Every candidate who is to become personnel is to undergo background verification before joining and on a continuing basis, within applicable law, regulation and ethics, and in proportion to business needs, the classification of the information they will reach and the perceived risk. Purpose: confirm that people qualify for and fit the jobs they are being considered for and stay so throughout their employment. Guidance: screen all personnel, full-time, part-time and temporary, and where people come through service suppliers, write screening requirements into the supplier contract. Candidate information is collected and handled under the law of the relevant jurisdiction, which may require candidates to be told in advance. Verification respects privacy, PII and employment law and, where allowed, includes satisfactory business and personal references, a check that the CV is complete and accurate, checking the degrees and professional credentials the person claims, independent identity verification using an official document, and deeper checks such as credit or criminal record review for critical roles. For information security roles, confirm the candidate is competent and trustworthy, especially where the role is critical. Where a job, on appointment or promotion, gives access to processing facilities and especially to confidential information such as financial, personal or health data, consider more detailed checks. Procedures define criteria and limits: who may screen, and how, when and why checks are done. If checks cannot be finished in time, apply mitigations until they are, such as delaying onboarding or the issue of corporate assets, onboarding with reduced access, or ending employment. Repeat checks periodically according to the criticality of the role.
This control maps to 51 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 6.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 51 it maps to, and the evidence behind each claim, over MCP and REST.