ISO 27001:2022 Annex A 6.1 Screening

In this guide, I will show you exactly how to implement ISO 27001 Annex A 6.1 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 6.1 Screening

ISO 27001 Annex A 6.1 requires organizations to conduct background verification checks on all candidates prior to joining and on an ongoing basis. This control ensures that everyone, from full-time employees to temporary contractors, is trustworthy and qualified for their role. Screening must be proportionate to the risk, the classification of the information they will access, and applicable local laws.

Core requirements for compliance include:

• Risk-Based Proportionate Screening: Not everyone needs the same level of checking. A receptionist may only need an identity check, while a Database Administrator or Finance Director will likely require criminal and credit checks.
• Pre-Employment Verification: Checks must be completed before the individual is granted access to live systems or sensitive data.
• Ongoing Monitoring: Screening is not a “one-off” event. High-risk roles (like IT Admins or Executives) should have their checks repeated periodically.
• Third-Party Alignment: If you use contractors or outsourced services, you must ensure your suppliers are conducting screening to the same standard as your internal team.
• Legal & Ethical Compliance: All screening must adhere to local employment laws and data privacy regulations (e.g., GDPR). You must obtain explicit consent from the individual before conducting background checks.

Audit Focus: Auditors will look for “The HR Gap”:

1. The Onboarding Process: “Show me the record for the last person you hired. Were their references and ID verified before their start date?”
2. Handling Failures: “What is your process if a background check comes back with a ‘fail’ result? Who makes the final decision?”
3. Third-Party Evidence: They will often ask to see redacted screening results for a random sample of both permanent staff and contractors.

Screening Level Matrix (Audit Cheat Sheet):

Role Level	Required Checks	Why it matters
Intern / Contractor	ID + Right to Work + 1 Reference.	Verifies identity and basic reliability.
Standard Employee	ID + Right to Work + 2 Refs + CV Check.	Confirms employment history and qualifications.
IT Admin / Finance	Standard + Criminal (DBS) Check.	Reduces risk of internal fraud or data sabotage.
Director / C-Level	Enhanced + Credit & Directorship Check.	Protects against financial conflict of interest.

What is ISO 27001 Annex A 6.1?

ISO 27001 Annex A 6.1 is about screening which means you must do a background check on people before they gain access to systems and information.

ISO 27001 Annex A 6.1 Employee Screening is an ISO 27001 control that wants you to do background checks on people before, and during, employment.

It understands that it has to be in line with the law, ethics and regulation and nods to the fact that it is based on what people do and what they can access.

ISO 27001 Annex A 6.1 Purpose

The purpose of ISO 27001 screening is to ensure we have checked people to an appropriate level before they get access to our data and information. It is proportionate to risk and done in the framework of applicable laws but the purpose is to reduce risk by making sure that people are who they say they are, can do the things they say they can do and don’t have any indicators they will do something bad.

ISO 27001 Annex A 6.1 Definition

ISO 27001 defines ISO 27001 Screening as:

Background verification checks on all candidates to become personnel should be carried out prior to joining the organisation and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks. 

ISO27001:2022 Annex A 6.1 Employee Screening

Watch the ISO 27001 Annex A 6.1 Tutorial

In the video ISO 27001 Screening Explained – ISO27001:2022 Annex A 6.1 I show you how to implement it and how to pass the audit.

ISO 27001 Annex A 6.1 Explainer Video

In this beginner’s guide to ISO 27001 Annex A 6.1 Screening, ISO 27001 Lead Auditor Stuart Barker and his team talk you through what it is, how to implement in and how to pass the audit. Free ISO 27001 training.

ISO 27001 Annex A 6.1 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 6.1 Screening. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 6.1

Who should be screened?

The headline guidance is to perform background checks on everyone which includes people that are:

• full time
• part time
• temporary
• or third party supplier resources.

Background checks and the law

Speak to your legal team or legal counsel to guide and agree with you what can and cannot be done. That always takes precedence.

Given that background checks typically involve the collection, processing, and transfer of personally identifiable information and protected characteristics (as defined by UK law), organisations must adhere rigorously to all applicable employment laws in every jurisdiction where they operate.

ISO 27001 Background Check Requirements

The level of background checks is going to be proportionate to need and risk but to consider the common requirements:

• References
• Verify the CV
• Confirm qualifications
• Verify Identity
• Where appropriate, criminal or finance checks.

Enhanced Vetting

The level of checks is going to be proportionate to the role and the risk posed. Not everyone will go through a full and rigorous check but there are roles that are inherently risky and require additional checks to be put in place. Common examples of roles requiring enhanced vetting include:

• Admins
• Power users
• Directors
• Those with financial authority
• Those with legal authority
• Those processing highly confidential or protected characteristic data

Information Security Roles

For people in information security roles you will make sure people are competent to do the job and can be trusted. This seems to push the industry certifications agenda and I am unsure how you can measure trust but be aware of it.

What if you can’t do the checks in time

If you cannot do the checks in time the standard has some pretty harsh guidance. I am not sure I agree in total but their approach is around delaying them joining, not giving them company stuff, allowing them only limited access or even sacking them. There is a limit to how practical this is so use judgement and have something in place for when you don’t get the results of checks back in time.

Do it and do it again

Now there has to be a mechanism for repeating the checks periodically. You define periodically. Just document how often you do it but do it proportionate to your needs and your risks.

Screening Process

Screening procedures must clearly identify responsible personnel and the purpose of the screening process.

Where to get more guidance

You can get more guidance in the beginner’s guide to ISO 27001 background checks.

Screening Level Matrix Example

Role Level	Basic Check	Standard Check	Enhanced Check
Intern / Contractor	ID + Right to Work.	1 Reference.	N/A
Standard Employee	ID + Right to Work.	2 References + CV Check.	N/A
IT Admin / Finance	ID + Right to Work.	2 Refs + CV Check.	Criminal (DBS) Check.
Director / C-Level	ID + Right to Work.	2 Refs + CV Check.	Credit Check + Directorship Check.

ISO 27001 Annex A 6.1 Implementation Checklist

Screening ISO 27001 Annex A 6.1 Implementation Checklist:

1. Establish a Screening Policy

Challenges

• Defining a clear and consistent policy that aligns with legal and regulatory requirements can be challenging.
• Ensuring the policy is communicated effectively to all relevant stakeholders (e.g., HR, hiring managers, candidates) can be difficult.

Solutions

• Involve legal and HR departments in the policy development process.
• Conduct a thorough risk assessment to determine the appropriate level of screening for different roles.
• Clearly document the ISO 27001 screening policy and make it readily available to all stakeholders.
• Provide training to HR and hiring managers on the screening policy and procedures.

2. Determine Screening Procedures

Challenges

• Selecting the most appropriate screening methods (e.g., background checks, reference checks, drug tests) can be complex.
• Ensuring that screening procedures are fair, equitable, and compliant with relevant laws and regulations is crucial.

Solutions

• Conduct research and consult with legal and HR experts to identify appropriate screening methods.
• Develop clear and documented procedures for each screening method.
• Obtain necessary consents from candidates before conducting any screening activities.
• Regularly review and update screening procedures to reflect changes in legal and regulatory requirements.

3. Conduct Thorough Background Checks

Challenges

• Obtaining accurate and reliable information from third-party providers can be challenging.
• Ensuring that background checks are conducted in a timely and efficient manner can be difficult.
• Maintaining the confidentiality of sensitive information throughout the screening process is crucial.

Solutions

• Utilise reputable and reliable background check providers.
• Establish clear timelines and service level agreements with background check providers.
• Implement robust data security measures to protect sensitive information.
• Conduct regular audits of background check providers to ensure compliance and accuracy.

4. Verify References and Credentials

Challenges

• Contacting and obtaining information from references can be time-consuming.
• Verifying the authenticity of educational and professional credentials can be complex.

Solutions

• Develop a standardised reference check form to ensure consistency.
• Utilise automated tools to streamline the reference check process.
• Verify credentials with official sources (e.g., educational institutions, professional licensing boards).
• Establish clear guidelines for handling discrepancies or inconsistencies.

5. Document and Maintain Records

Challenges

• Maintaining accurate and up-to-date screening records can be time-consuming and resource-intensive.
• Ensuring that screening records are stored securely and confidentially is crucial.

Solutions:

• Utilise an applicant tracking system (ATS) or other electronic system to store and manage screening records.
• Implement access controls to restrict access to sensitive information.
• Establish data retention policies and procedures for the secure destruction of outdated records.

6. Conduct Ongoing Monitoring and Review

Challenges

• Identifying and addressing any issues or concerns with the screening process can be challenging.
• Ensuring compliance with evolving legal and regulatory requirements is crucial.

Solutions

• Regularly review and analyse screening data to identify trends and areas for improvement.
• Conduct periodic audits to ensure compliance with internal policies and external regulations.
• Stay informed about changes in relevant laws and regulations and update screening procedures accordingly.

ISO 27001 Annex A 6.1 Audit Checklist

How to audit ISO 27001 Annex A 6.1 Screening

1. Is there a HR Screening Policy

• Does the policy aligns with legal and regulatory requirements
• Is the policy communicated, available to all and evidenced as being accepted.
• Were legal and HR involved in the creation of the policy.

2. Are Screening Procedures Documented

• Review the documented process of screening and walkthrough the process to ensure that it is being implemented as documented.

3. Assess Background Check Providers

• Is there a third party supplier of background checks and screening.
• Check the contract with the supplier to ensure it is in date, covers services provided and that it contains information security clauses.
• Review industry certificates for information security for completeness.
• Check service level agreements with the supplier.
• Assess the information transfer solution with the supplier.
• Seek evidence of independent supplier review.

4. Audit Checks on References and Credentials

• Is the authenticity of educational and professional credentials conducted prior to employment.
• Is the reference check process standardised and in line with all laws and regulations.
• Are copies of checks made retained and if so for how long.
• Review the exception process for when checks fail or cannot be completed.

5. Review Documents and Records

• Review documents and screening records to check they are accurate and up-to-date.
• Audit the storage of records to ensure that it is secure and confidential, reviewing access rights and technical security controls.
• Check data retention policies and procedures for the secure destruction of outdated records.

6. Assess Ongoing Monitoring and Review

• Ensure that a regular review of compliance with evolving legal and regulatory requirements is conducted.
• Confirm internal audits have been conducted.

How to pass the audit of ISO 27001 Annex A 6.1

To pass an audit of ISO 27001 screening you are going to make sure that

• You have screened everyone that works in your organisation
• Screening is proportionate and appropriate to role
• You have documented evidence of all checks carried out
• Checks comply with all laws and regulations

What the auditor will check

1. Employee Screening in HR Processes

• The audit will focus on the integration of employee screening within your HR processes.
• Auditors will verify the existence of a documented onboarding process that explicitly includes employee screening procedures.
• They will likely request evidence of completed screenings for recently onboarded employees.
• If the information is confidential, providing redacted versions of screening results is usually acceptable.

2. Handling Screening Failures

• Auditors will assess your organisation’s response to failed background checks or screenings.
• It’s a common oversight to assume all screenings will be successful.
• A defined procedure for handling failed screenings, even if it involves escalation to the CEO or senior leadership, is crucial.

Top 3 ISO 27001 Annex A 6.1 mistakes and how to avoid them

1. Employing Friends, Family, or Acquaintances

While employing friends, family, or acquaintances is not inherently wrong, neglecting thorough background checks and screenings is a significant mistake.

Familiarity can lead to a false sense of security, tempting organisations to overlook necessary checks.

Even for these individuals, basic checks like right-to-work verification are essential, and all legal requirements must be strictly adhered to.

2. Lack of Documentation

ISO 27001 emphasises the importance of well-documented processes.

Relying solely on verbal instructions or informal procedures increases the risk of inconsistencies, errors, and non-compliance.

While HR professionals are valuable resources, ensure all personnel-related processes are formally documented.

3. Inadequate Document and Version Control

Maintaining accurate and up-to-date document versions is crucial for an effective ISO 27001 implementation.

Key aspects of good document control include:

• Consistent version numbering across all references.
• Regular reviews (at least annually) with documented evidence.
• Minimising or eliminating comments within official documents.

Fast Track Compliance with the ISO 27001 Toolkit

---

---

For ISO 27001 Annex A 6.1 (Screening), the requirement is to perform background verification checks on all candidates before they join and on an ongoing basis. This is a critical human resources control designed to ensure that the people you hire are trustworthy and competent.

While SaaS compliance platforms often try to sell you “automated background check integrations” or complex candidate tracking modules, they cannot actually verify a passport or conduct a nuanced reference check, those are human HR tasks. The High Table ISO 27001 Toolkit is the logical choice because it provides the governance framework you need to manage screening effectively, allowing you to use any background check provider without a recurring subscription fee.

1. Ownership: You Own Your Screening Policy Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your screening levels and store your candidate logs inside their proprietary system, you are essentially renting your own HR standards.

• The Toolkit Advantage: You receive the HR Screening Policy and Screening Level Matrix in fully editable Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as which roles require criminal checks), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World HR

Annex A 6.1 is about ensuring checks happen. You don’t need a complex new software interface to manage what an existing HR system or even a simple spreadsheet can track perfectly.

• The Toolkit Advantage: Your HR team already knows how to hire people. What they need is the governance layer to prove to an auditor that these checks are formal, consistent, and risk-based. The Toolkit provides pre-written policies and “Screening Level Matrices” that formalize your existing hiring work into an auditor-ready framework, without forcing your team to learn a new software platform.

3. Cost: A One-Off Fee vs. The “Per-Hire” Tax

Many compliance and HR SaaS platforms charge more as your headcount grows or per “background check” integration. For a control that applies to every single person in your company, these monthly costs can scale aggressively.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you hire 5 people a year or 500, the cost of your Screening Documentation remains the same. You save your budget for actual background check services rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your HR Strategy

SaaS tools often mandate that you use their specific background check partners. If their partners are too slow, too expensive, or don’t operate in certain countries, the tool becomes a bottleneck.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Screening Procedures to match exactly how your HR team operates, using any local or international background check provider. You maintain total freedom to evolve your HR strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 6.1, the auditor wants to see that you have a formal policy for screening and proof that you follow it (e.g., a matrix of check levels and candidate records). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Annex A 6.1 FAQ

Related ISO 27001 Controls

ISO 27001 Annex A 7.7 Clear Desk And Clear Screen

ISO 27001 Annex A 5.37 Documented Operating Procedures

Further Reading

The complete guide to ISO/IEC 27002:2022

ISO 27001 Clear Desk Policy Beginner’s Guide

ISO 27001 Annex A 6.1 Attributes Table

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Availability Confidentiality Integrity	Protect	Human resource security	Governance and ecosystem

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.