10.2.2 For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set …

Requirement

For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set out which roles, responsibilities and authorities shall only be exercised by persons whose background has been verified; (b) ensure that verification referred to in point 10.2.1 is performed on these persons before they start exercising these roles, responsibilities and authorities, which shall take into consideration the applicable laws, regulations and ethics in proportion to the business requirements, the asset classification as referred to in point 12.1. and the network and information systems to be accessed and the perceived risks.

Guidance

• Where applicable, define criteria for roles, responsibilities and authorities that will be exercised only by persons who have undergone background verification. An indicative, non-exhaustive list is the following:
  • executives and senior management,
  • roles with access to sensitive information,
  • roles with financial responsibilities,
  • roles involving procurement and vendor management,
  • roles that grant access to physical assets or are responsible for physical security.
• Define criteria and limitations for background verification (e.g. who is eligible to screen people, and how, when and why verification reviews are carried out).
• For background verification, consider checking the criminal records of the person concerned with regard to offences that would be relevant to a specific position.
• Ensure that checks of criminal records align with legal and regulatory requirements (e.g. national (labour) laws and the GDPR).
• Collect and handle information on job candidates, taking into consideration any applicable laws, regulations and ethics, including the protection of personal data. This may include collecting professional references.
• Consider screening requirements in the contractual agreements between the entity and the direct suppliers and service providers in cases of personnel contracted with an external supplier.
• Periodically repeat verification to confirm the ongoing suitability of personnel, depending on the criticality of a person’s role, responsibilities and authorities.
• Entities should be permitted to rely on background checks of contractors employed by a third-party talent agency with which the entity covered has contracts for performing services.

Examples of evidence

• Records of an analysis conducted to determine which roles, responsibilities and authorities require background verification.
• Guidance for employees about when/how to perform background verification.
• Records of completed verifications of professional references for employees or, where applicable, for direct suppliers and service providers.
• Signed consent forms from employees or job candidates, confirming their agreement to undergo background verification.
• Documentation of follow-up actions taken in response to any issues or discrepancies identified during background verification.
• Agreements with third-parties that perform background verification services, if used, to ensure they comply with legal and policy requirements.

1. Ülevaade

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

3. Seotud regulatsioonid

Lingitud teemad

• ENISA -