Personnel Security and Background Screening Guide: Screening, Ongoing Assurance and Leavers

Most insider incidents are carried out by people who passed every check on the day they joined, so a one-off background screen is the start of personnel security, not the whole of it. Personnel security is the set of policies and procedures that reduce the risk of people exploiting legitimate access to an organisation's assets or premises. This guide covers role-based screening (with the UK BPSS and BS 7858 baselines and the US FCRA process), the data protection limits on criminal records checks, ongoing assurance after hiring, and the leaver process, including the API keys, tokens and service accounts a leaver created. It is for security, HR and IAM teams. It is not legal advice: screening law differs by country and, in the US, by state.

Key takeaways

• Screen by role, not by headcount. A role-based risk assessment sets the screening level for each post, so privileged engineers, finance approvers and support agents with bulk data access get deeper checks than everyone else.
• Identity comes first. Every other check is worthless if the person is not who they claim to be, and remote hiring has made identity fraud (including North Korean IT worker schemes) a real hiring risk.
• Criminal records data is regulated. In the UK a clear DBS result is still criminal offence data under Article 10 UK GDPR, and in the US the FCRA sets a fixed disclosure and adverse action sequence.
• Assurance continues after day one. Circumstances change, so line managers, security appraisals for sensitive roles, reporting routes and proportionate monitoring do more than any pre-employment check.
• Leavers own machine credentials too. Disabling the human account does not revoke the API keys, personal access tokens, OAuth grants, signing keys and service accounts that person created or could reach.

What personnel security covers

Personnel security runs across the whole employment lifecycle, and it applies to contractors, agency staff, outsourced support teams and partners with access, not only employees. ProtectUK, drawing on NPSA guidance, cites CPNI research finding that over 75% of insider acts were committed by staff who had no malicious intent when they joined. That finding is why the discipline has three stages of equal weight:

• Pre-employment screening: confirming identity, right to work, history and, where justified, criminal record and financial standing before access is granted.
• Ongoing personnel security: line management, security culture, appraisals for sensitive roles, reporting routes, protective monitoring and access reviews when people move roles.
• Exit: risk-assessing departures, choosing the right exit option, recovering assets and revoking every human and machine credential.

Gaps open at the hand-offs between security, HR and IAM. See the Insider Threat Programme Guide for the wider programme this sits inside.

Role-based background screening

NPSA's employment screening good practice guide (April 2023) recommends a Role Based Risk Assessment to set minimum, medium and high screening levels per post, and warns that applying the same checks to every hire adds delay without reducing risk. In practice, map each role to its access and the harm it could cause:

A developer who can read production secrets or mint tokens holds privileged access even without an admin title. Keep the tier on the identity record so IAM can enforce it: no privileged role assignment until the screening tier for that role is complete. See the Privileged Access Management Guide.

The checks in detail

• Identity: NPSA advises verifying identity before any other check, combining document examination (ideally photo ID plus a current address document) with electronic database checks, and testing the applicant's knowledge of their own records, because a database hit only proves that an identity exists.
• Right to work: check and record nationality and immigration status before employment starts. BPSS allows a physical document check, a certified digital identity service (IDVT) or the Home Office online check, with the Employer Checking Service as the fallback.
• Employment and education history: NPSA recommends at least three years, ideally five for full screening, covering at least two employers where possible. Contact referees directly through independently found numbers rather than the ones the applicant supplied.
• Qualifications: compare originals with the application and verify directly with the institution, watching for degree mills. NPSA names UK ENIC and HEDD as verification tools.
• Criminal record: request only the level the role justifies (see the DBS table below) and assess any conviction case by case for relevance, seriousness and time elapsed. A conviction is not automatically a bar.
• Financial and media checks: financial checks only for sensitive or money-handling roles; media searches only where proportionate, and never as the sole basis of a decision.
• Overseas history: require applicants to account for significant time abroad and allow extra time. Where checks cannot be completed, NPSA suggests temporary, supervised access rather than a silent pass.

UK baselines: BPSS, BS 7858 and DBS checks

Two UK baselines are widely used. The Baseline Personnel Security Standard (BPSS), version 7.0 published June 2024, is the pre-employment standard for civil servants, the armed forces, temporary staff and government contractors with access to government assets, and it underpins national security vetting. BS 7858:2019 is the BSI code of practice for screening individuals working in a secure environment, used across the private security sector and by other industries; BSI lists it as current.

The level of a UK criminal record check is fixed by law, not by employer preference. The Disclosure and Barring Service (England, Wales, Channel Islands and Isle of Man) issues four levels:

Most security and IT roles are eligible only for a basic check. On standard and enhanced certificates, DBS filtering removes older non-specified convictions (for example adult convictions over 11 years old without a custodial sentence).

US background checks under the FCRA

When a US employer uses a consumer reporting company for a background report, the Fair Credit Reporting Act sets the process. The FTC's employer guidance lists the steps:

1. Disclose in writing that a report may be used for employment decisions, in a document separate from the job application. For investigative reports based on interviews, disclose the right to a description of the nature and scope of the investigation.
2. Obtain written authorisation, stated clearly if it is to cover reports throughout employment.
3. Certify to the reporting company that you gave notice, obtained permission and will not misuse the information.
4. Pre-adverse action notice: before rejecting or dismissing based on the report, give the person a copy of the report and "A Summary of Your Rights Under the Fair Credit Reporting Act".
5. Adverse action notice: after the decision, state that it was based on the report, give the reporting company's contact details, say the company did not make the decision, and explain the right to dispute and to a free report within 60 days.
6. Dispose of reports securely once record-keeping duties end.

Federal anti-discrimination law applies alongside the FCRA. The FTC guidance, reflecting EEOC rules, says to apply the same standards to everyone regardless of protected characteristics, and that criminal record policies which disproportionately exclude protected groups must be "job related and consistent with business necessity". Many states and cities add their own limits, so confirm local law.

Data protection limits on screening

Screening creates sensitive records, and data protection law limits what you can collect and how long you keep it.

• Criminal offence data: the ICO treats personal data about criminal convictions and offences under Article 10 UK GDPR, and this includes the absence of convictions: keeping a clear check result on a personnel file is processing criminal offence data.
• Conditions: you need an Article 6 lawful basis and a condition in Schedule 1 of the Data Protection Act 2018. The employment condition (Schedule 1, paragraph 1) requires an appropriate policy document covering the condition relied on, how you meet each principle, and retention and deletion. Keep that document for at least six months after the processing ends.
• Consent is not a basis: the ICO's example of a delivery company checking riders states that consent to a check is not a valid condition, because it would not be freely given and could not be withdrawn.
• Minimise and retain briefly: record that a check was done and the outcome rather than keeping certificates indefinitely, restrict access to HR and security, and set retention in the appropriate policy document.
• Assess the high-risk parts: a DPIA is sensible for screening programmes that include financial, media or ongoing monitoring checks. See the DPIA Guide.

The ICO states that its criminal offence data guidance is under review following the Data (Use and Access) Act, so check the current text before finalising policy. EU member state law may restrict employer access to criminal records further. See the GDPR Compliance Guide for Security Teams.

Remote hiring and identity fraud

Fully remote recruitment lets an applicant present a borrowed or synthetic identity, use a stand-in at interview and route a company laptop to someone else. The FBI's January 2025 public service announcement on North Korean IT workers lists indicators that HR and security can act on: the same VoIP numbers or email addresses on resumes from different applicants, AI or face-swapping in video interviews, sudden changes of mailing address or payment platform during onboarding, unauthorised remote desktop tools, and logins to one account from several countries in a short period. Its recommended mitigations:

• Verify identity repeatedly: at interview, at onboarding and through employment, not only at offer.
• Meet in person where possible: complete as much of hiring and onboarding in person as you can, including device collection.
• Audit staffing firms: confirm third-party agencies follow robust practices and audit them regularly.

See the Insider Threat from Fake IT Workers Guide and the Deepfake and AI Impersonation Guide.

Contractors and outsourced staff

NPSA recommends that contractors are screened to the same standard as employees with equivalent access, that contracts set screening requirements, audit rights and rules for re-engagement, and that the hiring organisation keeps the final decision. Confirm that the person who arrives is the person the supplier sent. The Coinbase insider breach shows why: attackers bribed outsourced support agents outside the US, who extracted data on 69,461 customers without any hacking. Screening alone does not stop bribery; case-scoped data access and bulk-read alerting matter as much. See the Third-Party Access Guide.

Ongoing personnel security

NPSA's ongoing personnel security guidance puts the line manager at the centre: managers notice behaviour changes first, so security duties belong in their job descriptions. The core practices:

• Security appraisals: annual for staff in sensitive roles identified by a personnel security risk assessment, covering changes in finances, address and circumstances, and any suspicious approaches.
• Reporting routes: a confidential route independent of investigators, with whistleblowing protection.
• Protective monitoring: proportionate to the risk assessment, combining HR, IT and physical access data, with unique credentials for every person and human review of alerts. Seek legal advice before introducing or changing it. See the Employee Monitoring and Privacy Guide.
• Re-screening triggers: BPSS has no expiry but requires a recheck on transfer, a break over 12 months, expiring leave to remain or a reported change. Add your own: promotion into a privileged tier or a contractor converting to staff.
• Movers: review access when people change roles so rights do not accumulate, and remove what the new role does not need, including passwords, tokens and recovered assets.

Leavers: human and machine credentials

NPSA recommends risk-assessing each departure with HR and security as soon as it is known, considering the reason for leaving, the destination employer and the sensitivity of access, then choosing one of three options: full access through notice, reduced access with supervision, or immediate exit. Then recover assets against a signed checklist and change shared passwords and door codes.

For technical staff the hardest part is the machine credentials they leave behind. Disabling the directory account through SCIM or the IGA platform does not remove:

The Coupang breach is the clearest example: a former engineer who had worked on the authentication system kept a token signing key that was never revoked or rotated after he left, and used it to forge access tokens. See the Joiner-Mover-Leaver Guide, the Employee Offboarding Security Guide and the NHI Offboarding and Decommissioning Guide.

How to implement

1. Inventory roles and access: list roles, the systems and secrets each can reach, and assign a screening tier. Start with privileged and bulk data roles.
2. Write the policy and legal basis: screening policy per tier, appropriate policy document for criminal records data in the UK, FCRA disclosure and adverse action templates in the US, and local law review elsewhere.
3. Pilot: run the tiers for one department for a quarter, measuring time to hire and exceptions.
4. Connect HR to IAM: make the HR record the trigger for joiner, mover and leaver events, and block privileged role assignment until the tier is complete. Test with dummy joiners and leavers.
5. Add ongoing assurance: appraisals for sensitive roles, re-screening triggers and reporting routes.
6. Extend the leaver runbook to NHIs: ownership transfer and token, key and grant revocation, verified by a second person. Roll back a faulty automated revocation by reissuing from the vault rather than by suspending the leaver process.

Small vs large: a small company can buy screening from a BS 7858-aligned or FCRA-compliant provider and focus on identity checks and the leaver runbook; a large or regulated one needs documented tiers, supplier audits and IGA-driven revocation with evidence.

Detection and measurement

Log screening completion against the identity record, access granted before screening was complete, re-screening triggers, and every leaver revocation step with timestamps. Useful metrics:

• Screening before access: percentage of privileged role assignments made only after the required tier was complete (target 100%).
• Contractor parity: percentage of contractors with access equivalent to staff who were screened to the same tier.
• Leaver revocation time: median hours from last day to disabled account, and separately to revoked tokens, keys and grants.
• Orphaned NHIs: count of service accounts, tokens and keys whose owner has left, trending to zero.
• Mover access drift: access removed within 30 days of a role change, as a percentage of movers.
• Exception age: open screening exceptions (unverified history, overseas gaps) older than 90 days.

Framework mapping

Common failure patterns

• Same check for everyone: privileged and bulk data roles end up under-screened.
• Access before screening: privileged access granted "temporarily" and never revisited.
• Contractors outside the process: outsourced and agency staff screened by the supplier to an unknown standard, as in the Coinbase support agent bribery case.
• Keeping certificates forever: DBS certificates on shared drives with no retention rule.
• Human-only offboarding: the account is disabled but tokens, keys and service accounts survive, as with the signing key in the Coupang breach.

Practitioner checklist

• Assign a screening tier to every role based on the systems, data and secrets it can reach.
• Verify identity first, in person or through a certified digital identity service, and again at onboarding for remote hires.
• Choose the UK baseline (BPSS, BS 7858 or both) that customers and insurers require, and request only the DBS level the law allows for the role.
• For US hires through a reporting company, follow the FCRA disclosure, authorisation and two-step adverse action sequence.
• Write the appropriate policy document for criminal offence data and set retention for screening records.
• Put contractor screening parity, audit rights and identity confirmation into supplier contracts.
• Block privileged role assignment in IAM until the required screening tier is recorded complete.
• Run security appraisals for sensitive roles and re-screen on promotion into a privileged tier.
• Extend the leaver runbook to tokens, API keys, OAuth grants, signing keys and owned service accounts, with a second-person check.

Standards and references

• UK Government: Baseline Personnel Security Standard (BPSS)
• BSI: BS 7858:2019 Screening of individuals working in a secure environment, Code of practice
• NPSA: Employment Screening, A Good Practice Guide
• NPSA: Ongoing Personnel Security, A Good Practice Guide
• ICO: Criminal offence data
• FTC: Background Checks, What Employers Need to Know
• FBI IC3: North Korean IT Workers Conducting Data Extortion
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Insider Threat Programme Guide · Joiner-Mover-Leaver Guide · NHI Offboarding and Decommissioning Guide · Physical Security Guide for Security Teams · Security Awareness and Human Risk Management Guide. This guide summarises screening standards and laws and is not legal advice.