SOC2-CC1-BACKGROUND-CHECKS
Employee Background Check Process
What this control does
Pre-employment background screening for all employees and contractors with access to customer data or production systems.
Implementation guidance
Run criminal background checks through a third-party provider (e.g., Checkr) for all hires before granting system access. Maintain a log of checks completed. For contractors, require their employer to certify equivalent screening.
Requirements satisfied
Why it matters
Background checks reduce the risk of hiring individuals with criminal histories who could compromise customer data, intellectual property, or system integrity. A missing or incomplete screening process creates an unmitigated people risk that cannot be compensated for by technical controls, potentially exposing the organization to data breaches, fraud, or regulatory violations.
Evidence to collect
- Background check vendor contract and service agreement (e.g., Checkr, Sterling, First Advantage) showing scope and criminal history coverage
- Completed background check reports for a sample of 5–10 recent hires with hire dates and access grant dates
- Signed acknowledgment forms from employees confirming receipt of background check disclosure and consent
- Contractor employer certification letters or equivalent screening evidence for a sample of 3–5 active contractor accounts with system access
Testing procedure
Request the background check vendor list and reconcile against active employee and contractor records with system access. Verify that background checks were completed *before* access was provisioned by comparing check completion dates to access grant timestamps in your identity management system. For a sample of 10 hires, validate that signed consent forms and actual check reports exist in the personnel file. Confirm contractor screening by obtaining employer certifications or equivalent third-party reports. Identify any system users who lack documented evidence of background screening and trace why (e.g., legacy accounts, oversight).
Common gotchas
Organizations often perform background checks only at hire and forget to re-check contractors during renewal periods—establish a contractor re-screening cadence (typically annual). Another common miss: checking off the box for an employee but failing to actually *wait* for results before granting access; automate the access provisioning trigger to fire only after the background check vendor marks the check as "clear" or equivalent approval status.