How to answer
Are background checks performed on employees with access to customer data?
One of the few questions answered from an HR document rather than a security one, which is exactly why it is often answered from memory.
Yes. Background checks are performed on all employees prior to their start date, to the extent permitted by local law, and cover identity, right to work and criminal record where lawful. Contractors with access to production are subject to equivalent checks.
FillTrust grades an answer like this confirmed in your documents when your documents support it.
- Answered from
- Your HR or personnel security policy. This is one of the few questions answered from a document security never touches.
- Evidence to attach
- Never the checks themselves. Occasionally a statement of what the check covers.
- Where it is asked
- CAIQ v4.0 · HRS-01SIG LiteISO 27001 Annex A · A.6.1
This question is unusual on a security questionnaire because the document that answers it does not belong to the security team. It lives with HR, it is often the thinnest policy the company has, and it is therefore one of the questions most likely to be answered from somebody's recollection of what the recruiter said.
Three things make an answer here solid.
Scope it to the right people. The question is about people with access to customer data, and at a small company that is a wider set than "employees". Contractors, fractional staff and the agency developer who still has a production credential all belong in the answer. Reviewers ask about contractors specifically, because they are the population most often left out.
Say what the check covers, briefly. Identity and right to work are near-universal; criminal record checks are common in some jurisdictions and unlawful or heavily restricted in others; credit checks are usually reserved for finance roles and read as excessive elsewhere. Two clauses is enough.
Bound it by law, in the answer itself. "To the extent permitted by local law" is not hedging. It is the clause that makes the sentence true for a company that hires across several countries. Several European jurisdictions restrict criminal record checks for ordinary roles, so an unqualified claim that all staff are criminal-record checked is either false or describes something you should not be doing. Reviewers who work at international companies read the qualified version as more competent, not less.
Timing: pre-employment screening is the norm and is a complete answer. Periodic re-screening exists at larger and more regulated companies and is not expected of a startup. Do not claim it to look thorough; it is the sort of detail an auditor will later ask for evidence of.
How this one goes wrong
Specific to this question, not general advice.
- Answering for employees and omitting contractors, who are frequently the ones with production access.
- Ignoring the legal limits. Criminal record checks are restricted or unlawful for most roles in several European countries, and "to the extent permitted by local law" is the phrase that makes the answer true everywhere you hire.
- Claiming ongoing re-screening you do not perform. Pre-employment is the norm and is a fine answer.