Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A high security environment requires trust in the integrity of the employees. I am talking about administrators, developers and everyone else who could compromise the security easily. One way to reduce the risk is the application of the four-eyes principle, centralized logging and other ways of surveillance.

In addition to that I noticed the trend that new employees have to undergo background checks before they are allowed to work on high security projects. I wonder what can be considered state-of-the-art concerning the screening of employees. Where are the legal boundaries and what is usually excepted by new employees?

share|improve this question
up vote 3 down vote accepted

High security projects are not the only place you should use employee background checks. Use background check for any position where you need significant trust in the person.

  • Anyone with authority to place a large order on company credit.
  • Anyone with the ability to draw a significant amount of cash from a company account.
  • Anyone able to authorize the issue of equipment of significant value (a car, construction equipment, high precision electrical diagnostic equipment).
  • Anyone capable of signing legal documents on the company's behalf.
  • Anyone with the ability to hire or fire individual employees or contractors.
  • Anyone who regularly works with competition sensitive information or trade secrets which give the company a competitive advantage.

What you are screening for is the potential for those individuals to betray the trust necessary to perform their duties. The individual may betray trust for their own advantage or for the advantage of someone else. The most universal reasons are: financial difficulties, substance abuse, criminal inclination. So you check their credit report, require a drug screening test, and check legal databases for criminal activity.

I suspect that potential candidates may object to aspects of a background screen depending on the region they live in. A financial analyst in London may react significantly differently from a financial analyst in Moscow.

I am not aware of the legal requirements surrounding background checks.

If there are other factors specific to your business or industry that may induce an employee to break a trust, you should consider them in a background check. Remember that circumstances and people do change and given a significantly long term of employment you may want to preform periodic reinvestigation.

share|improve this answer

I don't know about state of the art, but for high sensitivity positions in financial services in the UK you would expect the following to be checked:

  • criminal record
  • credit
  • terrorist connections
  • residency/right to work

In some countries this list is reduced, eg in Switzerland you won't get a credit check

share|improve this answer

I don't know about "state of the art" or where the legal boundaries are, but it's safe to say that new employees would expect some or all of the following:

  • criminal record
  • verification of previous employment
  • credit score
  • drug test

Additionally, I've known a couple of people who have applied for US government jobs, and the background check goes a bit deeper there. They send a questionnaire to a list of what I presume is friends, family, and colleagues listed by the applicant. At the very least I (as an applicant) would expect that you're going to check my list of references.

share|improve this answer

Criminal background check is as far as a company should go I feel credit checks shouldn't play a role because maybe if they had the job they r applying for it would be what is needed to improve on their credit and paying off debts

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.