Security vetting: what defence employers may pre-screen

Security vetting and pre-screening for defence employers

Security vetting for defence work is done by the state, not by you as the employer. In the Netherlands the intelligence services carry out the veiligheidsonderzoek, in Germany the Sicherheitsüberprüfung runs under the SÜG, and in the UK it is United Kingdom Security Vetting (UKSV). None of them will tell you whether a candidate is a good hire. They only decide whether that person may access classified information or sites.

That leaves a gap for HR. State vetting can take weeks or many months, and it starts only once you have chosen a candidate. Before and alongside it, you still need to confirm who the person is, whether they may work for you and whether their CV is true. This guide explains where the state's job ends, what you may check yourself, and how to plan hiring around vetting timelines.

It is written for HR, security and talent teams at defence, aerospace and space companies in Europe, especially those working under Dutch, German or UK rules. It is general information, not legal advice.

What security vetting is, and who does it

Security vetting is a state investigation into whether a person can be trusted with classified information, systems or sites. The outcome is a clearance or a formal declaration, not a hiring recommendation. As the employer, you designate or sponsor the role and register the candidate. The vetting authority does the rest.

Netherlands: veiligheidsonderzoek and VGB

In the Netherlands, anyone in a vertrouwensfunctie (position of trust) needs a verklaring van geen bezwaar (VGB) before they start. Defensie explains that this also applies to contractors and hired staff, and that the AIVD or MIVD carries out the investigation. Checks include judicial records and the BKR credit register. Investigators may also interview the candidate or people around them, and request information abroad.

Dutch vetting has three levels: A, B and C, with A the most thorough. As the employer, you get the role designated as a position of trust, register the candidate and wait for the VGB.

For defence suppliers, the security requirements in the contract decide which roles count as positions of trust. Since 1 January 2026, new government contracts that touch national security fall under the ABRO 2026, which builds on the defence-only ABDO 2019. Existing Defence contracts under ABDO stay as they are. Chapter 2 of ABRO covers personnel security and applies to every contract it governs. The Nationaal Bureau Industrieveiligheid (NBIV), a joint body of the AIVD and MIVD, checks whether your company complies.

Germany: Sicherheitsüberprüfung under the SÜG

German defence and space companies that handle classified material work within the BMWE's industrial security programme (Geheimschutz in der Wirtschaft). The company's security officer requests a Sicherheitsüberprüfung for each person who needs access, with the candidate's written consent. The BMWE then has it carried out together with the Federal Office for the Protection of the Constitution (BfV). There are three levels: Ü1 (simple), Ü2 (extended) and Ü3 (extended with security investigations). From Ü2 upwards, a spouse or partner is usually included. Candidates who have lived in Germany for only a short time can be hard to vet, because there is too little history to check.

United Kingdom: BPSS and national security vetting

In the UK, the Baseline Personnel Security Standard (BPSS) is the employer's own pre-employment check. It is not a security clearance. National security vetting (CTC, SC and DV, plus enhanced versions) sits on top and is run by UKSV. BPSS covers four checks: identity, right to work, employment history, and unspent convictions.

International programmes

Staff at international organizations and on NATO, EU or ESA programmes usually need a personnel security clearance from the national security authority of their own country. For a multinational team, that can mean several vetting systems with different timelines on one project.

What employers may pre-screen

You may check the facts a candidate gives you and the conditions for employing them: identity, right to work, qualifications, references and sanctions status. These checks are yours to run, before or alongside state vetting, as long as each one is needed for the role and the candidate knows about it in advance.

• Identity. Confirms the person is who they say they are, with a valid ID document. Run it first, before any other check or vetting request. Dutch employers must verify ID and keep a copy for payroll, but should keep only what the law requires.
• Right to work. Confirms the person may legally work for you in that country. Check it before the start date, ideally at offer stage, including permit conditions and expiry dates for non-EU nationals.
• Qualifications. Confirms that degrees, certificates and licences on the CV are real. Verify them after a conditional offer, with the issuing institution or a register such as DUO for Dutch diplomas.
• References and employment history. Confirms that past roles, dates and conduct match the CV. Contact referees only with the candidate's permission, and ask about gaps rather than reject on them.
• Sanctions lists. Confirms the person is not on EU, UN or national sanctions lists. Do it before the offer becomes final. A name match is not a hit: confirm it with date of birth and other identifiers.

Why these checks matter more in defence

State vetting looks at loyalty and vulnerability to pressure. It does not confirm that a candidate's degree in aerospace engineering exists or that they really led a satellite programme. A false CV that passes vetting is still a false CV.

Identity and right to work also come first in the formal process. Under the UK's BPSS, identity and right-to-work checks must be complete before a national security vetting application is started. Employment history and criminal record checks can follow but must be done before clearance is granted. Dutch and German vetting likewise needs correct identity details from the start.

Sanctions screening is a legal safeguard, not a background check. EU sanctions rules forbid making funds or economic resources available to listed persons, and salary counts. For defence and space firms, which often also hold export licenses, a sanctions hit is a compliance problem before it is an HR one.

Do it within privacy law

The GDPR applies to every one of these checks. Tell candidates in your vacancy or offer which checks you run and why. Collect only what the role needs, keep it secure, and delete it once the purpose is met. In the Netherlands, the NVP recruitment code adds that you contact references only with the candidate's knowledge.

What to leave to the state

Leave the deep, personal side of vetting to the vetting authority. Those checks are the reason state vetting exists, and the law gives the intelligence services powers that employers do not have.

• Criminal records beyond what the law allows you. Dutch private employers may not collect criminal data themselves; the route is a verklaring omtrent het gedrag (VOG) or, for positions of trust, the VGB. In the UK, a basic check on unspent convictions is part of BPSS, so there it is your job. In Germany, ask for a Führungszeugnis only where the role justifies it.
• Finances and debt. The Dutch vetting process checks the BKR credit register, and UK and German vetting look at financial vulnerability too. Running your own credit check is rarely proportionate for a private employer.
• Partners, family and contacts abroad. Vetting at higher levels includes partners and foreign ties. These are not questions for a job interview.
• Political views, religion and health. These are special categories of data under the GDPR. They have no place in your pre-screening.
• Open-ended social media trawls. Looking at public professional profiles to confirm a CV can be fine. Scrolling through private life to judge character is not, and it duplicates what investigators do with proper safeguards.

How long security vetting takes

Expect anything from a few weeks for standard UK checks to well over a year for the highest German level. Your own pre-screening, by contrast, usually takes days. That difference is why the order of steps matters.

• Netherlands (VGB, all levels): the legal deadline is 8 weeks, with a target of 90% of decisions within it (Minister of Defence, May 2025).
• Germany: in 2023, the BfV took on average 10 weeks for an Ü1, 12 weeks for an Ü2 and 71 weeks for an Ü3 (Bundestag 20/11836).
• United Kingdom: UKSV aims to complete 85% of CTC and SC clearances within 25 days, and 85% of DV clearances within 95 days (NAO, January 2023).

These are official figures, but real cases vary. Dutch vetting fell short of its 90% norm in 2023, before the joint vetting unit caught up again in 2025. UK vetting missed its targets through much of 2021 and 2022, according to the National Audit Office. Long stays abroad, a foreign partner or gaps in the questionnaire all add time.

Planning hiring around vetting

• Make a conditional offer. Make the contract depend on a positive vetting outcome and say so in writing.
• Finish your own checks first. A vetting request based on a wrong name or a fake employment history wastes weeks, and may end in a refusal for dishonesty.
• Give the candidate unclassified work, if you can. Onboarding, training and unclassified project work can start while vetting runs, where your security rules allow it.
• Ask about existing clearances. A candidate who already holds a VGB, SÜ or UK clearance may need a transfer or update rather than a new investigation. Check with your security officer.
• Keep in touch. Candidates in long vetting processes drop out. Regular, honest updates keep them on board.

A pre-screening workflow for defence and space employers

Run your own checks in a fixed order, so state vetting starts with clean, verified data. This sequence works for most defence, aerospace and space roles:

1. Define the role. Agree with your security officer whether the role needs vetting and at what level. Put it in the vacancy, so candidates know from the start.
2. Inform candidates. Explain which checks you run, why, and how long you keep the data.
3. Verify identity and right to work. Do this before anything else. In the UK it is a condition for starting national vetting.
4. Screen against sanctions lists. Check EU, UN and relevant national lists, and resolve any possible matches before the offer becomes final.
5. Make a conditional offer. Tie it to a positive outcome of both your pre-screening and state vetting.
6. Check qualifications and references. Verify degrees, licenses and recent employment history. Ask the candidate to explain gaps.
7. Start state vetting. Register the candidate with the vetting authority, and help them fill in the questionnaire fully and accurately.
8. Onboard to unclassified work. Where your security rules allow, let the new hire start on tasks that need no clearance.
9. Grant access once cleared. Give access to classified information, systems or sites only after the VGB, SÜ or clearance is in.
10. Keep screening proportionate after hiring. Vetting is repeated periodically. Report relevant changes as your security rules require, and recheck sanctions lists when they change.

Frequently asked questions

• Can we carry out security vetting ourselves?

No. Security vetting is a state task. You can request it for a designated role, but the investigation and the decision belong to the vetting authority: the AIVD and MIVD in the Netherlands, the BMWE and BfV in Germany, and UKSV in the UK.

• Can a new hire start before the VGB arrives?

Not in the position of trust itself. Dutch law lets someone fill a position of trust only once the VGB has been issued. Many employers let new hires start on unclassified work in the meantime, with the contract conditional on a positive outcome.

• Is a VOG the same as a VGB?

No. A VOG (verklaring omtrent het gedrag) looks only at relevant criminal records for a specific role. A VGB follows a full security investigation by the intelligence services and is needed for positions of trust. Ask your security officer whether a VOG is still required while the VGB is pending.

• What happens if vetting is refused?

The candidate cannot take the role that needs clearance, and a conditional offer lapses. As the employer, you usually hear the outcome but not the reasons. In the Netherlands, the candidate can object to a refusal and then appeal to the courts.

• May we ask about a candidate's nationality?

Only where a legal rule makes it relevant, such as an export licence condition or the vetting rules for the role. Otherwise, asking about nationality risks discrimination. Right-to-work checks will often show nationality anyway; record it only when you need it.

• How often is vetting repeated?

It depends on the country and level. All three systems repeat or update vetting periodically, and earlier when new facts come to light. Your security officer will know the cycle for each role.

• Pre-screening that fits defence hiring

State vetting answers one question: can this person be trusted with classified work? Your pre-screening answers the others: is this person who they claim to be, may you employ them, and is their CV true? Get those answers early, and vetting starts on solid ground.

Pescheck helps defence, aerospace and space employers run identity, reference, qualification and sanctions checks in one GDPR-compliant flow, so candidates are ready when vetting begins. See how we work with aerospace and defence teams.