Background screening for IT and tech: NIS2 and ISO 27001

Most security budgets go to firewalls, endpoint protection and monitoring. But many incidents start with a person who already has legitimate access: a new hire with a fake CV, a contractor nobody vetted, or an admin with a history you never checked.

In tech, that risk is concentrated in a small group of roles. The people who write, deploy and manage your systems can read customer data, change production code and switch off logging. Screening them before they get access, and again when their role changes, closes a gap that technical controls alone cannot.

What goes wrong without screening

• CV fraud: invented degrees, certifications or employers, which are harder to spot now that AI writes many applications.
• Identity fraud: candidates who are not who they say they are, including remote hires who never meet the team in person.
• Insider risk: people with relevant criminal records or conflicts of interest gaining admin rights.
• Supply chain gaps: external engineers and managed service providers accessing your systems without the checks your own staff go through.

NIS2 (Directive (EU) 2022/2555) sets cybersecurity rules for essential and important entities across the EU. Many tech companies fall within scope directly, for example cloud providers, data centres, managed (security) service providers and other digital infrastructure. Many more are affected indirectly, because their NIS2-regulated customers must manage supply chain risk and will ask suppliers for proof.

Article 21 requires risk-management measures that include human resources security and access control. For digital infrastructure and ICT service providers, Implementing Regulation (EU) 2024/2690 goes further: it expects background verification checks on employees and, where appropriate, contractors, in proportion to their role and in line with local law.

In the Netherlands, NIS2 applies through the Cyberbeveiligingswet (Cbw), which has been in force since 15 August 2026. Management boards are accountable, so screening is now a board-level topic, not just an HR task.

What this means in practice:

• Define which roles have access to critical systems and data.
• Set a screening level for each of those roles and record why.
• Screen before access is granted, and re-screen when roles or risks change.
• Apply the same standard to contractors and IT service providers.
• Keep evidence you can show a regulator or customer.

Read more in our NIS2 guide on which staff to screen.

If you are ISO 27001 certified, or working towards it, screening is not optional. Annex A control 6.1 (Screening) in ISO/IEC 27001:2022 requires background verification checks on candidates before they join, and on an ongoing basis. The checks must respect laws, regulations and ethics, and be proportional to business requirements, the classification of the information people can access, and the risks involved.

Auditors usually look for three things:

• A documented screening policy that links checks to roles and risk.
• Consistent execution: every person in a role gets the same checks, at the right moment.
• Evidence: dated, traceable results for each employee and contractor.

Pescheck gives you all three. You set screening packages per role once, candidates complete their part online, and every result is stored in one audit-ready dossier.

Upgrading from ISO 27001:2013? The former control A.7.1.1 is now A.6.1. Read more on our ISO 27001 page.

Not every role needs the same screening. The more access someone has, the deeper the check. Use this table as a starting point and adjust it to your own risk assessment.

The right checks depend on local law, the role and your risk assessment. Some checks, such as criminal record or credit checks, are only allowed for specific roles or with the candidate's consent.

1. Set up role packages. Choose the checks for each IT role once, based on the table above or your own risk assessment.
2. Invite the candidate. They receive a secure link and complete their part online, from any device.
3. We run the checks. Our screening specialists verify the information and keep you updated in the dashboard. Results are ready within 24 hours on average.
4. Get an audit-ready report. Results are stored per person, with dates and sources, ready for your NIS2 or ISO 27001 audit.

Screening is GDPR-compliant and the candidate stays in control of their data throughout. Want to connect screening to your HR system? Pescheck works with more than 160 systems and offers a REST API.