NIS2 and employee screening: which staff should you screen?

Short answer: NIS2 contains no explicit duty to run background checks. It requires "appropriate and proportionate" cybersecurity risk-management measures, and one of the measures the Directive lists is "human resources security, access control policies and asset management" (Article 21(2)(i) of Directive (EU) 2022/2555).

The Directive does not define human resources security and does not name specific checks. Screening staff is one common way to meet this measure, and your own risk assessment decides for which roles it is proportionate. That is a decision you make and document, not a rule in the text.

The national laws repeat the measure in their own words:

• Netherlands: the Cyberbeveiligingswet (Cbw), article 21, third paragraph, point i: "beveiligingsaspecten ten aanzien van personeel, toegangsbeleid en beheer van assets" (security aspects regarding staff, access policy and asset management).
• Germany: section 30(2) no. 9 of the BSI Act (BSIG): "Konzepte für die Sicherheit des Personals, die Zugriffskontrolle und für die Verwaltung von IKT-Systemen" (concepts for personnel security, access control and the management of ICT systems).

Both also apply the proportionality test of the Directive: the measures must match your exposure to risk, your size and the likelihood and severity of incidents.

NIS2 applies to "essential" and "important" entities in the sectors listed in the Directive's annexes, such as energy, transport, banking, health, digital infrastructure, managed IT services, manufacturing and food. Each Member State implements it in national law.

• Netherlands: the Cyberbeveiligingswet (Stb. 2026, 187) and the Cyberbeveiligingsbesluit (Stb. 2026, 189) entered into force on 15 August 2026.
• Germany: the NIS2 implementation act (NIS2UmsuCG, BGBl. 2025 I Nr. 301) entered into force on 6 December 2025 and created the new BSIG. Under section 28 BSIG, an entity in a listed sector is "particularly important" from 250 employees, or from more than 50 million euro turnover plus a balance sheet total above 43 million euro. It is "important" from 50 employees, or when turnover and balance sheet total each exceed 10 million euro. Operators of critical installations are always particularly important, and some types, such as DNS providers and top-level domain registries, are in scope whatever their size.

Whether your organisation is in scope depends on your sector, size and services. Check this with the competent authority or legal counsel; this page does not decide it for you.

Because the law leaves the choice to you, the useful question is where a dishonest or unreliable person could do the most damage to your network and information systems. Organisations in scope typically look at these groups first:

• Staff with privileged or administrator access to networks, cloud environments, identity systems and backups.
• Developers and engineers with access to source code, build pipelines, secrets and production systems.
• Security, IT operations and SOC staff, including the people who can switch off monitoring.
• Finance, HR and payroll administrators with access to payments or large volumes of personal data.
• Managers and executives who approve security measures and carry responsibility for them. In Germany, section 38 BSIG makes the management responsible for implementing and monitoring the measures, and liable to the entity if they breach that duty.
• Supplier and contractor staff with similar access. Supply chain security is a separate measure in Article 21(2)(d) NIS2, so the way you cover their personnel belongs in your supplier risk assessment and contracts.

Staff without access to sensitive systems or data usually need no more than the standard identity and right-to-work check.

Match the checks to the role and the access, not to the regulation. The table is a starting point for your own risk assessment, not a legal requirement.

Screening is also not a one-off. When someone moves into a role with more access, rescreen for that role: see in-employment screening.

NIS2 does not override data protection law. Whatever you screen, the GDPR applies: you need a lawful basis, you may only process what is necessary for the role, and the person must be told in advance. More in our GDPR overview.

• Criminal records. Article 10 GDPR allows processing of criminal convictions data only under the control of an official authority or where national law allows it. In the Netherlands you do not look up records yourself: the candidate applies for a Certificate of Conduct (VOG) from Justis, assessed against a screening profile for the role. In Germany the Führungszeugnis is issued to the person (section 30 BZRG) and you can only ask for it where the role justifies it.
• Germany, employees. Section 26(1) BDSG allows processing of employee data only where necessary to decide on, carry out or end the employment relationship.
• Special categories. Health, religion, political opinion and similar data play no part in security screening.
• Works council. Where you have one, a screening policy usually needs its involvement.
• Security clearance is different. A formal security clearance under the German Security Clearance Act (SÜG) is carried out by authorities, not by employers, and only for security-sensitive activities defined in that law.

This page is general information and not legal advice.

Since the law asks for proportionate measures, the most useful thing you can show a supervisor is the reasoning:

1. List the roles with access to critical systems and data.
2. Decide per role which checks you run, and why they are proportionate.
3. Tell candidates and employees what you check, who does it and how long you keep the results.
4. Record the outcome and keep only what you need.
5. Review the list when roles, systems or suppliers change.

Pescheck runs these checks digitally, in the Netherlands, Germany and abroad, and keeps one record per person and role.