What it asks for. Individuals must be screened before they are authorised to access the system and rescreened according to defined conditions and frequencies.
In practice. This means background checks proportionate to role and access level, within the limits of local employment and data protection law, which in many European countries restrict what can be checked. Higher-risk roles, such as privileged administrators or staff handling payments, may justify deeper screening. Auditors expect a screening policy, evidence that checks were completed before access was granted and records of rescreening where required.
Common gaps. Access is often granted before screening is finished. Contractors and staff who move into sensitive roles are frequently not screened to the higher standard. Rescreening rules are also seldom defined.