PS004Screening during employment

The repetition of verification, in whole or in part, at a stated interval and on stated events: a move into a role of greater exposure, a return after a long absence, and a concern raised through any of the routes the program keeps open.

Pillar: PS | Personnel security
Sources cited: 7
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
PS004/EUMandatory	European Union	Commission Implementing Regulation (EU) 2024/2690European Commission · read 29 Aug 2026Directive (EU) 2022/2557 on the resilience of critical entities, articles 13 and 14European Parliament and Council · read 1 Sep 2026	What the directive’s categories hold, in an annex setting out asset classification, the inventory, access control, privileged accounts, and removable media as requirements rather than as headings.	For the digital infrastructure and service providers it reaches, the assignment of people to the roles that carry security responsibilities is reviewed at planned intervals and at least once a year, and changed where the review calls for it. For a critical entity the background check is not confined to recruitment either: it may be requested on a person who already holds the sensitive role or the authorization, in duly reasoned cases and against the Member State risk assessment.
PS004/HUMandatory	Hungary	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in all three security classes, persons are re-screened at a set frequency and when their authorization level or position changes.
PS004/SEMandatory	Sweden	Säkerhetsskyddslag (2018:585), 2 kap. 4 § and 3 kap.Riksdag · read 5 Oct 2026	For security-sensitive activities, that personnel security prevents persons who are not reliable from a security standpoint from taking part, that vetting is made before participation begins and followed up for as long as it lasts, that it rests on a basic investigation, register checks, and where required a special personal investigation, that posts are placed in security classes 1 to 3, and that register data are drawn continuously during participation.	For security-sensitive activities, the vetting is followed up for as long as participation lasts, and register data are drawn continuously during it; the Act sets no interval.
Recommended	Belgiumwhere written	CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026	What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch.	The background check is repeated periodically for the people in sensitive roles, so it is a standing condition of holding the role rather than a gate at the entrance.
Recommended	Finlandwhere written	Katakri 2020Kansallinen turvallisuusviranomainen · read 29 Aug 2026	The criteria an authority audits against, among them the requirement to recognize which functions call for special trustworthiness, a clearance graded on three scales, and log retention set by the limitation periods of the criminal law.	The clearances, the handling rights, the rights of use, the access rights, and the awareness of the duty not to disclose are all kept updated as changes occur, and the training that goes with a change is given before the change.
Recommended	United Kingdomwhere written	Ongoing Personnel Security: A Good Practice GuideNPSA · read 11 Aug 2026	Good practice for personnel security through employment rather than at the door, holding that protective monitoring should be proportionate.	Contracting is covered alongside employment, so the standard is set for people the organization does not employ.