A.6.1 Screening
Control Objective
Background verification checks on all candidates to become personnel shall be carried out prior to joining the organisation and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks.
Policy Statement
anDREa mitigates insider risk by conducting mandatory background verification checks on all personnel prior to employment and on a regular, ongoing basis. Screening depth is determined proportionally based on role seniority, the risk classification of the data being accessed, and local statutory requirements.
Screening Requirements & Protocols
To satisfy both initial onboarding requirements and ongoing compliance, all personnel must successfully complete the following verification steps:
-
Identity Verification: A valid government-issued identity document (Passport or National ID Card; Dutch driving licenses are not accepted) must be inspected for authenticity against national regulatory standards and securely archived in the employee's personnel file (Identity Checks).
-
Certificate of Conduct (VOG): All Dutch personnel must provide a valid Certificate of Conduct (Verklaring Omtrent het Gedrag / VOG) or its localized international equivalent. This record must be updated and re-verified throughout the employment lifecycle based on role risk ((Identity Checks).):
- High-Risk Roles (C-Level, Management Team, Solutions Architects): Renewal and verification are mandatory every 2 years.
- Standard Roles (All Other Positions): Renewal and verification are mandatory every 5 years, or ad-hoc upon promotion or an expansion of data access privileges.
-
Skills and Certifications: While technical attitude and a continuous learning mindset are heavily prioritized, specific internal or external certifications are required depending on the role function.
Training & Compliance Monitoring
- Mandatory Training Registry: Active certification and training requirements are centrally tracked via the aanDREa People HR.
- Registry Governance: The Management Team maintains and reviews the training registry at least biannually, or immediately following significant operational or infrastructural changes, to ensure training requirements remain aligned with current platform risks.
Administration & Data Governance
- Personnel Records: Authenticated identity documents, VOG submissions, and signed employment clauses are securely stored within Employee Contracts.