---
title: "Are job applicants screened (credit, criminal records, drug testing) as permitted by law?"
url: https://insuranceposture.com/questions/governance-and-workforce/job-applicants-screened-as-permitted-by-law
category: "Governance and workforce"
canonical_key: q_gov_006
evidence_state: attested
updated: 2026-08-24
---

# Are job applicants screened (credit, criminal records, drug testing) as permitted by law?

URL: https://insuranceposture.com/questions/governance-and-workforce/job-applicants-screened-as-permitted-by-law
Section: Governance and workforce
Evidence state: Attested, not tenant-verifiable

Screening addresses insider risk at the only point where it is cheap to address: before access is granted.

## What the carrier is actually asking

The carrier is asking whether background checks are performed on new hires to the extent permitted by law, which varies considerably by jurisdiction. It is usually more concerned with roles holding privileged access or financial authority than with the whole workforce.

## Why it is underwritten

Insider incidents are less frequent than external ones and more damaging per event, because the insider already has access and knows where things are. Screening is the control that operates before access exists, and carriers ask about it as part of the personnel security picture.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Screening is a human resources process, so it is attested. The important part is that it is risk-based and legally compliant.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| HR process | Screening policy by role, with what is checked | Identity, right to work, references, and where lawful and proportionate, criminal record checks. Attested |
| HR process | Enhanced screening for privileged and finance roles | Deeper checks where the access justifies it, rather than a uniform baseline |
| Contractors | Whether contractors and agency staff are screened | Screening carried through to the workforce that is not on payroll |
| Legal | Compliance with local employment and privacy law | Checks limited to what is lawful in each jurisdiction, since over-collection creates its own liability |
| Records | Evidence that screening was completed before access was granted | Sequence matters: screening after access has been granted answers a different question |

**Screening is jurisdictionally constrained**

The question says as permitted by law for a reason. Several jurisdictions restrict criminal record and credit checks sharply. A risk-based approach that respects those limits is the correct answer, and it should be described as such rather than as a blanket yes.

## What a defensible yes requires

- Screening is risk-based, with deeper checks for privileged and financial roles.
- It respects the legal limits of each jurisdiction.
- Contractors and agency staff are covered.
- Screening completes before access is granted.
- Records are retained in line with privacy obligations.

## How this answer goes wrong

Employees are screened thoroughly and contractors are not, while contractors hold administrative access. The screening programme covers the population with the least access and omits the one with the most.

## If this answer turns out to be wrong

The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Are criminal record checks required?

Not by carriers, and they are restricted in several jurisdictions. Identity and right-to-work verification plus references is a reasonable baseline.

### Should we re-screen existing staff?

Periodic re-screening for privileged roles is done in some sectors and is not a general expectation. Where it happens it should be lawful and disclosed.

### What about acquired employees?

They arrive with whatever screening the acquired company performed. Reviewing that during integration is worth doing, particularly for privileged roles.

### Does this matter much to carriers?

Less than the technical controls. It contributes to the personnel security picture alongside offboarding and training.

## Related questions

- [Does the Applicant terminate computer access promptly when employee/contractor leaves?](https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves)
- [Does the use and distribution of administrator and privileged access require senior management approval?](https://insuranceposture.com/questions/access-control/distribution-administrator-privileged-access-require-senior-management-approval)
- [Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?](https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors)
- [Are all accounts associated with legitimate processes or current users (no orphaned/stale)?](https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.