Policy 21 — Personnel Security / Screening Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 21. Values shown as [X] are placeholders still to be set.

Purpose

To reduce insider risk by screening personnel in roles with access to CHD/PHI, subject to local law.

Scope

Applies to all personnel in roles with access to CHD/PHI.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Background screening must be performed for personnel in sensitive roles prior to access, subject to local law.

2Screening records must be documented and retained confidentially.

3Re-screening must be considered upon significant role change where permitted.

Roles & responsibilities

Role	Responsibility
HR	Perform and document screening.
Security Officer	Verify screening before sensitive access is granted.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→