Why it matters
Background checks are a basic control against hiring someone into a position of trust who shouldn't be there.
How a self-led small team implements it
Proportionate screening (reference checks, ID verification) for roles with real access is enough — you don't need the same depth for every hire.
What auditors expect to see
Screening/background check records for relevant roles.
Track A.6.1 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS