questionnaire asks whether we screen employees before hiring

Personnel screening falls under human resources security, not access control

The question about screening for recruitment falls under personnel security, one of the ten measures under Article 21(2) NIS2 — explicitly named under point (g), together with conditions of employment and disciplinary measures for breaches. This is a different box from access control: screening concerns who you hire, access policy concerns what someone is permitted to see or do once they are inside. Do not automatically fill in "yes" to this question simply because an access matrix already exists — that is a different piece of evidence.

What counts as evidence depends on what happens in practice. A VOG requirement (certificate of conduct) for roles with access to sensitive systems is the most concrete proof. If that is absent, a fixed procedure in the recruitment process also counts: reference checks, identity verification, and for companies with ISO 27001 certification the screening clause from Annex A 6.1 (prior to employment). Without ISO certification and without a VOG policy, the answer is usually "no" or "partial" — and it is perfectly fine to enter it that way. Do not invent a screening process that does not exist; if the customer follows up on this, an honest "no, yes for roles X and Y" is stronger than a yes that will not hold up under audit.

Where this comes from: Article 21(2)(g) and Annex A 6.1

The ten measures of Article 21(2) NIS2 explicitly mention personnel security under (g), alongside access control and the management of corporate resources. In practice this is often assessed together with training in cyberhygiene, because both fall under the same human resources policy. For companies with ISO 27001 certification, the related management measure can be found in Annex A, under the clause on screening prior to employment — therefore check whether the company's ISO 27001 certificate covers this clause, as not every certificate is equally broadly scoped. For companies that themselves only fall under the Cybersecurity Act from 15 August 2026 onwards, this is not yet a legal obligation, but customers often already ask about it in anticipation of supply chain obligations.