Background Verification Policy¶
Classification: Internal
Document status: Effective
Version: 1.1
Owner: Management / Security Owner
Review cycle: Annual; interim revision upon material change to screening providers, law, or customer contract terms
Document control¶
| Role | Name |
|---|---|
| Prepared by | Management / Security Owner (Cloudnaut) |
| Reviewed by | Sandeep AC |
| Approved by | Sandeep AC |
Revision history¶
| Version | Date | Summary | Reviewed by | Approved by |
|---|---|---|---|---|
| 0.9 | 2021-03-14 | Draft for third-party review prior to first effective release. | Nidhi Jain (third party) | — |
| 1.0 | 2021-06-18 | Initial effective release. | Nidhi Jain (third party) | Sandeep AC |
| 1.0 | 2024-03-11 | Scheduled annual review; clarifications and cross-references (retained at version 1.0). | Nidhi Jain (third party) | Sandeep AC |
| 1.1 | 2026-10-15 | Screening provider updated to Kyra; consent, recheck triggers, and adverse-result handling defined; linked to HR Security Policy. | Sandeep AC | Sandeep AC |
Purpose¶
This policy defines background verification requirements for personnel who may access company or customer systems, repositories, data, or confidential information.
Scope¶
This policy applies to employees, contractors, and subcontractors assigned to customer-facing or security-sensitive roles.
Policy¶
Background verification is conducted through Kyra (or a successor provider approved under the Third-Party and Supplier Security Policy) prior to onboarding or prior to assignment to customer work, according to role and engagement requirements.
Screening may include identity verification, employment verification, education verification, criminal history checks where legally permitted, and additional checks required by contract or jurisdiction.
Screening is performed only with the individual’s written consent, and personal data collected for screening is handled in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 as its rules come into force.
This policy is part of the personnel security lifecycle defined in the HR Security Policy.
Rechecks¶
Initial screening occurs at hire or before substantive customer access. Rechecks are performed:
- at the interval a customer contract requires, for personnel assigned to that customer;
- when an individual moves to a materially more sensitive role (for example privileged access to production or regulated data);
- at a baseline interval set by management and recorded internally, for personnel in security-sensitive roles.
Adverse or incomplete results¶
Customer access is not granted while screening is incomplete unless management and, where required, the customer approve in writing. Adverse or discrepant results are reviewed by management with the individual given an opportunity to respond, and the outcome is recorded.
Records and confidentiality¶
The organization retains confirmation of completion and outcome category as permitted by law. Detailed reports are handled as confidential and shared only where legally and contractually required. Screening records are held in an internal, access-restricted location and are never published on this site.