Do contractors need background checks for SOC 2?

The sources do not give one rule. Drata says the control is specific to new hires and new contractors and recommends checks for individual contractors and confirming that agencies check their own people. Vanta says checks are typically done on employees, vendors and contractors. Secureframe does not address contractors. Decide which contractors can reach company systems or customer data, check them or get written confirmation from the agency, and agree the scope with your CPA firm. The generated Human Resources Security Policy applies the same screening requirement to contractors with access.

Can we skip a background check where local law does not allow it?

Drata addresses this case and advises evaluating the new hire anyway and keeping an audit trail of the reasoning for the exemption. The generated policy works the same way: it says a criminal record check applies only where legally permitted, and where a check is not permitted the reason is recorded and an alternative, such as additional reference checks, is applied. Whether a given check is lawful, and what you must tell the candidate, depends on the country and in the US on the state, so check local law with counsel. This page is not legal advice.

Do we have to check existing employees?

Drata says the control is specific to new hires and new contractors, and that checking existing employees is recommended but not required. That is one publisher's reading, and the generated policy is written around candidates before they start. If you adopt the policy, the auditor tests the population it describes, so write the policy to cover who you actually screen.

Does the check have to be done before the start date?

Secureframe describes testing that a check was completed before the start date, and also states that US employees need a check within 30 days of employment without citing a source for that figure. The two do not agree and neither is a rule in the criteria. The generated Human Resources Security Policy commits to screening before the start date, so that is the timing an auditor would test against your own policy. If you cannot meet it, change the policy to say what you do before you adopt it.

Does SOC 2 require background checks? What the sources say and what auditors test

Updated 25 October 2026

Not as a specific, named check. The sources cited here say SOC 2 does not mandate background checks or dictate their type, but the criteria expect you to evaluate the people you hire, and auditors commonly sample new hires and ask for evidence that each one was screened. The form of the check, who it covers and what the law lets you do are your decisions, made under local law. Whether your approach is enough is the CPA firm's call. This guide shows who says what, what an auditor tests, how contractors fit and what to write down.

Short answer: no specific check is mandated, and a screening control is still tested

A SOC 2 report is written by a CPA firm after it examines your controls against the Trust Services Criteria. Those criteria describe outcomes, not a list of checks. Four outside sources on this exact question agree on the main point and differ in emphasis:

Source	On whether checks are required	What else it says
Drata	Says SOC 2 does not mandate background checks and does not specify the type of check.	Calls the control specific to new hires and new contractors, and says checking existing employees is recommended, not required.
Vanta	Says the framework does not "overtly mandate" checks for potential staff.	Says the auditor judges whether your hiring controls satisfy the criteria, and that robust alternative methods might still earn an unqualified opinion, which it says is not certain.
Secureframe	Describes screening of new hires as typical and a common audit evidence request, and says skipping it would likely draw scrutiny.	Describes the sample-based test covered below. Its page promotes a background-check integration.
OneUptime	Says the criteria do not impose one universal background-check package on every worker.	Treats screening as a design choice based on role risk, customer commitments and law.

Three of these publishers sell compliance software or tooling, so read them as one side of the question. They agree that no rule says "run this check on everyone", and they also agree that you should expect to be asked about it. Secureframe's page is the only one that attaches a hard number (checks "within 30 days of employment" for US employees) and it cites no criterion for it, so treat that as the author's practice, not a SOC 2 rule.

The criteria the sources tie it to

The generated Human Resources Security Policy is mapped to both of these criteria, and the sources connect background checks to them:

CC1.4 (Competent people): The company hires people who can do the job, checks their background where the law allows, and trains them so they can carry out their security responsibilities.
CC1.1 (Integrity and ethical values): Leadership sets a clear expectation of honest, ethical behavior, writes it down, and holds everyone (including contractors) to it.

Vanta ties checks to CC1.4 through a control about evaluating individual backgrounds and also to CC1.1, and Secureframe names CC1.1 as the criterion it connects to screening (Secureframe). Points of focus are guidance on how a criterion can be met, not separate requirements, which is why the criteria leave the method to you.

What the auditor does

Secureframe describes the test as sample-based. The auditor asks for a list of employees with hire dates, picks a handful, and requests evidence for each that a check was completed before the start date, showing the name, the date and who performed it (Secureframe). Vanta likewise says auditors select a few employee names and request their background check records (Vanta). Drata adds that the control covers new hires and new contractors (Drata). What a given firm samples, and how many, varies, so ask yours.

The practical consequence is that the list matters as much as the checks. If your hire list is incomplete or one sampled person has no record, that is the finding, whatever you did in fact. Keep one register of everyone who started, with the check status beside each name. The SOC 2 evidence checklist shows where this sits among the other records an auditor may sample.

What counts as a check

Drata says the requirements do not specify the type of check, and that each organization decides what its criminal background checks cover (Drata). Criminal history is the common choice. Vanta notes that other ways of evaluating a person's background can be used but says an unqualified opinion is then not certain (Vanta), so a firm may question an unusual approach. The generated policy lists the elements it commits to:

Human Resources Security Policy, 4.1: Every candidate for a role with access to Northwind systems, customer data or company finances is screened before their start date: identity verification, right-to-work confirmation, verification of the most recent employment, and a criminal record check where legally permitted in the candidate's jurisdiction and proportionate to the role. Where a check is not permitted, People Operations records the reason and applies an alternative such as additional reference checks.

Two things in that statement are worth reading closely. The criminal record check is conditioned on legal permission and on the role, and the policy provides a recorded alternative where a check is not permitted. Both match the advice in the Drata FAQ discussed below. If you will not run a particular element, for example you do not screen every role, edit the sentence to say what you will do before you adopt it.

Contractors and agencies

The sources do not agree on a single rule, which is itself the answer. Drata says the control is specific to new hires and new contractors, recommends checks for individual (1099) contractors, and recommends confirming that third-party firms check their own contractors; it ties the contractor decision to role and access level (Drata). Vanta says checks are typically performed on prospective employees, vendors and contractors (Vanta). Secureframe does not address contractors.

None of them says SOC 2 requires a check for every contractor, so decide by access: who can reach production, source code or customer data? Check those people, or obtain written confirmation from the agency that it screened them to an equivalent standard, and agree the scope with your CPA firm. The generated policy takes this approach:

Human Resources Security Policy, 4.9: Contractors, agency workers and vendor staff with access to Northwind Cloud Inc systems meet the same screening, acknowledgment, training and offboarding requirements as employees. Where the contracting entity performs screening, Northwind Cloud Inc obtains written confirmation that it is equivalent to Section 4.1.

Human Resources Security Policy, 5.9: Contractor lifecycle. Before a contractor receives access, People Operations confirms a signed services agreement with confidentiality terms, screening confirmation and policy acknowledgment, and records a contract end date on which access expires unless the engaging manager confirms an extension in writing. Owner: People Operations, with the engaging manager. Cadence: at engagement and on each extension.

Where the law limits you

This is the part to take to a lawyer. Background checks are regulated differently from country to country and, in the US, from state to state, covering things like what you may ask, what you must tell the candidate and what you must do before rejecting someone. Policyseed is not a law firm, and this page is not legal advice. Check local law with counsel for every place you hire. What the sources say, attributed to them:

Law can push either way. Vanta says many countries mandate screening by law (Vanta), while Drata has an FAQ for the opposite case, where country-specific laws prohibit background checks (Drata).
If a check is not allowed, evaluate and record. Drata advises evaluating the new hire's background and technical competency anyway and keeping an audit trail of the rationale for the exemption (Drata).
US screening companies. OneUptime says that in the US, using a third-party company to get employment background reports can trigger the Fair Credit Reporting Act, that FTC and EEOC guidance covers standalone disclosure, written permission, nondiscrimination and pre-adverse and adverse-action steps, and that state and local rules and other countries' laws may add requirements (OneUptime). Those are one author's summary, not a checklist, so confirm them against the current rules.

Write the legal limits into the control itself: which roles are screened, in which jurisdictions, with which checks, and what happens when a check is not permitted. OneUptime recommends defining covered roles and jurisdictions, the checks performed, timing relative to access, who approves exceptions and how sensitive results are handled (OneUptime).

Writing a control you can run

The Human Resources Security Policy that the generator writes covers screening in its statements and its procedures. These excerpts are rendered from the policy templates for the Northwind Cloud Inc sample intake, so they change when a template does. The company and product names in them are the sample's.

Human Resources Security Policy, 5.1: Pre-employment screening. After an offer is accepted, People Operations initiates screening through the screening provider or documented manual checks and reviews the results with the hiring manager before confirming the start date. Adverse findings are escalated to Executive Management and the decision is recorded. Owner: People Operations. Timing: complete before day one.

That procedure names an owner (People Operations), a trigger (an accepted offer), a decision point (review of results before the start date is confirmed), an escalation path for adverse findings and a timing rule. A control with those five parts is easy to test and easy to run. The free onboarding and offboarding checklist turns the same policy into a screening step per hire with the policy deadline beside it, so the evidence is produced as people start.

Policyseed does not recommend a screening provider. The policy works with a screening provider or documented manual checks, and the choice depends on where you hire and what your counsel advises.

If you decide not to screen someone

Say so in writing. A role that is not screened, a country where the check is not permitted, or a start that cannot wait should be an approved, time-limited exception with the reason, compensating steps such as reference checks, an approver and an expiry. The free policy exception register is built for this. An exception that is recorded and approved reads very differently to an auditor than a gap discovered in the sample.

What to store

Keep the minimum that proves the control ran: who was checked, which checks, the date, the outcome, who reviewed the result and when the start was confirmed. OneUptime advises that audit evidence generally does not require placing detailed criminal or credit history in the compliance repository (OneUptime), and Secureframe's description of the test asks for name, date and performer, not report contents. The detailed report belongs in a restricted system with its own access control and retention rules, and your counsel can tell you how long you may or must keep it. The generated policy sets retention for the evidence of screening:

Human Resources Security Policy, 4.13: People Operations retains evidence of screening, signed agreements, policy acknowledgments, training completion, role-change reviews and offboarding checklists for seven years after employment ends, or longer where law requires, in line with the Data Retention and Disposal Policy, so that these controls can be evidenced for any audit period.

A simple record per hire is enough for the sample: name, role, start date, check type, date completed, outcome (cleared, cleared with decision recorded, or not permitted with alternative), reviewer and a link to the restricted record. Device controls follow the same pattern, with the criteria setting the outcome and the evidence left to you; see does SOC 2 require MDM.

Frequently asked questions

Does SOC 2 require background checks?: Not as a specific, named check. Vanta says the framework does not overtly mandate background checks, and Drata says SOC 2 does not mandate them and does not specify the type. The criteria do expect you to evaluate the people you bring on (CC1.4) and to hold them to ethical values (CC1.1), and the sources agree that auditors test how you do that for new hires, usually by sampling people and asking for evidence of the check. So the safe reading is that some documented, role-appropriate screening of new hires is expected in practice, the form is your choice, and the CPA firm decides whether what you do is enough.
Do contractors need background checks for SOC 2?: The sources do not give one rule. Drata says the control is specific to new hires and new contractors and recommends checks for individual contractors and confirming that agencies check their own people. Vanta says checks are typically done on employees, vendors and contractors. Secureframe does not address contractors. Decide which contractors can reach company systems or customer data, check them or get written confirmation from the agency, and agree the scope with your CPA firm. The generated Human Resources Security Policy applies the same screening requirement to contractors with access.
What type of background check does SOC 2 want?: No type is specified. Drata says SOC 2 requirements do not specify the type of checks and that each organization decides what its criminal background checks cover. Common elements in the generated policy are identity verification, right-to-work confirmation, verification of the most recent employment and a criminal record check where the law permits it and the role justifies it. What you choose has to match what your policy says, because that is what gets tested.
Can we skip a background check where local law does not allow it?: Drata addresses this case and advises evaluating the new hire anyway and keeping an audit trail of the reasoning for the exemption. The generated policy works the same way: it says a criminal record check applies only where legally permitted, and where a check is not permitted the reason is recorded and an alternative, such as additional reference checks, is applied. Whether a given check is lawful, and what you must tell the candidate, depends on the country and in the US on the state, so check local law with counsel. This page is not legal advice.
Do we have to check existing employees?: Drata says the control is specific to new hires and new contractors, and that checking existing employees is recommended but not required. That is one publisher's reading, and the generated policy is written around candidates before they start. If you adopt the policy, the auditor tests the population it describes, so write the policy to cover who you actually screen.
What should we keep as evidence of a background check?: Keep proof that the check was done and its outcome, not the report itself. Secureframe describes an auditor asking for the employee name, the date the check was completed and who performed it. OneUptime advises that audit evidence generally does not require placing detailed criminal or credit history in the compliance repository. In practice that means a log row or signed checklist step per hire (name, start date, check date, completed or not, who reviewed) and the detailed report left in a restricted system.
Does the check have to be done before the start date?: Secureframe describes testing that a check was completed before the start date, and also states that US employees need a check within 30 days of employment without citing a source for that figure. The two do not agree and neither is a rule in the criteria. The generated Human Resources Security Policy commits to screening before the start date, so that is the timing an auditor would test against your own policy. If you cannot meet it, change the policy to say what you do before you adopt it.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.