1Oct 2026

BS 7858 Security Screening: 12–16 Week Playbook for UK Recruiters

UK recruiter verifying security screening evidence

Security screening procedures are a documented sequence of identity, employment, criminal and, where relevant, financial checks designed to confirm a candidate is who they say they are and poses no undue risk. In the UK private sector, BS 7858 is the accepted benchmark, while BPSS and national security vetting apply in government and defence contexts. This guide covers the checks, timings, legal duties and templates employers need to run screening properly.

TL;DR:

  • BS 7858 mandates rigorous identity, employment, criminal, and financial checks, including verification of original documents, referees, and relevant licenses, with a typical three- to five-year review period.
  • Employers should tailor screening depth based on role risk level, confirming identity within 48 hours and completing checks within 12 to 16 weeks, mainly by shortening referee response times.
  • UK GDPR requires employers to establish lawful processing bases, produce policies, and conduct data impact assessments when handling criminal-offence data during screening.
  • Regular re-screening and proportionate checks are essential because treating BS 7858 as a one-time process leads to compliance risks and ineffective security.
  • The UK national vetting system includes higher security clearances like SC and DV, which require government sponsorship and are separate from private-sector standards like BS 7858.
Securityjobsboard
Find Security Talent With Confidence
Connect with security professionals and employers through a UK-focused platform built for faster, quality recruitment matches.
Visit Security Jobs Board

Table of Contents

BS 7858 essentials and the checks you must include

BS 7858 sets out what evidence-based screening looks like for anyone working in a secure environment, and it treats self-declaration as insufficient on its own. The BSI standard frames the process as a risk-mitigation tool for roles carrying insider risk, which means documentary verification, not a candidate’s word, carries the weight.

A compliant screening file generally includes:

  • Identity verification: original photographic ID (passport or driving licence) plus two independent address proofs dated within the last three months.
  • Employment history verification: direct confirmation with named referees covering the recommended checking period, with any gap over 31 days queried and explained.
  • Criminal record checks: a DBS check appropriate to the role, moving to an enhanced check where the position involves vulnerable people or sensitive access.
  • Financial checks: applied proportionately for roles handling cash, valuables or financial data, rather than as a blanket requirement.
  • SIA licence confirmation: checked directly against the regulator’s register wherever the role is licensable.

The NPSA good practice guide recommends a minimum three-year verification period, with five years preferred, and sets completion windows of 12 to 16 weeks depending on how far back the checks reach. Media checks have a place too, but only where the role’s risk profile justifies the extra scrutiny, not as a routine add-on for every post. For a wider view of how these individual checks slot together, this overview of checks used in security roles is a useful companion read.

Step-by-step screening workflow for employers and recruiters

Screening works best as a fixed sequence rather than a checklist tackled in whatever order documents arrive. The steps below follow the shape most recruiters already use, tightened to match BS 7858 expectations.

  1. Scope the check level to the role. A reception security officer does not need the same depth as a cash-in-transit driver: grade roles as basic, medium or full BS 7858 before advertising.
  2. Collect consent and documents early. Get written consent for criminal record and reference checks at offer stage, and request identity and right-to-work documents first since they gate everything else.
  3. Verify employment, education and references directly. Contact former employers rather than accepting reference letters, and ask explicitly about any unexplained gap.
  4. Order criminal and financial checks once identity is confirmed. Running these in parallel with reference calls, rather than after them, shortens the overall timeline.
  5. Log every result against a verification record. Note who checked what, on which date, and the outcome, including anything left unresolved.
  6. Make the decision point explicit. Issue conditional offers pending screening completion, and set out in writing what happens if a check raises a concern, including any appeal route.

Pro Tip: Run identity and right-to-work checks in the first 48 hours after an offer is accepted; nothing else in the file can be verified properly until those two are confirmed.

The NPSA guide points to the 12 to 16 week completion window as realistic for full BS 7858 screening, and most delays trace back to slow referee responses rather than the checks themselves. Chasing referees by phone instead of e-mail, and giving candidates a fixed deadline to supply alternative referees if the first set goes quiet, removes most of that friction. A practical walk-through of these timelines, including where candidates typically stall, sits in this guide to how security checks work.

Where BS 7858 sits alongside BPSS and national security vetting

BS 7858 and government vetting answer different questions. BS 7858 asks whether a candidate is trustworthy enough for a private-sector secure role; national vetting asks whether someone can be trusted with government or defence information, and it sits on a separate ladder entirely.

  • BPSS is the baseline standard underpinning government recruitment, and it also underpins the higher national vetting tiers according to Gov.
  • The national vetting framework has five main levels: Accreditation Check (AC), Counterterrorist Check (CTC), Level 1B, Security Check (SC) and Developed Vetting (DV), each adding more depth than the last.
  • Higher tiers typically involve a security questionnaire, Security Service checks, credit history reviews and, for SC and DV, detailed interviews, as set out in the applicant guidance.
  • Employers cannot self-initiate SC or DV: these require sponsorship by a government department or contracting authority, so a private employer without that sponsor relationship has no route to them.
  • A role needs national vetting rather than BS 7858 alone when it involves access to government premises, classified material or aviation secure areas, where AC is the typical tier used for staff reaching restricted zones. Our guide to UK security clearance types covers BPSS in more depth for readers weighing up which route applies.

Screening inevitably means processing criminal-offence data, and UK GDPR treats that category with extra caution. Employers need a clear answer to the lawful basis question before a single DBS check goes ahead.

  • Identify the lawful basis first. ICO guidance on pre-employment vetting requires an Article 6 basis plus, for criminal-offence data, either official authority or a Schedule 1 DPA 2018 condition.
  • Produce an appropriate policy document. Where no official authority applies, an appropriate policy document under the DPA 2018 is generally needed alongside the Schedule 1 condition.
  • Run a DPIA for higher-risk processing. The ICO’s guidance sets out when a data protection impact assessment becomes necessary rather than optional.
  • Be transparent with candidates. Tell candidates what will be checked, why, and record whether the basis is consent or legitimate interest, since that record is what an audit or an appeal will come back to.

Employers processing criminal-offence data must identify a lawful basis under UK GDPR and, in many cases, an appropriate policy document under the Data Protection Act 2018, a requirement set out directly in ICO guidance. Decisions based on a check result, including any adverse decision, should be documented with the reasoning behind them so the employer can show the process was applied consistently and without unlawful discrimination.

Checklists, a verification record outline and common red flags

A verification record is only useful if it is structured the same way every time. Fields worth including: candidate identifiers, document type and reference number, who carried out the check, the date it was done, the outcome, and a note of anything left unresolved along with the action taken.

A tiered checklist keeps the process proportionate, with transport and logistics roles benefiting from documented personnel checks as outlined in restricted party screening: a practical compliance workflow.

  • Basic tier: identity, right to work, one employer reference, standard DBS where applicable.
  • Medium tier: basic tier plus full employment history verification and an enhanced DBS for supervisory roles.
  • Full BS 7858 tier: medium tier plus financial checks, media checks where justified, and a five-year verification period for security-sensitive operational posts.

Common red flags include unexplained employment gaps, referees who cannot be reached through independently verified contact details, and inconsistencies between a CV and what a reference confirms. Escalate rather than ignore: ask the candidate directly, document their explanation, and decide against a written policy rather than an ad hoc judgement call.

Pro Tip: Keep consented evidence on file so a candidate moving between security employers does not need to resubmit identity documents from scratch; centralised repositories such as the BSIA’s FaSQUAL scheme exist specifically to reduce that repeat work.

Where screening is outsourced, the employer’s responsibility does not disappear. GOV.UK guidance on outsourced pre-employment screening is clear that employers should verify a supplier’s BS 7858 certification and keep their own audit trail of how documents were validated.

What recruiters consistently get wrong about BS 7858

What recruiters consistently get wrong about BS 7858 — overview diagram

Most employers treat BS 7858 as a box to tick at onboarding, then forget it exists until an audit or a client contract demands evidence. That is the wrong way round. BSI’s own framing of the standard positions it as an operational risk control, not a recruitment formality, and the organisations that get the most value from it are the ones that re-screen periodically rather than screening once and filing the record away.

The other mistake is depth creep: running full financial and media checks on every hire regardless of role, which slows down low-risk recruitment for no security benefit and burns goodwill with candidates who feel over-scrutinised for a job that carries no real insider risk. Proportionality is not a compliance nicety, it is what keeps the process fast enough to actually finish within the 12 to 16 week window the NPSA guide describes. Screening that takes six months because every post gets the full treatment protects nobody better than screening that is scoped correctly from the start.

— Rob

How Security Jobs Board supports screened security recruitment

Security Jobs Board is affiliated with the BSIA and built around GDPR-compliant tools for both sides of security hiring. Employers can post a job, search the CV database for candidates who already hold relevant licences and clearances, and reach jobseekers who understand what BS 7858 screening involves before they apply. For recruiters filling roles like cash-in-transit driving positions, that familiarity shortens the verification conversation considerably. Browse employer listing options to get started, or explore more screening resources on the blog.

Sources

FAQ

What are the 5 Cs in security?

The “5 Cs” is not a term defined in BS 7858 or GOV.UK vetting guidance, and its definition varies by source. Rather than quote an unverified framework, focus on the documented BS 7858 elements: identity, employment history, criminal record, references and, where proportionate, financial checks.

What are the 5 levels of security clearance in the UK?

The UK’s national security vetting framework has five main levels: Accreditation Check (AC), Counter Terrorist Check (CTC), Level 1B, Security Check (SC) and Developed Vetting (DV), as set out by GOV.UK. BPSS sits beneath these as the baseline standard that underpins them.

What are three types of security screening equipment?

This is an aviation and venue security topic rather than a personnel vetting one, and specific equipment categories vary by setting and operator. Passenger-facing screening at UK airports includes rules such as the liquids restrictions on hand luggage, which is a separate process from staff vetting under BS 7858.

What do you have to take out of your bag at UK airport security?

UK airport security asks passengers to remove laptops and other large electronic devices, and to present liquids separately within the permitted container limits, according to GOV.UK’s hand luggage guidance. Requirements can vary slightly by airport, so checking the specific airport’s advice before travelling is worthwhile.

Does BS 7858 screening apply to every security role?

BS 7858 is a voluntary private-sector standard, so it applies wherever an employer or client contract requires it, which in practice covers most guarding, cash-in-transit and secure-site roles in the UK. Roles involving government or classified access instead fall under BPSS and the national vetting framework rather than BS 7858 alone.