A SOC 2 report does not contain a line item that says “run a background check on every hire.” Nothing in the underlying framework, the AICPA Trust Services Criteria, names background screening as a mandatory control. That surprises a lot of founders and compliance leads who assumed SOC 2 worked like a licensing requirement with a fixed checklist. It does not. SOC 2 is built around control objectives, not a specific list of vendors or procedures, and an auditor’s job is to test whether your controls actually address the risk the criteria describe.
So the honest answer is that SOC 2 does not require background checks in the way a state childcare law requires fingerprinting. What it does require is that a company demonstrate it has a sound process for vetting the people who can touch customer data and production systems, and a background check is the most common way companies satisfy that expectation. Skip it entirely and you can still pass an audit, but you will need another way to show the same assurance, and most auditors will ask hard questions if that gap is not addressed somewhere else.
Where background checks live in the Trust Services Criteria
SOC 2 reports are built against the AICPA’s Trust Services Criteria (TSC), organized under a Common Criteria (CC) series that maps loosely to the framework known as COSO. The relevant section is CC1, which covers the control environment, and specifically CC1.4, which addresses how an organization demonstrates a commitment to attracting, developing, and retaining competent individuals in alignment with its objectives.
CC1.4 is a “people” control. It asks whether the organization has policies and practices for hiring, evaluating competence, and holding staff accountable. Background screening typically shows up as one piece of evidence an auditor reviews under this criterion, alongside onboarding checklists, role-based access provisioning, confidentiality agreements, and security awareness training records. There is no separate criterion titled “background checks,” which is exactly why so many companies search for a clear yes or no answer and do not find one in the standard itself.
Because the U.S. Trust Services Criteria are a private-sector professional standard published by the AICPA rather than a government rule, there is no federal statute or regulation that spells out SOC 2 requirements. The government-side framework SOC 2 borrows conceptually from is the personnel security family in NIST Special Publication 800-53, which many auditors and security teams reference when building out control language, even though a SOC 2 engagement is not a NIST compliance assessment.
Why most companies screen anyway
Even without an explicit mandate, background checks end up in almost every SOC 2 Type II report because they are the simplest, most defensible way to answer the question an auditor is really asking: how do you know the people with access to customer data are who they say they are and do not have a documented history that creates unmanaged risk. A written policy that says “we screen candidates before granting production access” combined with completed check records for the sample period is straightforward evidence. An auditor can request a sample of hires from the audit window and match each one to a completed screening record.
The alternative, arguing that some other control fully offsets the absence of screening, is possible but harder to substantiate and invites more auditor scrutiny. Most organizations find it faster to adopt a proportionate screening policy than to build and document a workaround.
What auditors typically request as evidence
| Evidence auditors commonly request | What it demonstrates |
|---|---|
| Written hiring or background check policy | A documented, approved standard exists and defines scope |
| Completed background check records for a sample of hires in the audit period | The policy was actually followed, not just written |
| Signed authorization and disclosure forms for each sampled hire | The check was obtained lawfully under the FCRA, not informally |
| Role mapping showing which positions require which level of screening | Screening scope is risk based, not arbitrary |
| Contractor and temporary staff screening records or vendor attestations | Non-employee access is covered by the same control intent |
| Evidence of adverse action handling when a check affected a hiring decision | The process respects legal notice requirements, reducing legal exposure that could affect the control environment |
Auditors are not grading the content of any individual background check. They are testing whether a defined process exists, whether it was followed consistently for the people in scope, and whether records exist to prove it. A policy that exists only on paper, with no matching records for actual hires, is a common finding that gets flagged as a control deficiency.
Scoping: who actually needs to be screened
Because CC1.4 is written around competence and integrity of personnel generally, companies have latitude in how broadly they scope screening. Reasonable, commonly seen approaches include:
- Screening every employee and contractor who will have access to production systems, source code repositories, or customer data, regardless of department.
- Applying a lighter check, such as identity and employment verification, to roles with no system access, and a fuller criminal history check to engineering, IT, and support roles that can see customer records.
- Requiring contractors and staffing agency workers to either complete the company’s own screening process or provide a recent, comparable screening attestation from their employer of record before receiving credentials.
- Re-screening or re-attesting periodically for staff who move into more sensitive roles, rather than treating the pre-hire check as valid forever.
None of these approaches is mandated by SOC 2 itself. What an auditor is checking is whether the scope you chose is documented, reasonable relative to the access each role has, and applied consistently. A policy that says “all engineers are screened” but exempts a founder or an executive with full database access is the kind of inconsistency that draws a finding.
Running the check without creating FCRA risk
A background check used for an employment decision in the United States is a consumer report under the Fair Credit Reporting Act when it is obtained through a consumer reporting agency, and that triggers a specific set of employer duties regardless of whether the check is also being used as SOC 2 evidence. Getting the SOC 2 control right and getting the FCRA process wrong at the same time is a real risk, since a compliance program that generates legal exposure is its own control weakness.
At minimum, employers running background checks for this purpose should provide a standalone disclosure that the company may obtain a consumer report, get written authorization before ordering the report, and, if a report may lead to a decision not to hire or to rescind an offer, follow the pre-adverse action and adverse action notice steps, including providing a copy of the report and the Summary of Rights before any final decision. What typically appears on a report, and how far back it can go, varies by state law and by the type of check ordered, so treat any blanket claim about what “will” show up with caution and confirm the applicable rule for the state in question.
Frequently asked questions
Does SOC 2 explicitly require background checks?
No. The Trust Services Criteria under CC1.4 address personnel competence and the control environment broadly, without naming background checks as a required procedure. Most organizations use them as the standard way to satisfy that criterion, but an auditor is testing for a documented, consistently applied process, not a specific vendor or method.
What SOC 2 criteria most often reference background checks in an audit?
CC1.4, which covers commitment to competent personnel, is the most common reference point. Some auditors also touch on it under CC1.1 and CC1.3 when evaluating the overall control environment and organizational structure, but CC1.4 is where the evidence request usually lands.
Do contractors and temporary staff need to be screened for SOC 2 purposes?
If a contractor or temporary worker has access to production systems or customer data, most auditors expect the same level of assurance as for employees, whether that comes from the company’s own screening process or a documented attestation from the staffing vendor.
Can a company pass a SOC 2 audit without doing any background checks?
It is possible if the company can show an equivalent control, such as very limited data access paired with strong technical controls and monitoring, but this is a harder case to make and tends to draw more auditor questions. Most organizations find it simpler to adopt a proportionate screening policy.
Does a SOC 2 background check policy need to follow the FCRA?
Yes, whenever the check is obtained through a consumer reporting agency for employment purposes in the United States. SOC 2 evidence requirements and FCRA employer duties are separate obligations that both apply to the same hiring event.
How far back can a background check used for SOC 2 evidence look?
That depends on state law and the type of search, not on SOC 2. Some states limit how far back certain records can be reported. Confirm the rule that applies in the relevant state rather than assuming a uniform lookback period.
Sources
- Consumer Financial Protection Bureau, Regulation V (Fair Credit Reporting)
- Electronic Code of Federal Regulations, Title 16, Part 680 (Fair Credit Reporting)
- Federal Trade Commission, Background Checks: What Employers Need to Know
- U.S. Equal Employment Opportunity Commission, Enforcement Guidance on Arrest and Conviction Records
- NIST Special Publication 800-53 Revision 5, Security and Privacy Controls (Personnel Security family)
Related reading: Does HIPAA Require Background Checks? What the Rule Actually Says and FCRA Permissible Purpose: The Legal Foundation of Every Background Check.
Get a compliant, FCRA-aligned screening process built for your team at Reveal Background.
This article is general information, not legal advice. Consult qualified counsel and your SOC 2 auditor for guidance specific to your organization.
