Checklist for Background Checks According to the CER Directive

Employers must thoroughly document personnel security work to meet the requirements of CER. This includes:

• Appoint a responsible function:Appoint a person responsible for personnel security (HR manager, security manager, or equivalent) who ensures that checks are performed according to regulations and that no individuals are missed. This person is also the point of contact with the supervisory authority regarding background checks.
• Timeline for compliance:Once the organization has been identified as a critical operator by the supervisory authority, it has 10 months to implement routines for personnel security, including background checks. Ensure the checklist is linked to this deadline and that an internal project plan exists to meet the requirements on time.
• Policies and procedures:There must be documented internal procedures for how background checks are conducted, how often, by whom, and how results are handled. These documents may be requested by the supervisory authority and are useful for training managers and HR staff internally.
• Register of checked individuals:A list should be maintained of which positions have been identified as critical and which individuals hold them. The date of the background check per individual and the planned date for the next check should also be recorded. Only authorized personnel should have access to the list.
• Handling check results:If a background check raises no "red flags," it is usually sufficient to note that the person is approved without remarks. However, if something unusual emerges - e.g., the criminal record extract shows a relevant conviction - the employer must document how it has been handled. This may include a special risk assessment, decision on possible reassignment or other measures, and that the employee has been informed and given the chance to explain. These steps should also be documented.
• Prepare for supervision and sanction risk:Supervisory authorities have the right to review procedures, documentation, and compliance with personnel security requirements. Deficiencies can lead to sanction fees of up to the higher of 2% of global annual turnover or the equivalent of EUR 10 million (private operators), or SEK 10 million (public operators). Ensure the checklist includes an item on internal auditing and that responsible parties are aware of the supervision process.

• Conduct an operations-based risk analysis:Before positions are identified as critical, the organization should conduct a risk assessment of its operations. The purpose is to understand which functions, systems, and roles are most vulnerable in the event of incidents. This analysis should be documented and serve as the basis for which positions require background checks.
• Identify critical positions:Conduct a position analysis that clarifies which roles in the organization are so significant that an unsuitable person in that role could cause more than minor harm to the essential service. This includes positions with major impact on operations and security - e.g., operations managers, system administrators, security officers, key personnel in control rooms. This also applies to external personnel.
• Set external requirements:Conduct a position analysis of external personnel with access to the essential service and require that this personnel also be checked. External actors should also be able to present documentation showing which checks have been performed, when and how, upon request.
• Execution:Perform background checks on individuals in these positions before appointment (i.e., upon new hire or internal transfer to such a role), and on an ongoing basis during employment. The government's CER investigation proposes that employees already in critical roles should be checked periodically - at least every two years - to detect if a previously reliable person's circumstances change in ways that may pose a risk.
• Document the checks:Have organized procedures and maintain records showing that a background check has been completed for each person in the designated positions, when it was done, and by whom. The material must be available for inspection but otherwise handled under confidentiality.
• Follow-up and reminders:Implement routines for notifications or reminders to responsible parties for background checks to be carried out, sent well before 24 months have passed since the last background check for an employee. The purpose is to ensure follow-up occurs on time and no checks are missed.