NIS2 requires proportionate risk-management measures, supply-chain security, incident management, access controls and training, among other areas. However, the Directive does not impose a general obligation to conduct background checks on employees. Validato views screening of certain individuals as a possible complementary, risk-based measure where the role and legal framework justify it. “NIS2 strengthens risk management, but it does not automatically turn every personnel check into a legal requirement. The key is to identify sensitive functions and apply proportionate, legally permissible controls,” says André Naef, CEO of Validato.

Validato recommends that potentially affected organisations have CISO, HR and Legal jointly assess which profiles have elevated risk exposure and which controls are appropriate. Any personnel screening must be assessed under the GDPR, Spain’s LOPDGDD and applicable sector-specific rules; criminal-record data requires a specific legal basis.