Personnel security policy

1. Purpose and scope

1.1 The purpose of this policy is to define how Registers of Scotland (RoS) ensures that all individuals or organisations who have access to government information, assets, or facilities are appropriately screened, vetted, and managed throughout their employment or contractual engagement.

1.2 Effective personnel security safeguards RoS against the risks of insider threat, unauthorised disclosure of information, and damage to the integrity or reputation of government operations.

1.3 This policy applies to:

• all colleagues’ “employees”
• all contractors, contingent workers, agency workers, secondees, consultants, and suppliers who are granted access to departmental systems, data, or facilities.

The requirements of this policy apply to all business areas, including shared services, joint ventures, and outsourced operations where RoS information is processed or accessed.

2. Terminology

3. Guiding principles

3.1 RoS shall implement and maintain personnel security controls that align with the Government Functional Standard GovS 007: Security, and the HMG Baseline Personnel Security Standard (BPSS).

3.2 All employees with access to government information or facilities shall hold, as a minimum, a valid BPSS clearance prior to commencing duties.

3.3 Higher levels of national security vetting (e.g. Security Check (SC), Developed Vetting (DV) shall be applied where the role requires, or as defined by risk assessment and business need.

3.4 Personnel security measures shall cover the entire employee’s lifecycle recruitment, onboarding, ongoing employment and exit ensuring continuous trust and suitability.

4. The policy

4.1 Personnel security requirements

Pre-employment screening

All candidates shall successfully complete BPSS screening before being given access to departmental information or assets.

BPSS screening includes verification of:

• identity (e.g., passport, driving licence, proof of address, national insurance number)
• right to work in the UK
• employment history (minimum 3 years)
• criminal record (unspent convictions).

No individual may be issued network credentials, building passes, or equipment until screening confirmation is received.

Exceptions to this shall be granted by a Director through the RoS policy exception process and tracked by the Information Security Assurance Group (ISAG).

4.2 The Official Secrets Act

All employees, contingent workers, contractors, consultants, and suppliers with access to RoS assets shall sign the Official Secrets Act before being granted access to any information.

4.3 Ongoing personnel assurance

Personnel security clearances shall be subject to periodic review to confirm continued validity and suitability.

4.4 Recording checks and results of the BPSS

Organisations shall:

• securely retain accurate and up-to-date BPSS records using the BPSS Verification Record (Annex B) (This document is the official record of the successful completion of BPSS checks. The BPSS Verification Record should be shared appropriately when an individual’s BPSS status needs confirming during a transfer or NSV application)
• advise individuals to declare any changes in their personal circumstances under the Civil Service Code or local organisational policy, which could affect their role, for example a criminal conviction
• report immediately any change in personal circumstances (e.g. criminal convictions, financial issues) that may affect clearance to employeerelations@ros.gov.uk.

Any declarations will be kept confidential and handled sensitively. If you would like a confidential conversation in advance, please get in touch via the same inbox.

Managers shall ensure that role changes triggering higher access levels initiate a vetting reassessment. The Talent Acquisition team shall be consulted in advance if this is the case, as they are responsible for organising additional clearance.

4.5 Contingent workers, contractor and third-party personnel

• all contingent workers, contractors, consultants, and suppliers with access to RoS assets shall meet the same BPSS baseline requirement as permanent employees
• contingent workers shall explicitly include clauses requiring the supplier to maintain valid clearances for their personnel throughout the engagement
• RoS shall retain the right to audit supplier compliance and to withdraw access where vetting standards are not met.

4.6 Access management

• personnel security clearance shall be verified before any logical or physical access is granted
• access rights shall be commensurate with the individual's clearance level and business need
• access shall be revoked immediately upon termination of employment or contract, or where clearance expires or is withdrawn.

4.7 Awareness and conduct

• all colleagues shall complete mandatory security and information awareness training during induction and bi-annually thereafter
• colleagues shall understand their responsibilities under the Data Protection Act 2018, and internal departmental security policies
• behaviour inconsistent with security requirements (e.g. policy violations, unauthorised disclosures) shall be subject to disciplinary or contractual action.

4.8 Offboarding and exit

• a formal exit process shall ensure that passes, ID cards and IT accounts are withdrawn and all RoS property returned
• departing colleagues shall be reminded of their continuing confidentiality obligations
• the HR and IT Security teams shall jointly confirm completion of the offboarding checklist.

5. Roles and responsibilities

5.1 All RoS employees and contingent workers are bound by the commitments of this policy, and:

5.2 are required to effectively operate the range of procedures and controls which facilitate compliance in practice.

5.3 shall report any non-conformances of or improvement to policy requirements to the Security Working Group SRA@ros.gov.uk.

5.4 The ISAG has ownership of this policy and is responsible for enforcing its application.

5.5 The ISAG is accountable for Information Governance, which includes requirements for the protection and handling of RoS information assets.

5.6 Frameworks (or agreements) shall be in place to ensure that all partners within a supply chain are aware of the policy requirements and understand their responsibilities for compliance.

5.7 This policy should be part of the publication scheme. Internally all employees shall be made aware of the policy.

6. Approval and review

This policy will be reviewed and approved by the Information Security Assurance Group (ISAG) annually, unless earlier review is appropriate.