What is BS7858 Vetting and Why Does It Matter

Understanding BS7858 Screening

BS7858 is a British Standard developed and published by the British Standards Institution (BSI) that sets out recommended procedures for screening individuals employed in security-related roles or other positions of trust. First introduced in the early 2000s, the standard was created in response to concerns about the quality and consistency of vetting practices across the security industry. It provides employers with a clear framework for verifying the identity, background, and trustworthiness of candidates before granting them access to sensitive environments, assets, or information.

Unlike SIA licensing, which is a legal requirement enforced by statute, BS7858 is a voluntary standard. However, BS7858 has become the de facto benchmark for best-practice vetting in the security sector and beyond. It is frequently specified in contracts, particularly for clients in regulated industries such as aviation, defence, banking, pharmaceuticals, data centres, and critical national infrastructure. Many insurance policies also require that security personnel undergo BS7858-level screening, and failure to comply can result in coverage being invalidated in the event of a claim.

The standard is designed to be scalable and proportionate. Employers can tailor the scope and depth of screening to the specific risks associated with the role. However, the core principle remains the same: employers should take all reasonable steps to verify that individuals in positions of trust are who they claim to be, have a verifiable and consistent background, and do not present an unacceptable risk.

What Does BS7858 Screening Involve?

BS7858 screening is a multi-stage process that builds a comprehensive picture of a candidate's background. The first step is identity verification — checking original documents such as a passport, driving licence, birth certificate, and utility bills to confirm that the candidate is who they claim to be. Employers typically follow a points-based system where different documents carry different weights, and a minimum number of points must be achieved.

The next step is employment history verification. Employers are expected to verify the candidate's employment for at least the previous three years, and preferably five years. This involves contacting previous employers directly (not relying on references provided by the candidate) to confirm dates of employment, job titles, and reasons for leaving. If there are gaps in the employment history, the candidate must provide a satisfactory explanation supported by documentary evidence.

Address history verification follows a similar approach. Employers verify where the candidate has lived for the previous three to five years, using documents such as utility bills, council tax statements, or tenancy agreements. Where gaps or inconsistencies are found, the candidate must provide a satisfactory explanation.

A criminal record check via the Disclosure and Barring Service (DBS) is a core component of BS7858 screening. Depending on the nature of the role, this will typically be a Standard or Enhanced DBS check. While SIA licensing requires a basic DBS check, BS7858 often involves a more detailed check, and employers may conduct periodic re-checks to ensure that officers remain suitable for positions of trust.

Some employers also include credit checks (to identify financial pressures that could increase the risk of theft or fraud), verification of educational or professional qualifications, and checks of professional registrations or memberships. The specific checks performed will depend on the nature of the role and the risks involved.

BS7858 vs DBS Checks: What's the Difference?

A common question is: "If we already require DBS checks, why do we need BS7858?" The answer is that a DBS check, while essential, provides only one piece of the puzzle. A DBS check reveals whether an individual has any criminal convictions, cautions, reprimands, or warnings on their record. It does not verify identity, employment history, or address history, and it does not detect dishonesty or inconsistencies in the information provided by the candidate.

For example, a candidate might have a completely clean DBS check but provide false references, claim to have worked for employers who have no record of them, use a false name, or have unexplained gaps in their work history that they are attempting to conceal. A DBS check would not identify any of these red flags. BS7858 screening, by contrast, involves verifying the candidate's entire background — not just their criminal record.

This distinction is particularly important in security roles and other positions of trust. An individual with no criminal record might still pose a risk if they have a history of dishonesty, financial problems, or unexplained gaps that suggest they are concealing something. In short, a DBS check tells you what someone has been convicted of; BS7858 screening tells you whether you can trust them.

Is BS7858 Certification a Thing?

It is important to clarify a common misconception: there is no such thing as being "BS7858 certified." BS7858 is a standard that defines the screening process, not a certification scheme. Individuals do not receive a BS7858 certificate, and companies are not certified or accredited under BS7858 by the BSI or any other body. An individual who has undergone BS7858 screening has been vetted in accordance with the standard, but they do not hold a formal credential as a result.

When a security company states that it conducts BS7858 screening, what it means is that it follows the procedures set out in the standard when vetting its staff. Businesses should be cautious of providers who claim to be "BS7858 certified" or "BS7858 accredited" — these terms are misleading. What matters is that the provider can demonstrate thorough, documented screening in line with BS7858 guidelines and can provide evidence of the checks performed.

When evaluating a security provider, ask for details of their vetting process: what specific checks do they conduct, how do they verify employment and address history, do they keep documented records, and can they provide copies of verification documents? A professional provider will have clear answers and will be transparent about their procedures.

Why BS7858 Matters for Your Business

For businesses in sensitive sectors — data centres, financial services, pharmaceuticals, aviation, defence, and critical infrastructure — the risks associated with employing unsuitable personnel are significant. Insider threats, whether intentional or inadvertent, can result in data breaches, theft, sabotage, regulatory violations, and reputational damage. BS7858 screening provides a robust framework for identifying and mitigating these risks.

Many clients in these sectors specify BS7858 screening as a contractual requirement. If your security provider cannot demonstrate that its officers have undergone BS7858-level vetting, you may be in breach of your contractual obligations. Regulatory bodies and industry standards — such as ISO 27001 for information security management, or the Civil Aviation Authority's requirements for airport security — often require or recommend BS7858 screening for personnel with access to sensitive areas.

Insurance is another important consideration. Many commercial insurance policies include clauses that require security personnel to be vetted to a specified standard. If an incident occurs and it emerges that the personnel involved were not properly vetted, the insurer may refuse to cover the claim. BS7858 screening provides documented evidence that you have conducted thorough vetting and exercised due diligence.

Finally, BS7858 screening is simply good practice. It demonstrates to clients, regulators, insurers, and other stakeholders that you take security seriously and are committed to employing trustworthy, reliable personnel.

Questions to Ask Your Security Provider

When engaging a security provider for roles in sensitive environments, ask the following about BS7858 screening: Do you conduct BS7858 screening on your officers? What specific checks are included — identity, employment history, address history, DBS level, credit checks? How do you verify employment and address history — do you contact employers directly, or rely on candidate-provided references? How far back do you verify — three years, five years, or longer? Do you keep documented records of the screening process? How do you handle gaps in employment or address history? Do you conduct periodic re-screening?

A professional security provider will have clear, documented procedures and will be able to answer these questions in detail. They will maintain records of the checks performed and will be willing to share evidence (with appropriate redactions to protect personal data) to demonstrate compliance. If a provider is vague or evasive, this is a red flag.

Remember that BS7858 screening is not a one-time event. Individuals' circumstances can change, and periodic re-screening helps ensure that officers continue to meet the required standards. Ask your provider how they manage ongoing compliance and whether they conduct regular re-checks.