Federal Law (FCRA)
The Fair Credit Reporting Act (FCRA) establishes the federal minimum requirements for employment background checks, including disclosure and authorization requirements, consumer rights, and the adverse action process. Many states impose additional requirements that employers must also follow.
Read FCRA OverviewAdditional Compliance Requirements
Beyond the FCRA, several sources determine the requirements for a compliant technology screening program.
Security Frameworks
SOC 2, ISO 27001, and PCI DSS treat personnel screening as a control, and auditors test whether it was applied.
Customer Contracts
Enterprise customers specify components, lookback periods, and re-screening intervals in vendor security agreements.
Government Work
Federal cloud authorization and access to criminal justice data carry their own personnel screening standards.
State Regulations
For a distributed workforce, the criminal history, credit, and adverse action rules of every state where employees work.
Recommended Screening Components
Background check components depend on the systems a role can reach, the data those systems hold, and which customers audit them.
| Position |  SSN Trace |
 Address History |
 Identity Document Verification |
 Form I-9 |
 County Criminal |
 National Criminal Database |
 Federal Criminal |
 Employment History |
 Education Verification |
 Credential Verification |
 Credit Reports |
 Global Watchlists |
 International Screening |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Software Engineer | |||||||||||||
| DevOps / Infrastructure | |||||||||||||
| Security Engineer | |||||||||||||
| Database Administrator | |||||||||||||
| IT Support | |||||||||||||
| Data Analyst | |||||||||||||
| Sales Engineer | |||||||||||||
| Engineering Leadership |
Form I-9 is required for every hire in the United States. No federal rule requires a background check for a technology role.
Determined by customer security frameworks, vendor agreements, and company policy. Identity verification appears across nearly every role here because most hiring happens without anyone meeting in person.
Notes on This Package
The customer’s audit sets the standard. A company selling to enterprises answers security questionnaires and undergoes audits, and personnel screening is one of the controls examined. Some frameworks name background verification directly and scale it to the sensitivity of the data. Others test whether a documented screening policy exists and was followed for every hire. In both cases the finding is about consistency, so a company that screens most people and skips a few fails on the exception.
Education verification returns less here. A large share of qualified engineers are self-taught, came through a bootcamp, or left a degree unfinished, and none of that is a red flag in this field. Verification confirms what a school reports, so a candidate with no degree to verify is common rather than notable. Employment history and technical credentials carry the weight instead.
Certifications expire and can be checked. Cloud platform certifications, security credentials, and vendor qualifications carry expiration dates, and most issuers run a public verification portal keyed to a candidate number. This makes them faster to confirm than degrees and more likely to be stale, since a certification earned four years ago may have lapsed without the resume reflecting it.
Access matters more than the org chart. An engineer with production database credentials reaches more sensitive data than a director who approves budgets. Screening scoped to access rather than to seniority is what security reviewers expect to see, and it is the mapping most companies have to build after the fact.
Distributed and Remote Hiring
Most technology hiring now happens across state lines, and often across borders. That changes where searches go, which laws apply, and what a report can confirm.
Where the searches go
Criminal records are held by the courts of the county where the case was filed, so a search has to be aimed at specific places. Address history determines those places. A candidate who lived in four counties over seven years needs four searches, and a national database result is a pointer toward where to look rather than a substitute for looking.
Which state’s law applies
Screening rules generally follow the state where the employee works, not the state where the company is headquartered. Ban the box timing, criminal history lookback limits, credit report restrictions, and adverse action waiting periods all attach to the worker’s location. A company hiring across 20 states carries 20 sets of requirements. Check the State Laws Overview for the states where you hire.
Workers outside the United States
Criminal record availability varies widely by country, and some jurisdictions release records only to the individual rather than to an employer. Data protection law in many countries limits what an employer may collect, how long it may be kept, and whether it may be transferred. See International Screening for how those checks are obtained.
Beyond General Technology
Most technology companies run the package above. Several segments carry requirements that expand it.
| Government Cloud | Federal cloud authorization requires personnel screening before access is granted, and some engagements require a government security clearance or agency credentialing. These are federal determinations that run separately from the company’s own screening. |
| Payments and Fintech | Handling cardholder data brings a named screening requirement for personnel with access to that environment. Companies operating through a bank partner also inherit the bank’s vendor standards. See Financial Services. |
| Health Technology | Vendors handling protected health information on behalf of a covered entity operate under a business associate agreement, and the covered entity commonly specifies screening terms in it. See Healthcare. |
| Public Safety Systems | Access to criminal justice information carries a fingerprint-based state and national criminal history check for every person who can reach the data, including vendor staff and subcontractors, with periodic recertification. |
Screening Considerations
Identity Verification
Confirming that the person hired is the person who applied is a separate check from a background report. Document verification and liveness confirmation address it, and both matter more when no step in the hiring process happens in person.
Customer Security Frameworks
Audit findings turn on consistency and documentation. A written screening policy, evidence it was applied to every hire, and records showing when each check was completed are what a reviewer asks for.
Multi-State Coverage
Address history drives which courts are searched, and a distributed workforce spreads those searches across many jurisdictions. Turnaround varies by court, so a package covering four counties completes on the slowest one.
Privileged Access
Production credentials, customer data access, and administrative rights are what security reviewers care about. Mapping screening depth to access level rather than to job title is what makes the program defensible in a customer audit.
Technical Certifications
Most issuers publish a verification portal keyed to a candidate identifier, so confirmation is direct and fast. Expiration dates matter, since a lapsed credential is common and does not appear on a resume.
Contractors and Outsourced Teams
Contractors, agency developers, and offshore teams often hold the same system access as employees. Screening reaches them through the vendor agreement, and customers auditing the company expect that standard to match the one applied to staff.
Re-Screening Intervals
Enterprise agreements commonly specify how recent a report must be and how often it repeats. Reports obtained after hire require their own disclosure and authorization covering the period of employment.
International Data Limits
What may be collected about a worker abroad, how long it may be held, and whether it may be transferred are governed by that country’s data protection law. Some records are available only through the individual, which changes how the check is obtained.
Common Questions
Is a background check required in tech?
No federal rule requires one. The requirement comes from customer contracts, security audits, and company policy, with government and payments work as the exceptions.
Do security audits require screening?
The major frameworks treat personnel screening as a control. Some name background verification directly, and all of them test whether the policy was applied consistently.
How are remote hires screened?
Address history identifies the counties to search, and each is searched separately. The package covers everywhere the person lived, not only where they live now.
Which state’s rules apply?
Generally the state where the employee works. A company hiring across many states follows the rules of each one rather than those of its headquarters.
Can a bootcamp be verified?
Yes, through the program, which confirms enrollment and completion. Bootcamps are not accredited institutions, so the verification confirms attendance and nothing about academic standing.
Is no degree a red flag?
Not in this field. Many qualified engineers never finished a degree, so verification returning nothing is common. Employment history and certifications carry more signal.
Do contractors get screened?
Usually, through the vendor agreement rather than through hiring. Customers auditing the company expect contractor screening to match the standard applied to employees.
What does identity verification add?
It confirms the person is who they claim to be. A criminal search confirms records tied to a name and number, which is a different question entirely.
Related Positions
For the package that applies to a specific role rather than the industry as a whole:
Firms placing technical staff at client sites are covered under Professional Services, where the client’s requirement governs access.
Worth Knowing
A Background Check Verifies Records, Not Identity
A background check searches for records associated with the identifying information provided by the applicant. Identity verification goes a step further by helping confirm that the person being hired is the same person who submitted the application. This can be especially useful for remote hiring.