Background Investigations & Screening

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Background Investigations & Screening

Key Takeaways Explain This Topic AI

FCRA-covered employers must send a pre-adverse action notice with a copy of the consumer report and a summary of FCRA rights before finalizing an adverse hiring decision.

Industry practice and FTC guidance treat approximately five business days as a reasonable minimum waiting period between the pre-adverse and final adverse action notices.

EEOC guidance directs employers to conduct an individualized assessment of offense nature, time elapsed, and job relatedness rather than apply blanket criminal-history exclusions.

Ban-the-box laws delay the criminal-history inquiry on job applications until later in the hiring process, typically after a conditional offer.

Social media screening should route through a designated reviewer who filters out protected-class information before it reaches the hiring manager.

Last updated: July 2026

Why Background Screening Matters in Personnel Security

Personnel security is the layer of an enterprise security program built around the people who work inside the perimeter -- screening them before hire, monitoring changed risk during employment, and protecting the organization when a hiring decision must be reversed. The CPP exam tests background screening as an applied, legally constrained process, not just an investigative skill. A CPP-level security manager designs the screening policy , selects and evaluates information sources , and ensures every step complies with federal, state, and local screening laws -- chiefly the Fair Credit Reporting Act (FCRA).

Background Investigation and Screening Techniques

Pre-employment screening blends several investigative techniques, scaled to position risk:

Identity verification -- confirming the applicant is who they claim to be (SSN trace, identity document review).

Criminal history checks -- county, state, and federal court record searches, sometimes supplemented by a national criminal database as a locator (never as a final adjudication source, since national databases can be incomplete or outdated).

Employment and education verification -- confirming dates, titles, degrees, and licenses directly with the issuing institution or past employer.

Reference checks -- structured interviews with supervisors or peers, focused on job-relevant conduct.

Financial/credit history review -- used selectively, generally for positions with fiduciary or financial-control responsibility.

Drug screening and, where legally permitted, polygraph -- the latter is tightly restricted for most private-sector employers under the Employee Polygraph Protection Act.

Higher-risk or higher-trust roles (executives, finance, IT administrators, positions with access to classified or proprietary information) warrant deeper investigation; the exam expects candidates to scale screening depth to position risk rather than apply one standard package to every hire.

Information Sources

Source category Examples Screening caution

Open source Public records, news archives, litigation dockets Verify currency and reliability before relying on it

Social media Public posts, professional networking profiles Review only job-relevant, non-protected-class content; document the review process

Government databases Court records, sex-offender registries, motor-vehicle records, sanctions/watch lists Confirm jurisdictional coverage and update frequency

Credit reports Credit bureau consumer reports Only for positions where financial responsibility is job-related; triggers full FCRA obligations

Social media screening carries particular risk: reviewers can inadvertently learn an applicant's protected-class status (religion, disability, pregnancy, and similar categories), creating discrimination exposure even when the hiring decision was unrelated. Programs that use social media screening should route it through a designated reviewer who filters out protected-class information before it reaches the hiring manager.

Screening Policies and Guidelines

A defensible screening program requires a written policy that defines: which positions require which screening package; who is authorized to order and review reports; how long results are retained; and how adverse information is adjudicated (an individualized-assessment process, not an automatic disqualifier). Consistency across candidates for the same role is essential -- inconsistent application of screening criteria is one of the most common sources of discrimination claims.

Screening Laws: FCRA Requirements

The Fair Credit Reporting Act governs any employer that obtains a consumer report -- including a criminal background check compiled by a third-party consumer reporting agency -- for employment purposes. FCRA compliance runs through three phases:

1. Before ordering the report:

Provide a clear, standalone written disclosure that a consumer report may be obtained.

Obtain the applicant's written authorization .

Certify to the consumer reporting agency that the employer will comply with the FCRA, including the adverse-action process.

2. Before taking adverse action (not hiring, rescinding an offer, or terminating based in whole or in part on the report):

Send a pre-adverse action notice that includes a copy of the consumer report and the CFPB's summary of consumer rights under the FCRA.

Allow a reasonable waiting period before finalizing the decision -- industry practice and FTC guidance treat approximately five business days as a reasonable minimum, giving the applicant time to review the report and dispute inaccuracies with the reporting agency.

3. After the waiting period, if the employer proceeds:

Send a final adverse action notice stating the decision, identifying the consumer reporting agency, noting that the agency did not make the decision and cannot explain it, and advising the applicant of the right to a free report copy and to dispute inaccurate information.

Ban-the-Box and EEOC Considerations

Ban-the-box laws -- enacted in many states, cities, and for federal contractors and agencies -- delay the criminal-history inquiry on the job application until later in the hiring process, typically after a conditional offer, so candidates are evaluated on qualifications first.

Under Title VII, the EEOC treats blanket criminal-history exclusions as a potential source of unlawful disparate impact against protected classes. EEOC guidance directs employers toward an individualized assessment before excluding a candidate for a criminal record: the nature and gravity of the offense, the time elapsed since the offense or completion of sentence, and the nature of the job held or sought. A defensible program documents this assessment for every adverse decision rather than applying a fixed conviction-based bar.

Key Compliance Checklist

Standalone disclosure and signed authorization before ordering any consumer report.

Position-scaled screening criteria applied consistently across candidates.

Pre-adverse action notice plus report copy and summary of rights, then a reasonable waiting period.

Individualized assessment before any adverse decision based on criminal history.

Final adverse action notice if the employer proceeds with the decision.