As a data center HR professional, you face significant risks when hiring because a single insider breach could compromise thousands of your tenants’ workloads.
By conducting in-depth pre-employment screens, you can protect sensitive company information and ensure your employees are trustworthy, qualified, and safe.
This guide explains how you should tier these checks based on role and access level while staying compliant with legal requirements.
Key Takeaways
- Data center background checks are role-tiered, highly secure screening programs used to confirm an applicant’s identity, employment record, criminal history, education, and credentials for base-level positions, and roles with greater access require more in-depth searches.
- A baseline package for any data center role includes identity verification, multi-level criminal history searches, employment verification, sex offender registry and global watchlist/sanctions checks, and education and credentials verification for jobs requiring degrees or certifications.
- To build a data center screening program, include adjudication guidelines in your background check policy, classify roles and match search depth by access tier, choose a reliable background check provider, follow the FCRA’s requirements, and include continuous rescreens.
Why You Should Screen Every Data Center Employee, Contractor, and Vendor
In a data center, a single contractor or employee could cause damage that spreads across your entire information system through human error or an insider attack.
According to the 2026 Verizon Data Breach Investigations Report (DBIR), insiders were responsible for 12% of all investigated data breaches.
Internal and external threats frequently target information held by AI training and other data centers because of the sheer amount of proprietary and sensitive information.
Client contracts and regulatory frameworks may mandate specific searches in your background checks, and many companies won’t contract with you unless you can document that you thoroughly investigate all employees and contractors through compliant background checks.
What Every Data Center Background Check Should Include
As a baseline for any role, all data center background check packages should include:
1. Identity Verification
Identity verification confirms an individual is who they say they are, surfaces additional areas to search, and verifies their legal authorization to work in the US.
Components include an SSN trace, biometric ID, and right-to-work verification.
Basic Identity Verification
A Basic Identity Verification is the initial search performed in a background check.
It shows the following information:
- The names (current, maiden, and any alias names) associated with the data provided by the candidate
- Date of birth associated with the data provided by the candidate
- Addresses associated with the candidate
Biometric Identity Validation
Biometric identity validation matches an individual’s characteristics against a trusted source to verify they are who they say they are.
For example, an applicant might submit a copy of a valid government-issued ID and provide a live sample (fingerprint, selfie, or video) that can be compared against it.
In 2026, this search has become increasingly important due to the wave of deepfake and synthetic identity hiring fraud.
For example, the Federal Bureau of Investigation issued a 2024 advisory warning about the use of AI to create fraudulent identification documents.
In April 2026, the US Department of Justice announced sentences for two US nationals who facilitated the remote hiring of North Korean nationals by creating false documents that led companies to believe they were hiring American IT workers in a scheme to deliver funds to North Korea.
Right-to-Work (I-9/E-Verify)
As an employer, you must gather information using the I-9 form. You might also be required to participate in E-Verify when hiring workers in the US.
I-9 and E-Verify documentation must survive an audit and demonstrate that those who were hired have legal authorization to work in the US.
2. Multi-Level Criminal History Checks
A criminal history check doesn’t involve searching a single database. Instead, it involves searching the following layers of records:
County Criminal Records Search
A county criminal records search for all jurisdictions in which an applicant has lived or worked, as revealed by the candidate-provided data.
Since most criminal records originate at the county level, you should search all counties in which an applicant has lived or worked.
Statewide Criminal Repositories
Local jurisdictions submit criminal conviction records to state criminal repositories, but their coverage varies by state.
In most states, we recommend using a statewide criminal repository search as a supplement to county searches rather than a substitute. This broadens your research and can find records in jurisdictions where the candidate has either lived or worked.
Federal Criminal Records Search
Since federal crimes are prosecuted at the federal level rather than in state courts, they don’t appear in county and statewide searches.
Instead, they only appear in the federal criminal database.
Federal criminal records searches reveal convictions, including fraud, embezzlement, wire fraud, cybercrime, crimes that cross state lines, crimes that occur on federal property, and others, that are highly relevant to work in data centers.
A federal criminal records search should be non-negotiable for your background screening package.
National Criminal Database Search
A national criminal database search is a preliminary investigation tool used to identify convictions and/or pending cases in jurisdictions across the United States. These valuable resources include jail rosters, incarceration records, and many other valuable “pointer” data.
When a national criminal records search finds possible records, the background check provider should always verify any records that appear at the primary source level (county, state, or federal).
A national database hit is not enough to adjudicate without the additional primary source search and verification.
Names and Aliases Search
The final step in a criminal history search involves searching all names and aliases found by the SSN trace at each criminal records level.
This reveals records that might be associated with a former name or alias but not with the individual’s current legal name.
3. Sex Offender Registry Check
Sex offender registry checks reveal whether an applicant is a registered sex offender, the offense requiring registration, and the jurisdiction in which they’re registered.
Run a sex offender registry check on all names and aliases revealed by the SSN trace.
4. Global Watchlist/
These searches are critical for data centers serving government or international clients.
They reveal whether an applicant appears on a global watchlist or has been sanctioned or barred from doing business in the US because of participation in terrorist activities, major international crimes, and more.
This search must include all names revealed by the basic identity verification.
5. Employment Verification
Employment verification confirms an applicant’s claimed employment history and reports the following information:
- Names and addresses of each employer
- Employment dates
- Titles/positions held
Employment verification flags potential undisclosed employment at competing data centers, tenant companies, or third-party vendors to assess potential intellectual property threats. It will also verify the work history that the candidate brings to your company. Look for unexplained gaps in employment and seek clarification when needed.
6. Education, Credentials & License Verifications
Education Verification
You should conduct education verification for any position that requires a degree.
It confirms the following information:
- Name and address of each educational institution attended
- Enrollment dates
- Any degrees, diplomas or certificates conferred
Credential Verification
For technical roles requiring certifications, such as network engineers, system administrators, cloud solutions architects, etc., a credential verification confirms whether an applicant holds the credential required for the job, including:
- CISSP
- CCNA/CCNP
- CompTIA
- VMware
- AWS/Azure/GCP
- Uptime Institute Certifications
- Cisco DCICN
Professional License Verification
For any position requiring a professional license, such as trades working on site, professional license verification shows the type of license, the licensee’s name, issuance and expiration dates, and any public discipline against the licensee.
This type of check is important for state-licensed electricians, professional engineers, and HVAC technicians.
Know Before You Hire
Background Searches to Conduct by Access Level
In addition to the base-level searches detailed above, you should also tier your package by each role’s access level.
For example, you don’t need to perform identical screens for a lobby receptionist, a technician with unescorted data-hall access, and an administrator with logical/root access, which is the highest access level for a computer information system.
In these cases, the lobby receptionist would require a less in-depth screening, while the administrator would need a much deeper background investigation.
Assigning the depth of your background check package to a documented access tier helps save your company money and defend against potential risks.
| Tier | Access Profile, Example Roles & Additions |
|---|---|
| T1 — Privileged / Root | Access profile: Full logical + physical, unescorted, admin credentials Example roles: Baseline (above) + these additions: |
| T2 — Hardware-Hands | Access profile: Physical access to racks, network kit Example roles: Baseline (above) + these additions: |
| T3 — Facility & Ops | Access profile: Building access, environmental & power systems Example roles: Baseline (above) + these additions: |
| T4 — Perimeter & Support | Access profile: Escorted or perimeter-only Example roles: Baseline (above) + these additions: |
| T5 — Contractor / Vendor | Access profile: Third-party — construction, maintenance, cleaning, security Example roles: Baseline (above) + these additions: |
A note about credit checks: Understand the laws in your state before conducting pre-employment credit checks. Several states restrict employers from conducting these searches for most jobs, although many include a number of exceptions (i.e., roles involving access to sensitive financial information). Consult legal counsel before including credit checks in your background searches.
Compliance Framework Requirements
Since data centers handle vast amounts of data and require high security levels to protect their customers’ information, they must comply with various regulatory frameworks:
- Systems and Organization Control 2 (SOC 2) – SOC 2 is a voluntary cybersecurity compliance standard developed by the American Institute of Certified Public Accountants (AICPA) to measure how well an organization protects sensitive systems and data from unauthorized access and disclosure.
- ISO 27001:2022 – ISO 27001:2022 is a standard developed by the International Organization for Standardization (IOS) used by organizations of all sizes to ensure their information security management systems are protected against cybersecurity risks.
- PCI DSS 4.0.1 – PCI DSS 4.0.1 is a mandatory global data security standard for any organization that holds, processes, or transmits credit card information.
- Health Insurance Portability and Accountability Act (HIPAA) – HIPAA is a major law that protects the confidentiality and security of protected health information and includes mandates for strict physical, administrative, and technical safeguards.
- FedRAMP/FISMA – The Federal Information Security Modernization Act (FISMA) was passed in 2002 and requires federal agencies to develop and implement information security systems. The Federal Risk Authorization and Management Program (FedRAMP) was implemented in 2011 under FISMA to provide a systematic approach for continuous monitoring and assessment of cloud products supplied by companies to the federal government. It applies to cloud service providers that deliver Software as a Service (SaaS) and Platform as a Service products to federal agencies.
- NERC-CIP 004 – NERC-CIP 004 is a standard for companies touching the bulk electrical system to ensure that only vetted employees and contractors can access critical cyber data that could affect the grid. The NERC CIP-004 requirement is the only framework that requires a specific look-back period and a re-check cadence.
Any facility that touches the bulk electric system is bound by this, which is becoming increasingly relevant as data centers consume more power and interconnect with electrical grid infrastructure.
- CMMC 2.0 – CMMC 2.0 is the US Department of Defense’s mandatory cybersecurity framework designed to protect controlled unclassified information (CUI) and federal contractor information (FCI). It applies to all federal contractors handling CUI and private companies handling FCI.
- NIS2 (EU) – NIS2 is a mandatory EU cybersecurity directive that applies to organizations operating in the EU and mandates that they apply stringent measures to protect sensitive information.
It’s important to apply the applicable compliance frameworks listed above based on the sensitive information your data center handles when you’re hiring for related roles, based on their access levels.
Know Before You Hire
Important Laws and Regulations
Federal Laws
Fair Credit Reporting Act
The Fair Credit Reporting Act protects consumer privacy in the information gathered, held, and disseminated by consumer reporting agencies (CRAs), including background check providers.
This law includes a rule that restricts the reporting of the following non-conviction information older than seven years when a position pays less than $75,000 annually:
- Arrests that didn’t result in convictions
- Chapter 13 bankruptcies (Chapter 7 can be reported for 10 years)
- Debt collection accounts
- Paid tax liens
- Civil lawsuits and judgments
Employers must also comply with the FCRA’s notice and consent requirements when they intend to conduct employment background checks. This means that you must clearly notify applicants and employees that you will conduct a background check on a standalone form without extraneous information.
You must also obtain the applicant’s signed authorization before you initiate a background check.
Once you receive the results, you must complete the adverse action steps before you decide not to hire an applicant based on information contained in a background check report.
Title VII of the Civil Rights Act of 1964
Title VII is a federal anti-discrimination law that prohibits workplace discrimination during any phase of employment based on an applicant’s or employee’s protected characteristics.
The Equal Employment Opportunity Commission (EEOC), which is the federal agency tasked with enforcing Title VII, has issued guidance to employers on how they should handle conviction information they learn from background checks.
If an applicant has a criminal record, you should assess it as it relates to the job’s duties and workplace safety before basing an adverse employment decision on that information.
Fair Chance to Compete for Jobs Act
The Fair Chance to Compete for Jobs Act is a federal fair-chance hiring law that applies to federal agencies and private companies that seek and/or hold federal contracts.
This law mandates that federal contractors wait to perform criminal history checks until after they have extended conditional employment offers.
If you check an applicant’s criminal history too early, federal agencies are prohibited from contracting with your company.
State Laws
State laws vary widely. Some common laws that you should know include state and local ban-the-box laws, clean slate laws, and credit check restrictions.
Ban the box laws require you to avoid asking about criminal history information on applications, and many also require you to wait until later in the hiring process before inquiring about criminal history.
Clean slate laws provide for the automatic expungement of certain convictions after a specific waiting period.
Several states have credit check restrictions for employers. Some include exclusions for certain types of companies.
To learn about the laws in your jurisdiction, it’s best to consult legal counsel.
How to Build a Data Center Screening Program
1. Include Adjudication Guidelines in Your Background Check Policy
Include written role-based adjudication guidelines in your background check policy to ensure consistency in hiring decisions across candidates. This is your best defense against both discrimination claims and audit findings.
Your guidelines should define:
- roles
- offense types and categories
- the relevant look-back window
- individualized assessment triggers
- who holds decision-making authority in hiring
You reduce the risk of unconscious bias and potential lawsuits when you apply consistent hiring criteria instead of relying on case-by-case judgment.
2. Classify Roles and Match Search Depth by Access Tier (T1 to T5)
Review the roles your center hires for and classify them by the level of access each has to your intellectual property and sensitive client information.
Once you’ve determined each position’s access tier, choose the background searches required while incorporating relevant compliance framework mandates.
3. Choose a Reliable Screening Provider
Choose a reliable screening provider, such as iprospectcheck, that can deliver legally compliant searches for every role and provide customized searches tailored to your needs.
4. Follow the FCRA’s Requirements
Make sure to include a standalone disclosure form and obtain consent before initiating a background check.
If you decide not to hire a candidate based on information contained in a background check report, follow the FCRA’s adverse action process before making a final decision:
- Send a pre-adverse action notice to the candidate and include a copy of the report that contains the problematic information, along with a copy of their rights under the FCRA.
- Give the candidate a reasonable opportunity to respond. The candidate can provide evidence that the information is wrong or that they have been rehabilitated.
- Send a final adverse action notice if you make the final decision not to hire the candidate. You should enclose a copy of their rights under the FCRA.
5. Include Continuous Rechecks
When you conduct pre-employment background checks, they capture an individual’s history at a single point in time. This information can change post-hire, and an employee’s access can span years.
Because of data center access levels and inherent risks, periodic rechecks are increasingly becoming the norm.
In many cases, customer contracts require periodic re-checks, making it a commercial requirement rather than a compliance mandate.
NERC CIP-004 explicitly mandates re-checks every 7 years for bulk-electric-system-touching facilities.
If your center implements periodic rechecks, you must comply with the FCRA’s notice and consent requirements and complete the adverse action process before basing an adverse decision on post-hire findings.
Document and retain information for auditors demonstrating your compliance and the frequency of your rechecks.
Your re-check consistency should be:
- Tier 1 employees – Annually
- Tier 2 – Tier 4 employees – When triggered
- NERC CIP (touching bulk electrical system) – 7 years
The Cost of Skipping a Thorough Background Check in a Data Center
You can invest millions in cybersecurity, surveillance, and access controls, but one hiring mistake can undermine them all. Matt Rodgers, founder of iProspectCheck, shares a true story from his experience in the background screening industry that shows how one hiring decision led to a major insider security breach.
Show more
Trust iprospectcheck to Protect Your Data Center with Thorough & Compliant Background Checks
When you’re hiring for a data center, you must conduct in-depth background checks to protect your intellectual property and the sensitive cyber information you retain and handle.
At iprospectcheck, we perform in-depth data center background checks for positions at all access tiers and stay up-to-date with all legal and regulatory requirements.
To learn more about our background checks and obtain a free quote, talk to a data center screening specialist today: (888) 509-1979.
FAQs
Do data center employees need background checks?
Yes, all data center employees need background checks. You should conduct some baseline searches on all employees and add additional searches based on the role’s tiered access level and compliance requirements.
Like employees, contractors working inside data centers need background checks because they have access to intellectual property and pose similar risks.
Some infamous examples include the 2013 Target breach, in which hackers stole 40 million credit card numbers through a third-party HVAC vendor. Others include the MOVEit breach in 2023, in which hackers gained access to data from 66.5 million individuals and companies by exploiting a software vulnerability, and the Snowflake breach in 2024, in which financially motivated hackers used stolen credentials harvested by Malware to log into accounts lacking two-factor authentication.
Who pays for data center contractor screening?
For contractor screening, you can pay for and run the screens, ask the contractor to pay for it with your center verifying their checks, or jointly agree with the contractor company on a reliable third party to perform the checks for both of you.
