To manage risks associated with security-sensitive activities, the organization should establish and implement a security vetting process for all individuals involved in such activities. This process must be completed before an individual begins their participation.
The security vetting should encompass a basic investigation, a register check, and a special personal investigation. The scope and depth of these investigations should align with the requirements of applicable security protection regulations, such as the Swedish Security Protection Act.
If specific reasons warrant it, the extent of the security vetting may be less comprehensive. Furthermore, the organization is responsible for continuously following up on security vetting throughout the duration of an individual's participation in security-sensitive activities.
