Automated and enhanced background screening for the Water Supply Sector
The water supply sector is a core part of critical infrastructure, directly impacting public health and supply security. Increased digitalisation makes the sector more vulnerable to cyberattacks, sabotage, and insider threats. With the NIS2 Directive and the CER Directive, requirements for personnel security, access control, and continuous monitoring are tightening. This increases the need for documented background checks of employees and suppliers with access to critical facilities and systems. P-Secure digitises the entire process — from hiring to continuous re-checks — with full traceability and compliance with GDPR.
Compliance challenges in the Water Supply Sector
Within the water supply sector, critical entities must ensure that employees, suppliers, and business partners across operational organisations and supply chains undergo relevant and documented background checks. At the same time, the documentation must be up to date, consistent, and readily available as accurate, traceable, and audit‑ready evidence for authorities, supervisory bodies, and internal controls.
In practice, this can create compliance challenges, as a relatively large number of individuals may permanently or periodically work in and/or with critical entities. This can delay recruitment processes and lead to significant administrative burdens if background screening is not carried out with a high degree of system support.
At the same time, current threat assessments show that many attacks exploit legitimate access—for example through compromised user accounts, supplier access, or insufficient overview of who has access to which systems.
Useful features for water utilities
P‑Secure automates and standardises key elements of the background screening process and adapts them to the needs of the water sector. Automation ensures that background checks are conducted consistently and on time, reduces the risk of human error, and significantly lowers the administrative workload. At the same time, it strengthens the water utility’s resilience against insider threats and misuse of authorised access—both well‑known attack vectors in the sector. The solution supports, among other things:
ID and CV check
Verification of identity, CV checks and employment history, including periods of non‑employment
Criminal history check
Automatic check of criminal records
Re-check
Ongoing re‑screening and follow‑up in the event of changes in roles or access rights
Document verification
Supply‑chain management, including documentation and audit
Recommended screening categories for background checks
In collaboration with stakeholders in the energy sector, P-Secure is working to establish a common standard for screening and background checks that can be applied across energy and utilities companies. Download our recommended screening categories for the energy sector.
Regulatory requirements and P‑Secure’s recommendations
At present, there are limited sector‑specific regulatory requirements for personnel screening within critical entities in the water sector. However, both EU regulation and supervisory practice point towards heightened expectations in light of the current threat landscape.
Requirements:
- Identity verification (CER Directive)
- Criminal record certificate (CER Directive)
Security clearance
Where roles require a security clearance, P‑Secure recommends conducting background checks aligned with the criteria for a security clearance in the period leading up to the completion of the formal security clearance process.
In addition, with reference to practices from, among others, the energy and utility sectors, P‑Secure recommends background screening covering the following categories:
- Personal data
- CV checks—typically at least five years back, including documentation of gaps
- Education
- Residence and work permits
- Residence abroad exceeding six months (past five years)
- Professional roles and positions of trust
- Photo ID (passport and/or driving licence)
This provides an overall, risk‑based decision foundation that can be adapted to permanent employees, new hires, temporary staff, and suppliers—particularly for roles with access to critical facilities, control systems, and data.
NIS2 and CER
P‑Secure supports compliance with the NIS2 Directive on security of network and information systems and the CER Directive on the resilience of critical entities. Both directives impose strengthened requirements on how water utilities identify, manage, and document risks related to technical, physical, and human threats.
The directives emphasise a holistic and risk‑based approach to security, where personnel, the supply chain, and access management constitute key components in protecting against sabotage, cyberattacks, and operational disruptions.
With P‑Secure, water utilities gain a single solution that integrates personnel processes, risk management, and compliance.
The need for modern background screening
Implement automated and compliant background checks
Requirements for security, documentation, and resilience in the water sector continue to increase, and it is expected that the environmental authorities will further clarify regulatory expectations. At the same time, recent incidents demonstrate that even limited attacks or human errors can have significant consequences for operations and supply. Organisations that continue to manage background screening manually or in fragmented ways therefore face an increased risk.
Benefits of automated background screening:
- Reduces administrative workload
- Shortens time‑to‑hire
- Increases transparency and consistency
- Strengthens audit readiness, internal controls, and preparedness
- Ensures ongoing compliance
- Can be applied across both employees and the entire supply chain
Continuous compliance
More than a background check
P‑Secure is not merely a tool for one‑off background checks, but a platform for continuous compliance:
- Ensures compliance with NIS2, CER, and relevant national requirements
- Consolidates all documentation in one place—ready for audit and supervision
- Supports risk‑based re‑screening and access management
- Ensures compliance with the GDPR
