UNCLASSIFIED However, in exceptional situations, for example where the clearance process would take longer than the contract, organisations might make it a condition. Organisations must record the exceptions for audit and legal reasons;  Be aware that security vetting can occur either during recruitment or at any stage when business requirements, perceived risks, sensitivity and value of information warrants more assurances about the employee’s character and personal circumstances;  Have a GoU Ministry, Department, Agency sponsor for all security clearance applications;  Subject to national security considerations and guided by the Need-to-Know principle, the sponsoring GoU entities should inform individuals when they submit their names for national security vetting;  Ensure that candidates understand that, whilst no one is obliged to undergo national security vetting, occupancy of posts on the GoU list of security vetted positions is reliant upon obtaining and keeping a security clearance;  Rely on risk assessment to determine the necessity for, and the level of, security vetting undertaken for candidates aiming for sensitive positions. For example, support and ancillary staff may have to undergo appropriate vetting depending on the results of the risk management exercise;  For sensitive positions, organisations may in accordance with relevant laws, regulations and ethics, evaluate the applicant’s likelihood to succumb to pressure and/or inducement to exploit their legitimate access to premises, information and staff for unauthorised use by conducting detailed checks of the applicant’s financial matters such as credit references, assets held individually and with family members, financial commitments, unpaid bills etc;  In strict adherence with relevant laws, regulations and ethics, organisations may consider whether the personal circumstances of the individuals such as medical and criminal history as well as behaviour could pose a security risk were that person to gain employment in a sensitive position;  Work with vetting organisations to find solutions to delayed clearances. For example, an employee may work “at risk” for a specified time, as long as the individual is being vetted and is working under supervision;  Only disclose the information gathered for the security clearance application to organisations with a legitimate Need-to-Know. In addition, organisations must only retain the security clearance information for as long as necessary;  Make a risk-based decision on whether to rely on the security vetting results obtained from another organisation on a candidate under consideration, restart the vetting process or conduct more checks;  Subject to national security considerations, have in place a mechanism for providing individuals reasons for the refusal of a security clearance;  Have in place a policy for dealing with existing employees who cannot continue in their existing position and/or take up a new position because of an adverse security vetting result. The policy must address issues such as re-deployment and appeal procedures. Additionally, organisations must have 42