Screening Records¶
Purpose. Records who has been screened, how and when, under the HR Security Policy §2.1, using the checks on the Employee Screening Checklist. It holds no copies of identity documents: only that the check was done, how, when and by whom.
1. Who needs screening at Soon¶
The HR Security Policy (§2.1, approved 2026-09-04) sets screening proportionate to Soon's size and risk, as ISO/IEC 27001 A.6.1 requires:
- Founders were not screened on joining. They founded the company. The policy records this as such, deliberately, rather than back-filling checklists written after the fact. This covers Olaf Jacobson, Thomas Picauly, Alessandro Cardinali and Melvin Jacobson.
- Screening applies from the first non-founder hire onwards. Soon has made no non-founder hires to date.
- External parties with access are screened. The only one is the external security consultant below.
- No criminal-record checks (VOG), drug, driving-record or credit checks are run at this size. The trigger for revisiting that is in HR Security Policy §2.6.
2. Records¶
Andrea Cardinali — CyberSquad (external security consultant)¶
Access held: read on the SoonHQ/isms repository; read on isms.soon.works. No
production, customer-data or credential access (Consultancy Agreement ISMS-DOC-A05-20-1 §2 and §6).
Role risk level: Low. Confidential ISMS documentation only.
| No | Check | Outcome | Reference | Completed | By |
|---|---|---|---|---|---|
| 1 | Identity: government-issued ID checked | Government ID shown on a video call and checked against the person. Andrea is also known personally to the ISM, for many years | ID not copied or retained | 2026-10-01 | Olaf Jacobson |
| 2 | References or verifiable track record | Verifiable public track record as an information-security and compliance practice. Both sources reviewed and confirmed live | https://cybearsquad.com/ ("CybearSquad Security Office") · https://www.linkedin.com/company/cybearsquad/ | 2026-10-13 | Olaf Jacobson |
| 3 | Qualifications, where relevant | Not required: advisory role with no system access. Any security certifications held may be noted here | — | — | — |
| 4 | Criminal-record check (VOG) | Not performed. Not proportionate under HR Security Policy §2.1 | — | — | — |
Contract and confidentiality: Consultancy Agreement ISMS-DOC-A05-20-1 and the NDA it incorporates (signed copies: checklist row 4). Related party: brother of founder Alessandro Cardinali. Disclosed in ISMS-DOC-05-2 §1.7.
Note on timing. Andrea's engagement began in Q2 2026, before this record existed. The policy condition that no production or customer-data access is granted before screening was met throughout, because no such access was ever granted. This record formalises the check.
Change log¶
| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | 2026-10-13 | ISMS | First version, for checklist row 11 (CC1.4): records the policy position on founders and the screening of the one external party with access. |
| 0.2 | 2026-10-13 | Olaf Jacobson | Andrea Cardinali's screening completed: ID checked on video call 2026-10-01; track record verified from CybearSquad's website and LinkedIn page. |