CHRO and CISO: why HR and Information Security should manage human risk together

Validato believes background checks should neither be treated solely as an HR compliance formality nor remain outside the CISO’s scope as a “purely human” issue. “Human risk does not respect departmental boundaries. When CHRO and CISO jointly define which roles require which level of verification, and at what frequency, they close a gap that neither technology nor HR policy can address on its own,” says André Naef, CEO of Validato.

Validato proposes a Human Risk Management model that classifies roles according to their exposure – for example access to critical systems, financial data or customer information – and aligns the scope of checks with that exposure. In Spain, each processing activity must be assessed separately and supported by a valid legal basis; necessity and proportionality are essential. Consent should not be presented as a universal solution in employment, where an imbalance of power may exist between the company and the candidate or employee.

About Validato: Validato is an international provider of background checks and Human Risk Management, headquartered in Zurich, Switzerland, and operating internationally. Its modular, ISO 27001-certified platform enables companies to configure candidate and employee checks according to the role and within the applicable legal framework. Core data is processed and stored in Switzerland and the EU and, under Validato policy, deleted within a maximum of 120 days. No minimum volumes and no setup fees.