And PCI DSS requires background checks. And HIPAA. SSAE16 / SOC technically doesn't, so far as I know, but it's going to end up in a company's policy due to (PC

And PCI DSS requires background checks. And HIPAA. SSAE16 / SOC technically doesn't, so far as I know, but it's going to end up in a company's policy due to (PCI | HIPAA | Insurance | Customer requirements | it was in the template) and therefore has to be enforced to pass audits.