BPSS and National Security Vetting: What the Mandelson Scandal Reveals About the Baseline Every Employer Gets Wrong

In mid-April 2026, it was reported that Peter Mandelson had failed his developed vetting assessment before his appointment as UK ambassador to the United States. He was given top security clearance anyway. A senior civil servant at the Foreign Office overrode the vetting outcome. When the story broke, the Prime Minister's chief of staff resigned and said publicly that the due diligence and vetting process had to be fundamentally overhauled. Former UK high commissioner Arthur Snell described the national security vetting system as limited, flawed, untransparent and crying out for reform.

That story concerns what happens at DV level, the highest tier of national security vetting clearance. But the question it should prompt every employer holding or bidding for government contracts to ask is a more fundamental one. If the senior layers of the UK's vetting framework can crack under pressure, what does that mean for the baseline sitting underneath all of it? Because BPSS is that baseline. Every clearance level depends on it. And in my experience, most employers carrying BPSS obligations do not fully understand what they have taken on.

What Most Organisations Get Wrong

I spent 18 years doing this work. The single most persistent mistake I saw with BPSS was straightforward: organisations believed that completing a BPSS process meant they had obtained security clearance. They had not. They had completed a pre-employment screening standard. Those are not the same thing, and the gap between them carries real consequences.

BPSS is not a formal security clearance. The Cabinet Office is explicit on this point. It is a screening standard. It establishes a baseline of assurance about an individual's identity, their right to work, their employment history and their unspent criminal record. National security vetting, which operates at CTC, SC and DV level, sits above BPSS. The baseline is the foundation on which NSV is built. It is not a destination.

The second mistake I saw consistently was treating BPSS as a one-time event rather than a process with ongoing responsibilities. Organisations would complete the checks at the point of hire, file a form somewhere and move on. Nobody tracked whether every element had actually been verified. Nobody checked whether a BPSS Verification Record existed and was complete. And nobody understood what needed to happen before that individual could be put forward for national security vetting when a contract required it.

I saw organisations lose government contracts because of exactly this. A departmental authority asked to see the documentation. It was not there. Or it was incomplete. The individual could not be put forward. The contract was at risk.

What BPSS Actually Requires

BPSS requires verification of four things. Identity, to an appropriate standard of assurance. Right to work in the UK. Employment history covering the previous three years, or back to the age of 16 if the candidate is younger. And an unspent criminal record check.

Each of these must be verified, not simply self-reported. The record of that verification must be documented on a BPSS Verification Record, which is the official document confirming that BPSS has been completed. That document is what a departmental authority will ask to see when an NSV application is required. If it does not exist, you do not have a complete BPSS, regardless of what checks you think you have run.

Where BPSS Ends and NSV Begins

BPSS is the prerequisite for national security vetting, not a level within it. Once BPSS is complete, the departmental authority responsible for a given post determines whether NSV is required and at what level.

Counter Terrorist Check is the first level of NSV. It applies to roles involving proximity to public figures assessed to be at particular risk from terrorist attack, access to information of value to terrorists, or unescorted access to certain sensitive establishments. CTC requires everything in BPSS plus a security questionnaire and checks against Security Service records.

Security Check sits above CTC. It is required for long-term, frequent and uncontrolled access to information classified as SECRET, or supervised access to TOP SECRET material. SC adds credit and financial history checks and can extend to relatives or others named on the security questionnaire.

Developed Vetting is the highest level. It applies to long-term, frequent and uncontrolled access to TOP SECRET material or particularly sensitive intelligence. DV involves a full review of personal finances and an in-depth interview.

The official government position is unambiguous. BPSS is not a formal security clearance, but its rigorous and consistent application underpins the national security vetting process at CTC, SC and DV. Weak BPSS means weak foundations. Every tier above it is only as reliable as the baseline underneath.

Who Owns the Responsibility

The employing authority owns BPSS. Not UKSV. Not a third-party supplier. The organisation that is employing or contracting the individual. Identity and right to work checks must be completed before an NSV application can even be initiated. Criminal record and employment history checks must be completed before the BPSS is considered done and before NSV can be relied upon.

That responsibility cannot be delegated away. A supplier can assist with running the checks. The accountability for whether the process has been completed correctly stays with the employer.

The Consequences of Getting It Wrong

If your BPSS process is incomplete, inconsistently applied or poorly documented, the consequences are specific.

A departmental authority can refuse to initiate an NSV application. That means the individual cannot take up the role requiring clearance. For a contracted post, that can mean delay, an inability to resource the contract and, in some cases, loss of the contract entirely.

For organisations on government framework agreements or approved supplier lists, a BPSS failure on audit can result in removal from the list. Getting back on takes time and carries significant commercial cost.

The Mandelson story made headlines at DV level. The operational lesson for every employer reading this sits at the layer below all of it. BPSS is your responsibility. If you cannot demonstrate that you have completed it correctly, the consequences are yours to manage.

Charlotte Is the Answer to This Problem

Charlotte is not a search engine and she is not a guidance document. She is the closest thing to having me available to your organisation at any hour. She covers 68 specialist topic areas across the full scope of UK pre-employment screening, vetting compliance, governance and risk, built entirely on 18 years of real operational experience. Ask her anything and get a clear, practical, expert answer at the exact point the decision needs to be made.

On BPSS and national security vetting specifically, Charlotte can tell you what your BPSS process must cover, what the BPSS Verification Record needs to contain, what the employing authority must do before putting an individual forward for CTC or SC, and how to structure your documentation so it holds up under scrutiny. If you have any doubt about whether your BPSS process is genuinely complete, Charlotte is the right place to start.

To give you a sense of what Charlotte can do on this topic, here is the question I put to her and the answer she came back with.

Charlotte provides expert guidance based on 18 years of real operational experience in UK employment screening and vetting. She does not provide legal advice. For legal matters specific to your organisation, always consult a qualified solicitor.

Getting access to Charlotte requires a one-time setup of £500 and an ongoing monthly access fee of £895. There are no per-user or per-seat charges. Multiple authorised users can access Charlotte across your organisation. Access runs month to month with no long-term commitment. The 7-day free trial at https://vettinghub.co.uk/trial is the obvious starting point. Full access, real questions, real answers and nothing to cancel if she is not right for you.

Read More on This Topic

If you want to understand the full scope of what BPSS requires and where organisations consistently fall short, my post from earlier this week covers the standard in depth and sets out the most common compliance gaps I saw across 18 years of operational work: https://vettinghub.co.uk/post/bpss-compliance-gaps-government-contractors

If you are working across more than one screening standard and you are not certain whether BPSS or BS7858 governs your obligations, this post sets out the key differences clearly and helps you work out which standard applies to your organisation: https://vettinghub.co.uk/post/bs7858-vs-bpss-which-screening-standard-applies-to-your-organisation

Frequently Asked Questions

Is BPSS the same as a security clearance?

No. BPSS is a pre-employment screening standard, not a formal security clearance. It establishes a baseline of assurance about identity, right to work, employment history and unspent criminal record. National security vetting clearances, which are CTC, SC and DV, sit above BPSS and require BPSS to have been completed first.

Who is responsible for completing BPSS?

The employing authority. That means the organisation hiring or contracting the individual. A supplier can assist with running the checks, but the employing authority owns the process, holds the documentation and is accountable for whether BPSS has been completed correctly.

What does BPSS actually check?

BPSS verifies four things: identity, right to work in the UK, employment history covering the previous three years (or back to age 16), and an unspent criminal record. Each element must be verified rather than self-reported, and the outcome must be recorded on a BPSS Verification Record held by the employing authority.

Can someone be put forward for CTC or SC without completing BPSS first?

No. Identity and right to work checks must be completed before an NSV application can even be initiated. Employment history and criminal record checks must follow before the BPSS can be relied upon. Without a complete, documented BPSS, a departmental authority cannot proceed with CTC or SC vetting.

Does BPSS expire?

BPSS does not carry a formal expiry date in the way that NSV clearances do. However, where an individual moves to a new employing authority, that employer must carry out its own BPSS process. Accepting a previous employer's BPSS without independent verification is a risk most departmental authorities will not accept.

Start With a Real Question

The best way to understand what Charlotte can do on BPSS, national security vetting and the 68 specialist topic areas she covers is to ask her a real question yourself. The 7-day free trial at https://vettinghub.co.uk/trial gives you full access, no sign-up risk and nothing to cancel if she is not right for you.

A one-time setup of £500 deploys Charlotte securely into your organisation or platform. Ongoing monthly access is £895, with no per-user charges, no long-term contracts and no limits on use. Charlotte covers 68 specialist topic areas across pre-employment screening, vetting compliance, governance and risk. She is available from the moment she is deployed, every hour of every day, at the exact point screening decisions are being made.