Background check

Answer: Considering ISO 27001, the need for background check is only required when:
- you have legal requirements (e.g., laws, contracts, or regulations) demanding such action;
- there are unacceptable risks which only can be handle by performing background checks;
- there is a top management decision defining that background checks must be performed.

If none of these situations apply, there is no need to implement background check., and even if background check is applicable, most probably it will not be necessary to cover all employees, but only the most critical roles in your organization.

2 . If we do not want to go for BGC for all employees and have letter from management for the same is it recommended or it will be a NC.

Answer: As explained before, if there is a letter from management requiring background checks, not performing them would be NC. An approach you may try is to show management that performing background checks on all employees wouldn't be efficient (or maybe even be against law), and that the background scope should be reduced only to those roles regarded as critical according the results of risk assessment.

This article will provide you further explanation about background checks:
- How to perform background checks according to ISO 27001 https://advisera.com/27001academy/blog/2018/03/26/how-to-perform-background-checks-according-to-iso-27001/