There are two sources of restrictions: State law and federal law. Federal law, through the fair credit reporting act, provides a baseline. States may impose additional restrictions.

The FCRA distinguishes between records of arrest and records of conviction. See 15 USC Sec. 1681c:
Quote Quoting 15 USC Sec. 1681c(a). Requirements relating to information contained in consumer reports
(a) Information excluded from consumer reports. Except as authorized under subsection (b), no consumer reporting agency may make any consumer report containing any of the following items of information:

(1) Cases under title 11 or under the Bankruptcy Act that, from the date of entry of the order for relief or the date of adjudication, as the case may be, antedate the report by more than 10 years.

(2) Civil suits, civil judgments, and records of arrest that, from date of entry, antedate the report by more than seven years or until the governing statute of limitations has expired, whichever is the longer period.

(3) Paid tax liens which, from date of payment, antedate the report by more than seven years.

(4) Accounts placed for collection or charged to profit and loss which antedate the report by more than seven years.

(5) Any other adverse item of information, other than records of convictions of crimes which antedates the report by more than seven years.

(6) The name, address, and telephone number of any medical information furnisher that has notified the agency of its status, unless—

(A) such name, address, and telephone number are restricted or reported using codes that do not identify, or provide information sufficient to infer, the specific provider or the nature of such services, products, or devices to a person other than the consumer; or

(B) the report is being provided to an insurance company for a purpose relating to engaging in the business of insurance other than property and casualty insurance.
Thus, the federal limits apply to arrests, but where a conviction has occurred reporting may continue indefinitely.

Also, sometimes an employer will order a criminal history abstract directly from the state, in which case the report does not fall under the FCRA at all.

Some states impose limits on how long convictions may be reported on a consumer report, and many reporting agencies simplify their lives by omitting criminal histories from their reports (the three major credit reporting agencies don't list arrest or conviction information at all), or by dropping off any information that is more than seven years old. But if you have a conviction, no matter how long ago it occurred, nobody can promise you that your employer is not going to find out about it.