PS
Family: |
Personnel Security |
||
Class: |
Operational |
Download PS Baseline Security Controls here
PERSONNEL SECURITY POLICY AND PROCEDURES
Control: The organization develops, disseminates, and reviews/updates [Assignment: organization defined frequency]:
a. A formal, documented personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
b. Formal, documented procedures to facilitate the implementation of the personnel security policy and associated personnel security controls.
Supplemental Guidance: This control is intended to produce the policy and procedures that are required for the effective implementation of selected security controls and control enhancements in the personnel security family. The policy and procedures are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Existing organizational policies and procedures may make the need for additional specific policies and procedures unnecessary. The personnel security policy can be included as part of the general information security policy for the organization. Personnel security procedures can be developed for the security program in general and for a particular information system, when required. The organizational risk management strategy is a key factor in the development of the personnel security policy.
Related control: PM-9.
Control Enhancements: None.
References: NIST Special Publications 800-12, 800-100.
| LOW PS-1 | MOD PS-1 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
Parameter: at least annually
Additional Requirements and Guidance:
None.
POSITION CATEGORIZATION
Control: The organization:
a. Assigns a risk designation to all positions;
b. Establishes screening criteria for individuals filling those positions; and
c. Reviews and revises position risk designations [Assignment: organization-defined frequency].
Supplemental Guidance: Position risk designations are consistent with Office of Personnel Management policy and guidance. The screening criteria include explicit information security role appointment requirements (e.g., training, security clearance).
Related control: None.
Control Enhancements: None.
References: 5 CFR 731.106(a).
| LOW PS-2 | MOD PS-2 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
(c) Parameter: at least every three years
Additional Requirements and Guidance:
None.
PERSONNEL SCREENING
Control: The organization:
a. Screens individuals prior to authorizing access to the information system; and
b. Rescreens individuals according to [Assignment: organization-defined list of conditions requiring rescreening and, where re-screening is so indicated, the frequency of such rescreening].
Supplemental Guidance: Screening and rescreening are consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidance, and the criteria established for the risk designation of the assigned position. The organization may define different rescreening conditions and frequencies for personnel accessing the information system based on the type of information processed, stored, or transmitted by the system.
Related control: None.
Control Enhancements: None.
References: 5 CFR 731.106; FIPS Publications 199, 201; NIST Special Publications 800-73, 800- 76, 800-78; ICD 704.
| LOW PS-3 | MOD PS-3 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
(b) Parameter: for national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance.For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low risk positions
Additional Requirements and Guidance:
None.
PERSONNEL TERMINATION
Control: The organization, upon termination of individual employment:
a. Terminates information system access;
b. Conducts exit interviews;
c. Retrieves all security-related organizational information system-related property; and
d. Retains access to organizational information and information systems formerly controlled by terminated individual.
Supplemental Guidance: Information system-related property includes, for example, hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that individuals understand any security constraints imposed by being former employees and that proper accountability is achieved for all information system-related property. Exit interviews may not be possible for some employees (e.g., in the case of job abandonment, some illnesses, and nonavailability of supervisors). Exit interviews are important for individuals with security clearances. Timely execution of this control is particularly essential for employees or contractors terminated for cause.
Related control: None.
Control Enhancements: None.
References: None.
| LOW PS-4 | MOD PS-4 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
None.
Additional Requirements and Guidance:
None.
PERSONNEL TRANSFER
Control: The organization reviews logical and physical access authorizations to information systems/facilities when personnel are reassigned or transferred to other positions within the organization and initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action].
Supplemental Guidance: This control applies when the reassignment or transfer of an employee is permanent or of such an extended duration as to make the actions warranted. In addition the organization defines the actions appropriate for the type of reassignment or transfer; whether permanent or temporary. Actions that may be required when personnel are transferred or reassigned to other positions within the organization include, for example: (i) returning old and issuing new keys, identification cards, and building passes; (ii) closing previous information system accounts and establishing new accounts; (iii) changing information system access authorizations; and (iv) providing for access to official records to which the employee had access at the previous work location and in the previous information system accounts.
Related control: None.
Control Enhancements: None.
References: None.
| LOW PS-5 | MOD PS-5 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
Parameter: See additional requirements and guidance.
Parameter: within five days
Additional Requirements and Guidance:
Requirement: The service provider defines transfer or reassignment actions. Transfer or reassignment actions are approved and accepted by the JAB.
ACCESS AGREEMENTS
Control: The organization:
a. Ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and
b. Reviews/updates the access agreements [Assignment: organization-defined frequency].
Supplemental Guidance: Access agreements include, for example, nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with the information system to which access is authorized. Electronic signatures are acceptable for use in acknowledging access agreements unless specifically prohibited by organizational policy.
Related control: PL-4.
Control Enhancements: None.
References: None.
| LOW PS-6 | MOD PS-6 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
(b) Parameter: at least annually
Additional Requirements and Guidance:
None.
THIRD-PART PERSONNEL SECURITY
Control: The organization:
a. Establishes personnel security requirements including security roles and responsibilities for third-party providers;
b. Documents personnel security requirements; and
c. Monitors provider compliance.
Supplemental Guidance: Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management. The organization explicitly includes personnel security requirements in acquisition-related documents.
Related control: None.
Control Enhancements: None.
References: NIST Special Publication 800-35.
| LOW PS-7 | MOD PS-7 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
None.
Additional Requirements and Guidance:
None.
PERSONNEL SANCTIONS
Control: The organization employs a formal sanctions process for personnel failing to comply with established information security policies and procedures.
Supplemental Guidance: The sanctions process is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. The process is described in access agreements and can be included as part of the general personnel policies and procedures for the organization.
Related controls: PL-4, PS-6.
Control Enhancements: None.
References: None.
| LOW PS-8 | MOD PS-8 |
Federal Risk and Authorization Management Program
Control Parameter Requirements:
None.
Additional Requirements and Guidance:
None.