Personnel Security¶

This template is the starting point for how your organization designates the trust required by each position, screens people before they are granted access, rescreens them on a defined trigger, binds them to an access agreement, and adjusts or removes their access when they transfer or leave. It also covers the personnel security requirements you impose on external providers and the sanctions process that backs your policies.

Personnel security is the one control family the platform cannot execute for you. Background checks happen at your organization, under your legal counsel, before an account is ever requested. What the platform does is gate access on the outcome, hold the record, and evidence that the practice ran. Fill in the sample sections with what your organization actually does, then keep the User Access Request records current so the evidence matches the practice.

This document is also your Personnel Security policy and procedures. It is the document PS-1 asks for.

Download the KB article (Markdown)

Requirements this document answers¶

Personnel security is answered differently by each of the three frameworks, and the differences matter when you decide how much of this template to fill.

FedRAMP Rev5 (NIST 800-53). The full PS family, every control in the Low baseline and therefore in Moderate and High as well.

At High (Class D) the baseline adds PS-4(2), automated notification of termination actions. It is out of scope for Class C and this template does not carry it.

FedRAMP 20x. There is no Personnel Security Key Security Indicator family. PS controls appear as underlying lineage beneath five indicators in other families, which means 20x asks you to demonstrate the outcome rather than to produce a personnel security document.

Note what is absent: no KSI carries PS-1. Under 20x alone there is no indicator that asks whether this document exists. If you are pursuing 20x only, this template is still worth adopting, because the screening and personnel-action practices it describes are what the five indicators above are evidenced on, but the policy obligation itself comes from Rev5 and CMMC.

CMMC Level 2. Two practices, both in the PS domain, both derived from NIST SP 800-171 Rev. 2.

CMMC assessors examine the personnel security policy, the screening procedures, and the records of screened personnel, and they interview personnel with personnel security responsibilities. Objective [a] on PS.L2-3.9.2 is a documentation objective: the policy or process must exist as a document, not only as a habit.

Sample practice: position risk designation and screening criteria¶

Sample text. [Organization] assigns a risk designation to every position with access to the system, using [designation scheme]. The designation is set when the position is created and reviewed on the cadence in the values table. Each designation carries its own screening criteria: what checks are performed, what results disqualify, and what adjudication path applies to an adverse result. Security and privacy responsibilities appropriate to the designation are written into the position description before the position is posted.

Replace with your practice. Name the designation scheme and the role that assigns it. PS-9 is satisfied by the position description work in the last sentence, so make sure that step is real and not a statement of intent. PS-2 requires the designations be reviewed, and FedRAMP sets the floor at every three years.

Sample practice: screening before access¶

Sample text. No individual is granted access to the system before screening completes and is adjudicated favorably for the risk designation of their position. Screening for [designation] positions comprises [checks: identity verification, criminal history, employment verification, education verification, credit check where the position warrants it, and any sector-specific check]. Screening is performed by [provider or internal function] under [legal framework], and the checks performed reflect applicable laws, executive orders, directives, regulations, policies, and the criteria established for the level of access required.

Sample text. The screening outcome is recorded as [record], held by [role] under [retention period]. The record states that screening completed and was adjudicated, and the date; it does not travel into the platform, and the underlying check results stay with [role]. A User Access Request for an individual whose screening has not completed is rejected at approval.

Replace with your practice. Name the checks per designation, who performs them, and where the outcome is held. Two cautions. First, background screening is regulated: what you may check, and what you may act on, varies by jurisdiction, so this section belongs to your legal counsel as much as to your security function. Second, keep the check results out of the platform. The platform needs to know that screening passed and when; it does not need the report.

Sample practice: rescreening¶

Sample text. Individuals are rescreened when [conditions], and on the frequency set for their position's risk designation. Rescreening also occurs out of cycle on [triggers: a change in position risk designation, a documented security concern, a sanctions action, or a break in employment exceeding [period]]. An individual whose rescreening is overdue [treatment: access suspended, or access retained pending completion with a documented risk acceptance by [role]].

Replace with your practice. Rescreening is where most personnel security programs actually fail an assessment, because the initial screen is easy to evidence and the recurring one is not. Put a real trigger and a real treatment for the overdue case in the values table, and make sure something generates the reminder.

Sample practice: access agreements¶

Sample text. Every individual requiring access signs [agreements: rules of behavior, acceptable use, non-disclosure] before access is granted. The agreements are reviewed and updated on the cadence in the values table, and individuals re-sign when an agreement is updated, when their level of access changes, and otherwise on the standing cadence. [Role] holds the signed agreements and reconciles the signed set against the active account set [cadence]; an account with no current signed agreement is raised as a finding.

Replace with your practice. The reconciliation sentence is the part that gets evidenced. A stack of signed agreements proves people signed something; a reconciliation against active accounts proves nobody slipped through.

Sample practice: transfer and termination¶

Sample text. On a transfer or reassignment, [role] reviews the individual's existing logical and physical access against the operational need of the new position and confirms, modifies, or removes each authorization. The transfer actions are initiated within the period in the values table, and [notification recipients, including the access control personnel responsible for the system] are notified within the notification period. Access that the new position does not need is removed rather than left in place pending review.

Sample text. On termination, system access is disabled within the period in the values table, authenticators and credentials associated with the individual are terminated or revoked, an exit interview covering [topics] is conducted, security-related organizational property is retrieved, and the organization retains access to the information and systems the individual controlled. Where a termination follows a security concern, access is disabled first and the remaining steps follow.

Replace with your practice. This is the pair CMMC PS.L2-3.9.2 examines and the pair KSI-IAM-SUS is evidenced on. FedRAMP sets hard clocks here: four hours to disable on termination, twenty-four hours on transfer actions and notifications. Those are floors, not targets.

Sample practice: external personnel¶

Sample text. External providers whose personnel hold organizational credentials, badges, or system privileges are bound by [contract mechanism] to personnel security requirements equivalent to those above, including screening to the risk designation of the access granted. The contract names the security roles and responsibilities of the provider's personnel, requires the provider to notify [recipients] of any transfer or termination of covered personnel within the notification period, and permits [monitoring mechanism] to verify compliance. Provider compliance is reviewed [cadence], and a provider that cannot meet the notification requirement is recorded as a gap with a compensating measure.

Replace with your practice. PS-7 is the control auditors reach for when a subcontractor's departed engineer still has a valid credential. The notification clause is the substance; name where it lives in the agreement.

Sample practice: sanctions¶

Sample text. [Organization] operates a formal sanctions process for individuals who fail to comply with information security and privacy policies and procedures, run by [role] under [policy reference]. When a formal sanctions process is initiated, [recipients, to include the ISSO or equivalent] are notified within the notification period, identifying the individual and the reason. Sanctions outcomes that change an individual's access are executed as User Access Requests so the access change carries the same record as any other.

Replace with your practice. Sanctions usually already exist inside an HR disciplinary policy. PS-8 does not require a separate process, only that the security-relevant one is formal and that the ISSO learns of it on a clock. Point at the HR policy rather than duplicating it.

Organization-defined values¶

FedRAMP defines values for many of the slots below. Where the Notes column says MUST, the value is a framework floor: you may be stricter, never looser, and an interview that "confirms" a looser value produces a finding. Each MUST value is quoted verbatim from its baseline parameter, so the wording varies where FedRAMP's own wording varies. Rows marked Moderate and above have no FedRAMP-defined value in the Low baseline.

Evidence¶

The GRC-ITSM platform does not screen your people, hold your background check results, or run your sanctions process. It gates access on the screening outcome, carries the personnel actions as records, and evidences that the practice ran. See the Access Management Policy and Procedures for the User Access Request lifecycle these records live in, and the Continuous Monitoring and Reporting Policy and Procedures for the validation tree and check cadences.

The recurring account recertification and the privileged and non-privileged account compliance reviews that surface stale access are owned by the Continuous Monitoring and Reporting Policy and Procedures; the account records they operate on are owned by Access Management. This template governs the personnel practice behind them.

Authority, review, and revision¶

Client fills. Name the executive who issues this document, the role that owns personnel security, the review cadence for the policy and the separate cadence for the procedures, and the approval path for exceptions. State the scope of the policy and how it coordinates among the organizational entities involved, since personnel security spans HR, legal, and security. State that the policy is consistent with the applicable laws, executive orders, directives, regulations, policies, standards, and guidelines that govern your screening program, and name where that register is held. Record the issue date and the revision history below.

PS-1 asks for two review cadences, not one: the policy at least every three years, the procedures at least annually and following significant changes. If you adopt this as a single combined document, state both commitments separately.