NIST SP 800-53 (controls) 5.1.1+u4
| Ref | Title | Text | |
|---|---|---|---|
| PS-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] personnel security policy that: (a) Addresses pur | |
| PS-02 | Position Risk Designation | a. Assign a risk designation to all organizational positions; b. Establish screening criteria for individuals filling those positions; and c. Review and update position risk designations [Assignment: frequency]. | |
| PS-03 | Personnel Screening | a. Screen individuals prior to authorizing access to the system; and b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of resc | |
| PS-03(01) in PS-3 |
Classified Information | Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system. | |
| PS-03(02) in PS-3 |
Formal Indoctrination | Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have acce | |
| PS-03(03) in PS-3 |
Information Requiring Special Protective Measures | Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: (a) Have valid access authorizations that are demonstrated by assigned official government duties; and (b) Satisfy [As | |
| PS-03(04) in PS-3 |
Citizenship Requirements | Verify that individuals accessing a system processing, storing, or transmitting [Assignment: information types] meet [Assignment: citizenship requirements]. | |
| PS-04 | Personnel Termination | Upon termination of individual employment: a. Disable system access within [Assignment: time period]; b. Terminate or revoke any authenticators and credentials associated with the individual; c. Conduct exit interviews that include a discus | |
| PS-04(01) in PS-4 |
Post-employment Requirements | (a) Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information; and (b) Require terminated individuals to sign an acknowledgment of post-employment requirements | |
| PS-04(02) in PS-4 |
Automated Actions | Use [Assignment: automated mechanisms] to [Selection (one or more): notify {{ insert: param, ps-04.02_odp.03 }} of individual termination actions; disable access to system resources]. | |
| PS-05 | Personnel Transfer | a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization; b. Initiate [Assignme | |
| PS-06 | Access Agreements | a. Develop and document access agreements for organizational systems; b. Review and update the access agreements [Assignment: frequency] ; and c. Verify that individuals requiring access to organizational information and systems: 1. Sign ap | |
| PS-06(01) in PS-6 |
Information Requiring Special Protection withdrawn | ||
| PS-06(02) in PS-6 |
Classified Information Requiring Special Protection | Verify that access to classified information requiring special protection is granted only to individuals who: (a) Have a valid access authorization that is demonstrated by assigned official government duties; (b) Satisfy associated personne | |
| PS-06(03) in PS-6 |
Post-employment Requirements | (a) Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information; and (b) Require individuals to sign an acknowledgment of these requirements, if applicable, as part of granting | |
| PS-07 | External Personnel Security | a. Establish personnel security requirements, including security roles and responsibilities for external providers; b. Require external providers to comply with personnel security policies and procedures established by the organization; c. | |
| PS-08 | Personnel Sanctions | a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and b. Notify [Assignment: personnel or roles] within [Assignment: time period] when a formal | |
| PS-09 | Position Descriptions | Incorporate security and privacy roles and responsibilities into organizational position descriptions. |
18 of 1193.