+PS-03 Personnel Screening
---+PS-03(01) Classified Information
---+PS-03(02) Formal Indoctrination
---+PS-03(03) Information Requiring Special Protective Measures
---+PS-03(04) Citizenship Requirements

PS-03 Personnel Screening

Control

  1. Screen individuals prior to authorizing access to the system; and
  2. Rescreen individuals in accordance with [Assignement: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].

Discussion

Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.

Assessment Objective

  1. individuals are screened prior to authorizing access to the system;
    1. individuals are rescreened in accordance with [Assignement: conditions requiring rescreening];
    2. where rescreening is so indicated, individuals are rescreened [Assignement: frequency].

Assessment Method

Examine

Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities

1. Übersicht

PS-03(01) Classified Information

Control

Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.

Discussion

Classified information is the most sensitive information that the Federal Government processes, stores, or transmits. It is imperative that individuals have the requisite security clearances and system access authorizations prior to gaining access to such information. Access authorizations are enforced by system access controls (see [AC-3](#ac-3) ) and flow controls (see [AC-4](#ac-4)).

Assessment Objective

  1. individuals accessing a system processing, storing, or transmitting classified information are cleared;
  2. individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system.

Assessment Method

Examine

Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(02) Formal Indoctrination

Control

Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.

Discussion

Types of classified information that require formal indoctrination include Special Access Program (SAP), Restricted Data (RD), and Sensitive Compartmented Information (SCI).

Assessment Objective

individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.

Assessment Method

Examine

Personnel security policy procedures addressing personnel screening indoctrination documents records of screened personnel system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(03) Information Requiring Special Protective Measures

Control

Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:
  1. Have valid access authorizations that are demonstrated by assigned official government duties; and
  2. Satisfy [Assignement: additional personnel screening criteria].

Discussion

Organizational information that requires special protection includes controlled unclassified information. Personnel security criteria include position sensitivity background screening requirements.

Assessment Objective

  1. individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;
  2. individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [Assignement: additional personnel screening criteria].

Assessment Method

Examine

Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(04) Citizenship Requirements

Control

Verify that individuals accessing a system processing, storing, or transmitting [Assignement: information types] meet [Assignement: citizenship requirements].

Discussion

None.

Assessment Objective

individuals accessing a system processing, storing, or transmitting [Assignement: information types] meet [Assignement: citizenship requirements].

Assessment Method

Examine

Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by PS-03 Personnel Screening – Assessment Procedure
is blocked by Personnel Screening