+PS-03 Personnel Screening
---+PS-03(01) Classified Information
---+PS-03(02) Formal Indoctrination
---+PS-03(03) Information Requiring Special Protective Measures
---+PS-03(04) Citizenship Requirements

PS-03 Personnel Screening

Control

Screen individuals prior to authorizing access to the system; and
Rescreen individuals in accordance with [Assignement: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].

Discussion

Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.

Assessment Objective

individuals are screened prior to authorizing access to the system;
1. individuals are rescreened in accordance with [Assignement: conditions requiring rescreening];
2. where rescreening is so indicated, individuals are rescreened [Assignement: frequency].

Assessment Method

Examine

Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records

Interview

Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities

1. Overview

Summary	Standard
PS-03(01) Classified Information	Control Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system. Discussion Classified information is the most sensitive information that the Federal Government processes, stores, or transmits. It is imperative that individuals have the requisite security clearances and system access authorizations prior to gaining access to such information. Access authorizations are enforced by system access controls (see [AC-3](#ac-3) ) and flow controls (see [AC-4](#ac-4)). Assessment Objective individuals accessing a system processing, storing, or transmitting classified information are cleared; individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system. Assessment Method Examine Personnel security policy procedures addressing personnel screening records of screened personnel system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(02) Formal Indoctrination	Control Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system. Discussion Types of classified information that require formal indoctrination include Special Access Program (SAP), Restricted Data (RD), and Sensitive Compartmented Information (SCI). Assessment Objective individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system. Assessment Method Examine Personnel security policy procedures addressing personnel screening indoctrination documents records of screened personnel system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(03) Information Requiring Special Protective Measures	Control Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: Have valid access authorizations that are demonstrated by assigned official government duties; and Satisfy [Assignement: additional personnel screening criteria]. Discussion Organizational information that requires special protection includes controlled unclassified information. Personnel security criteria include position sensitivity background screening requirements. Assessment Objective individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties; individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [Assignement: additional personnel screening criteria]. Assessment Method Examine Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities
PS-03(04) Citizenship Requirements	Control Verify that individuals accessing a system processing, storing, or transmitting [Assignement: information types] meet [Assignement: citizenship requirements]. Discussion None. Assessment Objective individuals accessing a system processing, storing, or transmitting [Assignement: information types] meet [Assignement: citizenship requirements]. Assessment Method Examine Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records Interview Organizational personnel with personnel security responsibilities organizational personnel with information security responsibilities

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements
Source	Requirement

3. Related Regulations

Regulations
Source	Regulation

Linked Issues

Issuelinks
Linktype	Issue
is blocked by	PS-03 Personnel Screening – Assessment Procedure
is blocked by	Personnel Screening

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.