03.09.04E Citizenship Requirements

Statement

Verify that individuals accessing a system that processes, stores, or transmits CUI meet {{ insert: param, A.03.09.04E.ODP.01 }}.

Guidance

Organizations may determine that individuals who need access to CUI associated with a high value asset or critical program require U.S. citizenship status. This requirement enhances SP 800-171 requirement 03.09.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

individuals accessing a system processing, storing, or transmitting CUI meet {{ insert: param, A.03.09.04E.ODP.01 }}.

Assessment method

• Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records

Assessment method

• Personnel with personnel security responsibilities personnel with information security responsibilities

Assessment method

• Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship processes for additional personnel screening

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final