Assessment Objective
Determine if:
- PS-07a. personnel security requirements are established, including security roles and responsibilities for external providers;
- PS-07b. external providers are required to comply with personnel security policies and procedures established by the organization;
- PS-07c. personnel security requirements are documented;
- PS-07d. external providers are required to notify [Assignment: personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [Assignment: time period];
- PS-07e. provider compliance with personnel security requirements is monitored.
Assessment Methods
Examine
- Personnel security policy
- procedures addressing external personnel security
- list of personnel security requirements
- acquisition documents
- service-level agreements
- compliance monitoring process
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- external providers
- system/network administrators
- organizational personnel with account management responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for managing and monitoring external personnel security
- mechanisms supporting and/or implementing the monitoring of provider compliance
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | PS-07 External Personnel Security |