Assessment Objective

Determine if:

• PS-03(03)(a) individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;
• PS-03(03)(b) individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [Assignment: additional personnel screening criteria].

Assessment Methods

Examine

• Personnel security policy
• access control policy, procedures addressing personnel screening
• records of screened personnel
• screening criteria
• records of access authorizations
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with personnel security responsibilities
• organizational personnel with information security responsibilities

Test

• Organizational processes for ensuring valid access authorizations for information requiring special protection
• organizational process for additional personnel screening for information requiring special protection

Susietos užduotys

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final