3.9 Personnel Security

Statement

• Develop and document access agreements for systems processing, storing, or transmitting CUI.

• Review and update the access agreements {{ insert: param, A.03.09.03E_prm_1 }}.

• Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:

  • Sign appropriate access agreements prior to being granted access; and

  • Re-sign access agreements to maintain access to systems when access agreements have been updated or {{ insert: param, A.03.09.03E_prm_1 }}.

Guidance

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

access agreements are developed and documented for systems processing, storing, or transmitting CUI.

Assessment objective

access agreements are reviewed {{ insert: param, A.03.09.03E.ODP.01 }} .

Assessment objective

access agreements are updated {{ insert: param, A.03.09.03E.ODP.01 }} .

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or {{ insert: param, A.03.09.03E.ODP.02 }} .

Assessment method

• Personnel security policy personnel security procedures procedures addressing access agreements for systems processing, storing, or transmitting CUI access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan other relevant documents or records

Assessment method

• Personnel with personnel security responsibilities personnel who have signed and/or resigned access agreements personnel with information security responsibilities

Assessment method

• Processes for reviewing, updating, and re-signing access agreements mechanisms supporting reviewing, updating, and re-signing of access agreements

Statement

Verify that individuals accessing a system that processes, stores, or transmits CUI meet {{ insert: param, A.03.09.04E.ODP.01 }}.

Guidance

Organizations may determine that individuals who need access to CUI associated with a high value asset or critical program require U.S. citizenship status. This requirement enhances SP 800-171 requirement 03.09.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

individuals accessing a system processing, storing, or transmitting CUI meet {{ insert: param, A.03.09.04E.ODP.01 }}.

Assessment method

• Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records

Assessment method

• Personnel with personnel security responsibilities personnel with information security responsibilities

Assessment method

• Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship processes for additional personnel screening