03.09 Personnel Security

Statement

• a. Screen individuals prior to authorizing access to the system.

• b. Rescreen individuals in accordance with {{ insert: param, A.03.09.01.ODP.01 }}.

Guidance

Personnel security screening activities involve the assessment of the conduct, integrity, judgment, loyalty, reliability, and stability of an individual (i.e., the individual’s trustworthiness) prior to authorizing access to the system or when elevating system access. The screening and rescreening activities reflect applicable federal laws, Executive Orders, directives, policies, regulations, and criteria established for the level of access required for the assigned position.

Assessment objective

individuals are screened prior to authorizing access to the system.

Assessment objective

individuals are rescreened in accordance with the following conditions: {{ insert: param, A.03.09.01.ODP.01 }}.

Assessment method

• personnel security policy and procedures procedures for personnel screening and rescreening records of screened personnel system security plan other relevant documents or records

Assessment method

• personnel with personnel security responsibilities personnel with information security responsibilities

Assessment method

• processes for personnel screening and rescreening

Statement

• a. When individual employment is terminated:

  • 01. Disable system access within {{ insert: param, A.03.09.02.ODP.01 }},

  • 02. Terminate or revoke authenticators and credentials associated with the individual, and

  • 03. Retrieve security-related system property.

• b. When individuals are reassigned or transferred to other positions in the organization:

  • 01. Review and confirm the ongoing operational need for current logical and physical access authorizations to the system and facility, and

  • 02. Modify access authorization to correspond with any changes in operational need.

Guidance

Security-related system property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that accountability is achieved for the organizational property. Security topics at exit interviews include reminding individuals of potential limitations on future employment and non-disclosure agreements. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment. The timely execution of termination actions is essential for individuals who have been terminated for cause. Organizations may consider disabling the accounts of individuals who are being terminated prior to the individuals being notified. This requirement applies to the reassignment or transfer of individuals when the personnel action is permanent or of such extended duration as to require protection. Protections that may be required for transfers or reassignments to other positions within organizations include returning old and issuing new identification cards, keys, and building passes; changing system access authorizations (i.e., privileges); closing system accounts and establishing new accounts; and providing access to official records to which individuals had access at previous work locations in previous system accounts.

Assessment objective

upon termination of individual employment, system access is disabled within {{ insert: param, A.03.09.02.ODP.01 }}.

Assessment objective

upon termination of individual employment, authenticators associated with the individual are terminated or revoked.

Assessment objective

upon termination of individual employment, credentials associated with the individual are terminated or revoked.

Assessment objective

upon termination of individual employment, security-related system property is retrieved.

Assessment objective

upon individual reassignment or transfer to other positions in the organization, access authorization is modified to correspond with any changes in operational need.

Assessment objective

upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.

Assessment objective

upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is confirmed.

Assessment method

• personnel security policy and procedures procedures for personnel termination records of personnel transfer actions procedures for personnel transfer list of system and facility access authorizations records of personnel termination actions records of terminated or revoked authenticators or credentials list of system accounts records of exit interviews system security plan other relevant documents or records

Assessment method

• personnel with personnel security responsibilities personnel with account management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for personnel termination processes for personnel transfer mechanisms for supporting or implementing personnel transfer notifications mechanisms for supporting or implementing personnel termination notifications mechanisms for disabling system access and revoking authenticators