PS-1 Policy and procedures
The personnel security policy and procedures control: what the PS policy must address, who owns it, review and update cycles for policy and procedures, and the documents assessors examine.
PS Personnel security
The SP 800-53 Rev. 5 Personnel Security family: position risk designation, screening, termination, transfer, access agreements, external personnel, sanctions and position descriptions, with baselines and assessment procedures.
PS-2 Position risk designation
Assigning a risk designation to every organizational position, setting screening criteria for the people who fill them, and reviewing designations periodically, the foundation for screening under PS-3.
PS-3 Personnel screening
Screening individuals before granting system access and rescreening them under defined conditions and frequencies, with enhancements for classified information, formal indoctrination, special protective measures and citizenship.
PS-4 Personnel termination
Offboarding at termination: disabling system access within a defined time, revoking authenticators and credentials, exit interviews, recovering organizational property and keeping access to information the person controlled.
PS-5 Personnel transfer
Reviewing and adjusting logical and physical access when people are reassigned or transferred: confirming ongoing need, starting transfer actions, modifying authorizations and notifying defined personnel.
PS-6 Access agreements
Access agreements such as nondisclosure, acceptable use and conflict-of-interest agreements: developing and reviewing them, and requiring signature before access and re-signature after updates. It is the only PS control in the privacy baseline.
PS-7 External personnel security
Personnel security for external providers such as contractors and service bureaus: setting and documenting requirements, requiring compliance and notice of staff transfers or terminations, and monitoring compliance.
PS-8 Personnel sanctions
A formal sanctions process for people who fail to comply with security and privacy policies and procedures, and notifying defined personnel when a sanctions process starts.
PS-9 Position descriptions
Writing security and privacy roles and responsibilities into organizational position descriptions so duties and role-based training needs are clear.
