PS-2 Position risk designation: requirements and evidence

What PS-2 position risk designation requires and why assessors start here

When an agency, contract or authorization requires SP 800-53 personnel security, PS-2 is the control assessors ask about first. It requires your organization to assign a risk designation to every organizational position, to set screening criteria for the individuals who fill those positions, and to review and update the designations at a defined frequency. The discussion in the control notes that these designations reflect Office of Personnel Management policy and guidance, so your scheme should be traceable to that source. PS-2 is the foundation for PS-3 personnel screening: the screening depth you apply to a person depends on the designation of the position they hold, so a weak PS-2 result undermines every screening record that follows.

PS-2 applies to the low, moderate and high control baselines in SP 800-53B, but it is not part of the privacy baseline. Its assessment in SP 800-53A Rev. 5 has three determination statements, which assessors test by examining the procedures, the list of designations and the codes of federal regulations you cite, by interviewing the people who run personnel security, and by testing whether the assignment, review and update processes work in practice. Confirm the baseline assignment and the parameter values your system's security plan needs with your authorizing official or the governing contract before you scope the work.

In most organizations the difficulty is not writing the policy. Positions are rarely inventoried in a form that can be assigned a designation, and designations are seldom linked to the systems and access rights the positions use. An assessor who picks a privileged administrator role will ask which designation it carries, what screening that designation requires and whether the person was screened accordingly. Start by listing every position with access to in-scope systems, then map each to a designation, and confirm that the access request and identity records can show that mapping.

Which positions, systems and third parties fall under PS-2

PS-2 looks like a short list of job titles, but the scope decisions made up front determine how many designations you maintain and who must be screened. The cards below cover the decisions that change the work most: which positions count, which systems the designations feed, how contractors are handled, and how the system impact level sets the expected rigor.

Positions with privileged access

Start with every position that can administer systems, change security configurations, approve access or read sensitive data in bulk. Administrators, database owners, security tool operators and cloud account holders usually carry the highest risk designation. Check that the list comes from HR role data and from access reviews, not only from job titles, because roles often accumulate privileges over time. Assign designations to privileged roles first, then work outward to standard users.

Roles with indirect system access

Some positions never log in to a system but still influence it. Developers who can push code to production, help desk staff who reset credentials, and finance staff who approve payment files all fall into this group. PS-2 expects the organization to consider these positions as well. Confirm with the control owner whether each indirect role has a documented designation, and record the reasoning when a role is judged low risk.

Systems the designations feed

Designations matter only where they drive a decision. Map each position to the systems it touches, including identity providers, source code platforms, ticketing tools and backup consoles, not only the primary application. The mapping lets PS-3 screening and PS-6 access agreements use the same designation. Ask the system owner to confirm the mapping during each review cycle, since new integrations quietly add access paths.

Contractors and external personnel

Contractors, managed service staff and consultants often hold the same access as employees without appearing on an HR roster. Under PS-7, the organization must set requirements for external providers and monitor their compliance. Decide whether each external role receives an equivalent designation and screening criteria, and write those requirements into the contract. Keep a current list of external individuals who hold accounts, since that list is what an assessor will sample.

Impact level and expected rigor

SP 800-53B ties PS-2 to the low, moderate and high baselines, so the system's impact level shapes how much detail the designation work needs. A position with access to a high-impact system warrants a more documented rationale, more frequent review and tighter criteria than a comparable role on a low-impact system. Confirm the security categorization for each system first, because that categorization determines which baseline applies and how thoroughly the designations must be justified.

Positions aligned to OPM guidance

The NIST discussion notes that position risk designations reflect Office of Personnel Management policy and guidance. Federal and federal-contractor programs therefore need the designation scheme to map to the categories OPM uses, while private organizations can adopt an equivalent scale that their auditors accept. Confirm with the assessor and the contracting authority which scheme they expect before building the register, so the designations do not need to be rebuilt later.

How an assessor tests PS-2 under SP 800-53A

This table maps the three SP 800-53A determination statements for PS-2 to the examine, interview and test methods an assessor uses, and to the artifacts each method usually requires. Read it as a checklist of what to have ready before an assessment and where designations most often fail.

Assessment element	What the assessor does	Artifacts to have ready	Common finding
Examine: categorization procedures	Reads the documented procedures that address how positions are categorized by risk and how screening criteria are tied to each designation	Position categorization procedure, cited federal regulations or OPM guidance used as the basis, and the version history showing approval	Procedure exists but does not define who assigns designations or what criteria place a position in each level
Examine: list of risk designations	Compares the list of designations against the organization's position inventory and checks that each designation has a documented rationale	Current list of risk designations for organizational positions, mapped to job titles or position codes, with the date of last approval	Designations missing for some positions, especially contractor-held, newly created or recently reorganized roles
Interview: personnel security staff	Asks staff who assign and maintain designations how they decide a level, what triggers a change and how screening criteria are applied	Names and roles of personnel security responsibilities, training records, and examples of recent designation decisions	Staff describe the process differently from the written procedure, or responsibilities are split between HR and system owners with no clear owner
Test: assigning designations	Selects a sample of positions and traces each to its designation and the screening criteria that apply to the person in that role	Samples of position records, screening criteria linked to each designation, and records showing who approved the assignment	Sampled positions carry no designation, or the designation does not match the access the role holds
Test: reviewing designations	Checks whether reviews occurred at the frequency the organization defined and whether reviewers used current position duties	Review schedule, review minutes or sign-off records, and change logs for designations adjusted after review	Reviews not performed at the defined frequency, or reviews that confirm the list without checking position duties
Test: updating designations	Follows a sample of role changes, reorganizations or new positions to confirm designations were updated and screening was adjusted	Change tickets or HR actions, updated designation records, and evidence that affected screening under PS-3 was reconsidered	Role changes processed by HR without a corresponding designation update, leaving outdated screening levels in place

Implementing PS-2 position risk designation step by step

This sequence turns PS-2 from a policy statement into a working designation program: every position gets a risk level, each level gets screening criteria, and the designations drive PS-3 screening and access requests. Each step names the record it produces so an assessor can trace a position from the org chart to its screening decision.

Build the inventory of organizational positions
Start by listing every organizational position in scope, including employees, contractors and roles that only exist in a system, such as administrators and privileged service operators. Pull the list from HR records, the identity provider and the system access registers, then reconcile the three so that no position is missing or duplicated. The output is a position register with a unique identifier, title, owning unit and the systems each position touches. You know this step is done when the register matches the current organization chart and the access reviews agree with it.
Assign a risk designation to each position
For each position, the responsible security or HR owner assigns a risk designation based on the potential for harm the role could cause to systems and information. Base the categorization on the organization's own system categorization and on the Office of Personnel Management policy and guidance that the NIST discussion notes reference, and record the rationale for each assignment. Positions with privileged access, access to sensitive data or authority over security functions usually need closer review. The output is a designation matrix that lists each position, its designation and the reasoning behind it. Confirm with your HR and legal teams which designation scheme applies to your jurisdiction and sector.
Define screening criteria for each designation
Set the screening criteria that individuals must meet for each designation level, such as the type of background check, the depth of verification and any citizenship, clearance or sanctions checks the role requires. Keep these criteria specific enough that an HR reviewer can apply them without making judgments that vary from case to case. Have legal counsel confirm that the criteria comply with local employment and data protection law. The output is a screening criteria table tied to each designation. The step is complete when every designation level has criteria, and each criterion names the screening activity that satisfies it.
Document the review frequency and trigger conditions
Define how often designations are reviewed and which events force an early review, such as a reorganization, a change in a position's system privileges, a new regulatory requirement or a security incident involving the role. PS-2 requires the designations to be reviewed and updated at a defined frequency, so the organization must choose the interval and record it in its policy. Confirm the interval against your own governing policy and any framework or contract that applies to you. The output is a short review procedure that names the owner, the cadence and the triggers.
Connect designations to PS-3 screening and access requests
Wire the designation into the processes that act on it. When a hire, transfer or access request names a position, the designation should determine which screening under PS-3 must be completed before access is granted, and the access workflow should refuse provisioning until that screening is recorded. Many organizations do this by carrying the designation as an attribute in the identity directory or ticketing system, so it is visible at the point of access. The output is a documented mapping from each designation to its screening steps and to the access approvals that depend on them.
Run and record the first designation review
Conduct the first full review of the matrix against the current organization chart, the screening criteria and the review procedure. Check that every position has a designation, that the rationale still holds and that screening records exist for the people in designated positions, and correct any gaps. Record who reviewed each position, the date, any changes made and the approval for those changes. The output is a signed review record that an assessor can examine. Keep the register, matrix and review record under version control so that later changes leave a visible history.

How PS-2 designations drive PS-3 screening and access decisions

The core point is that a PS-2 designation is not a free-standing document. It sets the screening criteria that PS-3 applies before an individual is granted access, so the organization must be able to trace a line from each position, to its risk designation, to the screening required for that designation, to the screening record for the person, and finally to the account and authorizations that person holds. An assessor will walk that chain in the direction of an account, starting from a sample of active users and asking which position each one fills, what designation the position carries and what screening was completed before access was granted.

Designations change for several reasons, and each should trigger a documented review. A change in job duties, a reassignment to a different position, a change in the security categorization of a system the position supports, or a revised position description can all move a position to a higher or lower designation. Confirm that your identity governance or HR system records a position identifier on every account, that a change to a position description creates a review task for the designation owner, and that a change in system categorization under the risk assessment process notifies personnel security. Confirm also the review frequency your organization has defined for designations, since the control requires periodic review and update.

Assessors look for this chain because a policy that lists risk levels says what the organization intends, while the linked records show what it did. The SP 800-53A procedures for PS-2 examine the designation list and the procedures for assigning and updating designations, and they interview the people responsible for personnel security. A practical test is to pick a position recently reclassified and show the updated designation, the screening that followed and the account changes that matched it. Gaps usually appear where the position identifier is missing from the account record, so that link deserves a check before any audit.

Evidence that passes a PS-2 assessment

An assessor testing PS-2 looks for a current, reviewed set of position risk designations and proof that the organization applies them. The cards below cover each artifact an examiner will ask for, along with how to keep it accurate between assessments so it does not need rebuilding before each one.

Position risk designation list

This is the core artifact: a list of every organizational position with its assigned risk designation. An assessor will compare it against the position inventory from HR and the access roles in your systems. Check that no position is missing, that contractor-filled roles are covered where they are organizational positions, and that each entry records who approved the designation and when. Keep the list under change control so every entry has a traceable history.

Categorization procedure

Assessors examine the documented procedure that explains how a position receives its designation. It should state the criteria used, the reference to Office of Personnel Management policy and guidance that the NIST discussion notes, and the roles responsible for applying them. A procedure that reads as generic will not show how a designation was reached. Include worked examples for a few representative positions so the reasoning is visible.

Screening criteria mapped to designations

PS-2 requires screening criteria for the people who fill each position, so the designation list must connect to a matrix of criteria. For each designation level, document the screening expected before access is granted. Assessors will pick a sample of positions and ask how the criteria were applied. Review the matrix whenever designations change, because a mismatch between a designation and its screening requirement is a common finding.

Review schedule and review records

PS-2 requires periodic review and update of designations, and the organization sets the frequency. Record the defined interval, the dates of past reviews, the participants and the outcome of each review, including reviews where no change was made. Assessors test whether reviews happen on schedule, so a calendar entry tied to the position inventory is more useful than an annual note in a policy document. Confirm the interval with your own policy owner, since it is set by the organization.

Change records for designation updates

When a position is reclassified because its duties, data access or system authority changed, the change must be recorded. Keep the prior designation, the new designation, the reason, the approver and the effective date. These records show that designations respond to real changes rather than only to the calendar. Tie each change to the request that triggered it, such as a role redesign or a new system onboarding, so the chain of evidence is complete.

Link to PS-3 screening records

PS-2 is the foundation for PS-3, so an assessor will follow a position to the individuals who hold it and then to their screening records. Maintain a cross-reference from each position and designation to the screening completed for its incumbents, with dates and any rescreening triggered by a designation change. Where screening is performed by a separate HR or vendor system, confirm that you can produce the link on request without manual reconstruction. Gaps here tend to surface during sampling.

What meeting PS-2 costs in money and effort

This table breaks down the cost and effort of meeting PS-2 by component, showing who is paid, whether each cost is one-time or recurring, and what drives it up or down. No price or duration figures are supplied for PS-2, so use the drivers and quote questions to compare proposals. The main takeaway is that most effort sits in building an accurate position inventory and keeping it current.

Cost component	Who carries the effort or fee	One-time or recurring	What drives it
Position inventory and classification	HR and security staff, sometimes with system owners	One-time build, then recurring upkeep	Number of positions, job family variety, and how well current role data is kept
Setting screening criteria per risk designation	HR, security leadership and legal counsel	One-time, revisited when criteria change	Number of distinct designation levels and the regulations or contracts that govern them
Legal or HR review of criteria	Employment counsel or HR advisers	One-time, then at each criteria revision	Jurisdiction, labor agreements and whether criteria touch background screening rules
Inventory tooling	Existing HRIS or identity directory, or a new system	Licensing recurs; setup is one-time	Whether an HRIS or directory already holds position data and reporting fields
Periodic review of designations	HR and security staff, managers who confirm positions	Recurring at the defined review frequency	Frequency set in your policy and the number of positions under review
Updates after reorganization or role change	HR operations and system owners	Recurring, event-driven	Reorganization frequency, mergers, and the number of systems that inherit designations
External review, if used	Independent consultant or implementation partner	One-time or per review cycle, by written scope	Scope agreed in writing, number of business units and documentation quality
Assessor sampling time	Internal staff supporting the assessor, plus the assessor	Recurring at each assessment cycle	Sample size chosen, quality of records and how quickly staff can produce them

Who owns PS-2 and what an outside partner can prepare

The organization owns PS-2 in full. Its leadership decides which positions exist, how each one is categorized for risk, which screening criteria apply to the people who fill them, and how often designations are reviewed. The NIST discussion for PS-2 ties these designations to Office of Personnel Management policy and guidance, so the organization must also decide which external policy it follows and document that choice. Human resources, the security office and the business owners of each function typically share this work, but one accountable role should approve the final list.

Position inventory: Maintain the authoritative list of organizational positions, including those held by contractors where the organization relies on them.
Designation decisions: Assign a risk designation to each position and record the rationale, approver and date.
Screening criteria: Define what screening each designation requires before PS-3 is applied.
Review cycle: Set a review frequency and a trigger for early review, such as a reorganization or a change in system access.
Approval record: Keep signed or system-recorded approvals that an assessor can examine.

Before engaging anyone, confirm that a named owner can approve designations and that the review frequency is written into the personnel security procedures.

Where PS-2 programs usually fall short

PS-2 looks simple on paper: designate every position, set screening criteria, and review the designations. In practice, the gaps tend to sit between the designation list and the systems, people and records it is supposed to govern. The cards below cover where those links most often break and the check that catches each one.

Positions missing from the inventory

Designations often cover the org chart's standard roles but skip newly created positions, shared service roles, and roles that exist only in a system, such as privileged service desk or database administrator positions. Compare the designation list against HR's position records and against the accounts that hold privileged access. Any account whose holder has no designated position is a gap to close before PS-3 screening can be applied to it.

Designations not tied to access or screening

A risk designation only reduces risk when it changes something: the screening level under PS-3, the access granted, and the approval path for exceptions. Where designations sit in a spreadsheet that no provisioning workflow reads, a high-risk position can receive the same access as a low-risk one. Ask the owner to show one high-designation position and trace it through screening, access approval and the account record.

No defined review frequency

PS-2 requires designations to be reviewed and updated at a frequency the organization defines. Many programs never set that frequency, so reviews happen only when someone remembers. Set a documented interval, assign an owner, and make the review date visible on the designation record. An assessor will ask for the defined frequency first, so an undefined one fails the check before any review is examined.

Contractors left out of designations

Contractors, consultants and service provider staff often hold privileged access without a designated position in the organization's own records. PS-2 covers positions in the organization, and PS-7 sets the requirements that external personnel must meet. Confirm that each contracted role that reaches sensitive systems has a designation, or that the contract maps the external role to an organizational designation and the screening that goes with it.

Designations not updated after reorganization

Mergers, team restructures and changed system boundaries move duties without changing position titles. A role that was low risk when it was designated may now administer production data. Tie designation review to triggers such as reorganizations, new systems and role changes, not only to the calendar. Check the change log of the HR and identity systems for restructures in the last review period and confirm that the affected positions were re-designated.

No records of review

Assessors test PS-2 by examining the designation list, the criteria used to set it, and evidence that reviews happened. A list with a last-updated date but no record of who reviewed it, what changed and why does not show a review took place. Keep dated review records with reviewer names, decisions and changed designations, and retain them for the period the organization's own policy sets. Confirm the retention period with your auditor before the first assessment.

PS-2 questions buyers ask before bringing in help

How much effort does PS-2 take to implement?

The effort depends mostly on how many positions the organization has and how many of them already have a documented risk designation. PS-2 asks for a designation for every organizational position, criteria for screening the people who fill them, and a defined review cycle. A small organization with a short list of roles can finish the first pass quickly, while a large enterprise with many job families, contractors and system-specific roles will spend far more time on the mapping. The work is mostly analysis and documentation, not technology. Ask any partner to break its estimate into position inventory, designation workshops, criteria drafting, approval and first review, so you can see where the hours go. No effort figure is supplied for this control, so confirm the estimate against your own position count.

Can we do PS-2 in-house without outside help?

Yes. PS-2 is a policy and process control, and the organization owns it, so internal HR and security teams can complete it without an outside party. Outside help is most useful when the position inventory is incomplete, when HR records do not match the systems people actually access, or when the team lacks someone who can tie designations to Office of Personnel Management guidance. If you bring in a partner, it can prepare the inventory, draft the designation criteria and organize evidence for assessment. It cannot assign designations on your behalf or certify the result. An independent assessor tests whether the process works.

What does PS-2 need from HR and security staff?

PS-2 splits work between two groups that often operate separately. HR usually holds the position descriptions, job families and classification records. Security typically owns the system access model and the screening criteria that connect to it. Both need to agree on the risk designation levels and the criteria for each. The practical needs are:

HR access to the full list of organizational positions and current position descriptions
Security input on which positions reach sensitive systems or data
A named owner who approves designations and sets the review frequency
Interviews with the people responsible for personnel security, which assessors use to test the process

Define these roles before the work starts, because the assessment method for PS-2 includes interviews with those staff members.

How long does PS-2 take to complete?

No duration is supplied for PS-2, so no timeline can be stated here. The time depends on the size of the position inventory, how many people must review the designations, whether the organization already has a designation scheme, and how often the assessor will test the process. Ask for a schedule with milestones in any proposal, and confirm the expected timing with your assessor or with your internal plan before committing to a date. Also ask whether the schedule assumes the review cycle has already run once, since assessors often look for evidence that designations were reviewed and updated, not only created.

Can a partner own our position risk designations?

No. The organization owns its controls, and the risk designation for each position is a decision the organization makes. An implementation partner can prepare the position inventory, draft the designation criteria, document the review process and gather evidence. The designations must be approved by your accountable personnel, who should be able to explain why each position received its level. An independent assessor or auditor then tests the process. A partner that offers to assign designations and sign them off as compliant is not describing the arrangement that PS-2 requires.

How does PS-2 differ from PS-3 and PS-1?

PS-2 decides how sensitive each position is. PS-3 then screens the individuals who fill those positions before they get system access, using the criteria PS-2 set. PS-1 is the policy and procedures control that governs both, requiring a documented personnel security policy and procedures and a review cycle for them. In practice, you write the PS-1 policy first, define the PS-2 designations and criteria under it, and then apply the PS-3 screening to people in each designated position. Assessors test the three controls as a chain, so gaps in PS-2 usually show up as gaps in PS-3 screening.

What evidence will an assessor ask to see for PS-2?

Under the SP 800-53A procedure for PS-2, an assessor examines the procedures addressing position categorization, the list of risk designations for organizational positions, and any cited codes of federal regulations. The assessor interviews personnel with personnel security responsibilities and tests the processes for assigning, reviewing and updating designations. Practical evidence includes the position inventory with designations, the written criteria, approval records, the review schedule and records showing that reviews happened. Confirm with your assessor which federal codes and Office of Personnel Management references apply to your organization, because the designation scheme must reflect them.

Which PS-2 work can a partner support and which must stay internal?

A partner can support the inventory, the criteria drafting, the documentation and the evidence packaging. These tasks follow a fixed scope agreed in writing before work starts. The organization must keep the decisions: which positions carry which designation, who approves them, and how often they are reviewed. Ongoing reviews can be covered by a retainer if you want outside support between assessments, but the designations themselves remain your responsibility. Ask any provider to state in its scope document which deliverables it prepares and which decisions remain with your staff.

How DeployOpen prepares PS-2 evidence

DeployOpen works inside the client's own environment to prepare the systems, configurations and records that show PS-2 operating. In practice that means building the position inventory structure, deciding how each position record carries its risk designation and screening criteria, and linking those records to the identity systems that create and disable accounts. Where the organization's HR platform, directory service or identity provider is the source of truth, the work covers how position attributes flow into those systems and what an assessor can pull from them to trace a designation to a person with access. Scope is agreed in a written, fixed-scope agreement before work starts, so the client knows which systems, roles and evidence items are covered and what is excluded. Confirm early which system holds the authoritative list of positions, because that choice determines most of the integration effort.

The boundaries matter as much as the deliverables. DeployOpen does not issue audit reports, attestations or certifications, and it does not decide the risk designation for any position. The organization owns its designations, the screening criteria attached to them and the review frequency it defines, and it must approve them through its own governance. An independent assessor, using the examine, interview and test methods described in SP 800-53A, determines whether the designations and their review process meet the requirement. Ask any implementation partner to state in writing which artifacts it will produce, which decisions remain with your personnel security and HR owners, and who signs off the final evidence package before it goes to an assessor.

PS-2 Position risk designation