Personnel Security Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for personnel security in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers personnel security and ties it to the access lifecycle. The Organization establishes trust in a person before granting access and re-verifies it on a continuing basis. Each position must carry a risk designation, and the Organization must screen people in proportion to that risk before granting access. When a person separates, the Organization must end their access immediately and record it. For a voluntary separation, access ends the same business day; for an involuntary one, access ends at the same time as the notification. The Organization must review access on transfer, flow personnel security obligations to third-party personnel by contract, and apply sanctions for policy violations.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• GV.RR — Roles, Responsibilities, and Authorities (Govern function)
• PR.AT — Awareness and Training (Protect function)

These categories fall under the Govern, Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every personnel security control in the high baseline of FIPS 200 and NIST SP 800-53B:

• PS-01 — Policy and Procedures
• PS-02 — Position Risk Designation
• PS-03 — Personnel Screening
• PS-03(3) — Information Requiring Special Protective Measures
• PS-04 — Personnel Termination
• PS-04(2) — Automated Actions
• PS-05 — Personnel Transfer
• PS-06 — Access Agreements
• PS-07 — External Personnel Security
• PS-08 — Personnel Sanctions
• PS-09 — Position Descriptions

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PS control family. They add to the NIST SP 800-53 control requirements in the Policy section.

FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors

• The organization must issue a PIV credential only after the FBI fingerprint check is complete and a background investigation has started. (FIPS 201-3, §2)

FAR 52.204-9: Personal Identity Verification of Contractor Personnel

• The organization must require contractors to account for all government-issued identification, including PIV cards, and return it when their employees no longer need it for the contract. (FAR 52.204-9(b))

5 CFR Part 731: Suitability and Fitness (5 CFR Part 731)

• The organization must designate the risk level of every covered position and make suitability determinations under 5 CFR Part 731. (5 CFR § 731.106)

5 CFR Part 1400: Designation of National Security Positions (5 CFR Part 1400)

• The organization must designate the national security sensitivity level of each position whose duties could affect national security, as 5 CFR Part 1400 requires. (5 CFR § 1400.201)

Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters

• The organization must enroll personnel in continuous vetting under Trusted Workforce 2.0 instead of relying only on periodic reinvestigations. (EO 13764; Trusted Workforce 2.0)

3. Policy #

The Organization must implement and maintain its personnel security controls to meet the following requirements:

PS-01 — Policy and Procedures #

Baselines: Low / Moderate / High

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] personnel security policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and
3. Review and update the current personnel security:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level personnel security policy and the procedures that put the PS controls into practice. The policy states its purpose and scope, assigns roles and responsibilities, records management’s commitment, provides for coordination among organizational entities, and sets compliance expectations. The CISO manages the development, documentation, and distribution of both documents and delivers them to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and key stakeholders. The CISO must review both documents every year, and again after a major incident or a major change to applicable policy. For example, a screening failure or a mishandled separation starts a review.

PS-02 — Position Risk Designation #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

1. Assign a risk designation to all organizational positions;
2. Establish screening criteria for individuals filling those positions; and
3. Review and update position risk designations at least annually.

Implementation guidance:

The Organization must assign a risk designation to every position. The designation reflects the harm that misconduct by the person in the position could cause to operations, assets, or national security interests. The personnel security function must designate each position with the Office of Personnel Management (OPM) Position Designation Tool. It uses 5 CFR part 731 for suitability risk and 5 CFR part 1400 for national security sensitivity. The Organization must set screening criteria for each position that match its designation, including explicit requirements for positions with information security roles. Supervisors, with the personnel security function, must review and update position risk designations at least annually and whenever a position changes materially. A position filled against an outdated designation gets the wrong level of screening.

PS-03 — Personnel Screening #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

Requirement:

1. Screen individuals prior to authorizing access to the system; and
2. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening — to be defined].

Implementation guidance:

The personnel security function must screen each individual before the Organization authorizes access to its systems, at the depth the risk designation of the person’s position requires. It must accept a prior favorable investigation that meets the position’s requirements under OPM reciprocity rules, instead of starting a new one. Account managers must not provision an account on the promise that screening will follow later. The personnel security function must enroll covered personnel in continuous vetting, as Executive Order 13764 and the Trusted Workforce 2.0 reforms require. It must rescreen anyone not yet enrolled at least every five years, and sooner when the individual changes position, under the conditions the Organization Security Handbook defines. System Owners and account managers must not grant access before a favorable determination exists. When a screening result changes, the Organization must change the individual’s access without delay.

PS-03(3) — Information Requiring Special Protective Measures #

Baselines: Moderate / High

Requirement:

Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: (a) Have valid access authorizations that are demonstrated by assigned official government duties; and (b) Satisfy personnel screening criteria - as required by specific information.

Implementation guidance:

Some information, including controlled unclassified information, requires more than the standard screening. Before an individual accesses a system that processes, stores, or transmits information that requires special protection, the System Owner must verify two things. The individual must hold a valid access authorization based on assigned official duties, and the individual must meet the additional screening criteria the Organization has set for that information. The obligation follows the information, not the job title. When the individual’s duties change, the System Owner must repeat the verification.

PS-04 — Personnel Termination #

Baselines: Low / Moderate / High

Requirement:

Upon termination of individual employment: a. Disable system access within one (1) hour; b. Terminate or revoke any authenticators and credentials associated with the individual; c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics — to be defined]; d. Retrieve all security-related organizational system-related property; and e. Retain access to organizational information and systems formerly controlled by terminated individual.

Implementation guidance:

When an individual’s employment ends, account managers must disable the individual’s system access within 1 hour. Account managers must also revoke the authenticators and credentials tied to the individual. The supervisor or Contracting Officer’s Representative must collect the individual’s PIV card. The identity team must then revoke the card’s certificates and destroy the card. The Organization must recover the other property it issued, including tokens, building passes, and equipment. Human Resources must notify the insider threat program before an involuntary or adverse separation. The supervisor must hold an exit interview. The interview must cover non-disclosure obligations, succession for the roles the individual held, retention of Organization records, and any limits on future employment. For a termination for cause, the System Owner and the supervisor must coordinate so that access ends at or before the time the individual is notified. The Organization must keep access to the information the individual controlled, so the work continues after the departure.

PS-04(2) — Automated Actions #

Baselines: High

Requirement:

Use [Assignment: organization-defined automated mechanisms — to be defined] to access control personnel responsible for disabling access to the system.

Implementation guidance:

The Organization must use [PS-04(2) parameter 1 — to be defined] to access control personnel responsible for disabling access to the system whenever an individual’s employment or contract ends. Supervisors must enter each termination into these mechanisms as soon as they know the separation date. Notices must reach [PS-04(2) parameter 3 — to be defined] without manual relay, so account managers and System Owners can remove access. The Chief Information Security Officer (CISO) must approve the automated mechanisms and the recipient list. System Owners must report any notification failure to the CISO.

PS-05 — Personnel Transfer #

Baselines: Low / Moderate / High

Requirement:

1. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;
2. Initiate [Assignment: organization-defined transfer or reassignment actions — to be defined] within twenty-four (24) hours;
3. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
4. Notify including access control personnel responsible for the system within twenty-four (24) hours.

Implementation guidance:

When the Organization reassigns or transfers an individual, the gaining and losing supervisors must review the individual’s logical and physical access against the needs of the new position. They must confirm which access remains justified. The losing supervisor must submit an Account Change Request and start any required training updates within 4 hours of the transfer. Account managers must change the access to match the new duties by reducing it, adding to it, or ending it. Within the same 4 hours, the Organization must notify Human Resources, Personnel Security, the IT Help Desk, and every network and system administrator that the change affects. This notice ensures that no one who holds an access record works from the old assignment. The Organization treats access carried forward without a review as unauthorized access.

PS-06 — Access Agreements #

Baselines: Low / Moderate / High / Privacy

Requirement:

1. Develop and document access agreements for organizational systems;
2. Review and update the access agreements at least annually; and
3. Verify that individuals requiring access to organizational information and systems:

1. Sign appropriate access agreements prior to being granted access; and
2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or at least annually and any time there is a change to the user’s level of access.

Implementation guidance:

The Organization must develop and document access agreements for its systems, including non-disclosure agreements, acceptable use agreements, and related commitments. No individual may receive access to organizational information or systems before signing the agreements that apply. The CISO must review and update the agreements at least every year. Individuals must sign the agreements again every year and whenever the agreements change, so that the signature on file always matches the terms in force. When an agreement expires or is missing, the System Owner must suspend the access it supported.

PS-07 — External Personnel Security #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities), PR.AT (Awareness and Training)

Requirement:

1. Establish personnel security requirements, including security roles and responsibilities for external providers;
2. Require external providers to comply with personnel security policies and procedures established by the organization;
3. Document personnel security requirements;
4. Require external providers to notify including access control personnel responsible for the system and/or facilities, as appropriate of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within terminations: immediately; transfers: within twenty-four (24) hours; and
5. Monitor provider compliance with personnel security requirements.

Implementation guidance:

The Organization must set personnel security requirements for external providers, including the security roles and responsibilities their personnel hold. The Contracting Officer (CO) must put those requirements in the governing contracts and agreements and must require providers to follow the Organization’s personnel security policies and procedures. The CO must include Federal Acquisition Regulation (FAR) clause 52.204-9, Personal Identity Verification of Contractor Personnel, in every contract that requires routine access to a federally controlled facility or information system. Under that clause, provider personnel receive PIV credentials under HSPD-12 and Federal Information Processing Standards (FIPS) 201-3, and the provider returns each card when a person leaves the contract. Providers must notify the CO or the Contracting Officer’s Representative (COR) within 4 hours when one of their personnel transfers or leaves. This applies to any provider employee who holds organizational credentials, badges, or system privileges. The COR, with the ISSO, must monitor provider compliance and report a notification failure to the CO as a contract performance issue.

PS-08 — Personnel Sanctions #

Baselines: Low / Moderate / High

Requirement:

1. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and
2. Notify to include the ISSO and/or similar role within the organization within 24 hours when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

Implementation guidance:

The Organization must apply a formal sanctions process to individuals who fail to comply with its information security and privacy policies and procedures. The process runs through the established personnel and legal channels, not case by case. When the Organization starts a formal sanctions process against an employee, the initiating office must notify the individual’s supervisor and the managers of the affected business units within 24 hours. Where a Contracting Officer’s Representative or an employee representative is the appropriate party, the initiating office must notify them in the same window. The notification must name the individual and the reason. Sanctions must be proportionate to the violation and consistent across cases. The initiating office must keep the CISO informed of security-driven sanctions, so that the CISO can review them for the policy or control gaps they expose.

PS-09 — Position Descriptions #

Baselines: Low / Moderate / High

Requirement:

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

Implementation guidance:

The Organization must include security and privacy roles and responsibilities in its position descriptions. Every position description must state the protection duties the position carries, from the baseline obligations all personnel share to the specific duties of ISSOs, System Owners, and other designated roles. Supervisors, with the personnel security function, must update a description when its security or privacy duties are added or changed. The Organization must defer hiring against an outdated description until the description is corrected. The duties written into the description are the basis for role-based training and for accountability when the duties are not performed.

Related Required Processes #

• At separation, the supervisor or the Contracting Officer’s Representative collects the person’s PIV card. The PIV issuer then revokes its certificates and destroys it. The full PIV card life cycle is in the Identification and Authentication procedure.
• Contractor staff who handle Controlled Unclassified Information (CUI) finish the training the contract requires before they get access, and their Organization accounts end with the contract. The steps are in the System and Services Acquisition procedure.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of personnel security controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves personnel security through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Automate the separation workflow so a single HR action triggers verified logical access, physical access, credential, and equipment recovery steps.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• Designation of National Security Positions (5 CFR Part 1400): Designation of National Security Positions, June 5, 2015.
• Executive Order 13467: Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, June 30, 2008.
• Executive Order 13488: Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust, January 16, 2009.
• Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters, January 17, 2017.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• FAR 52.204-9: Personal Identity Verification of Contractor Personnel, January 2011.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors, January 2022.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.
• Suitability and Fitness (5 CFR Part 731): Suitability and Fitness, current text.