Personnel Security Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the PS control family policy (POL-PS). It covers every control in the personnel security family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the PS family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the low security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• GV.RR — Roles, Responsibilities, and Authorities (Govern function)
• PR.AT — Awareness and Training (Protect function)

3. Controls Covered #

This procedure covers the following 9 controls in the PS family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the PS control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors

• The organization must issue a PIV credential only after the FBI fingerprint check is complete and a background investigation has started. (FIPS 201-3, §2)

FAR 52.204-9: Personal Identity Verification of Contractor Personnel

• The organization must require contractors to account for all government-issued identification, including PIV cards, and return it when their employees no longer need it for the contract. (FAR 52.204-9(b))

5 CFR Part 731: Suitability and Fitness (5 CFR Part 731)

• The organization must designate the risk level of every covered position and make suitability determinations under 5 CFR Part 731. (5 CFR § 731.106)

5 CFR Part 1400: Designation of National Security Positions (5 CFR Part 1400)

• The organization must designate the national security sensitivity level of each position whose duties could affect national security, as 5 CFR Part 1400 requires. (5 CFR § 1400.201)

Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters

• The organization must enroll personnel in continuous vetting under Trusted Workforce 2.0 instead of relying only on periodic reinvestigations. (EO 13764; Trusted Workforce 2.0)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the PS controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Personnel Security family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Human Resources / Personnel Security Officer carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the PS policy (POL-PS) for the role definitions.

4.2 Control-Specific Procedures #

PS-01 — Policy and Procedures #

Baselines: Low / Moderate / High

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] personnel security policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and
3. Review and update the current personnel security:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The CISO’s office keeps POL-PS and PROC-PS under version control. The CISO’s office starts a review every 3 years, and immediately after a major incident or a major change to applicable policy. In either case, the CISO’s office opens the review in the policy library in the document management system. The CISO’s office collects input from the roles that operate the family: System Owners and Information System Security Officers (ISSOs) on the access consequences, and the personnel security function on screening and separation practice.

The CISO approves the revision. The CISO’s office sends the approved documents to the Authorizing Official, System Owners, ISSOs, and key stakeholders and records the distribution in the review record. The CISO’s office archives each superseded version with its effective dates.

Evidence: the version histories of both documents, the review records showing what triggered each cycle and who contributed, the approval records, and the distribution log for each release.

PS-02 — Position Risk Designation #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

1. Assign a risk designation to all organizational positions;
2. Establish screening criteria for individuals filling those positions; and
3. Review and update position risk designations at least every three years.

Procedure:

When the Organization creates a position, the hiring supervisor and the personnel security function designate it using the Office of Personnel Management (OPM) Position Designation Tool. They evaluate the duties and responsibilities for the damage that misconduct could cause and for national security sensitivity, under 5 CFR parts 731 and 1400. They record the resulting risk and sensitivity levels with the position description. The designation sets the screening criteria and the investigation level for anyone who fills the position, including the added requirements for information security roles.

The supervisor and the personnel security function review each designation at least every 3 years, and immediately when the position’s duties change, for example after a reorganization, a new system access, or added privileges. The review either reaffirms the designation or updates it. An updated designation triggers a check that the incumbent’s screening still meets the new level. Any gap becomes a ticketing system ticket tracked to resolution.

Evidence: the recorded designations with their Position Designation Tool results and assessment dates, the 3-year and change-driven review records, and the tickets that resolved screening gaps the reviews found.

PS-03 — Personnel Screening #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities)

1. Screen individuals prior to authorizing access to the system; and
2. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening — to be defined].

Procedure:

Screening is a step in onboarding that every new individual completes before access. The personnel security function first checks for a prior favorable investigation that meets the position’s requirements and accepts it under OPM reciprocity rules. Otherwise, it starts the background investigation that the position’s risk designation requires. It records the favorable determination before any access request for the individual proceeds. Account provisioning checks for that determination and stops without it.

The personnel security function enrolls covered personnel in continuous vetting and acts on the alerts it receives. For anyone not yet enrolled, it rescreens at least every five years and starts each rescreening before the current one expires. A change of position restarts the evaluation against the new position’s requirements, under the conditions in the Organization Security Handbook.

When screening raises an issue, such as an unfavorable determination, a continuous vetting alert, or a lapsed investigation, the personnel security function notifies the ISSO and the System Owner. Account managers suspend or remove the individual’s access while the matter is resolved and record the action in the ticketing system.

Evidence: the screening determinations tied to individuals and positions, reciprocity decisions, continuous vetting enrollment records, the rescreening schedule with its completion records, and the access-action tickets for adverse or lapsed results.

PS-04 — Personnel Termination #

Baselines: Low / Moderate / High

Upon termination of individual employment: a. Disable system access within four (4) hours; b. Terminate or revoke any authenticators and credentials associated with the individual; c. Conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics — to be defined]; d. Retrieve all security-related organizational system-related property; and e. Retain access to organizational information and systems formerly controlled by terminated individual.

Procedure:

The human resources (HR) separation action starts the 4-hour clock. Within 4 hours of the termination, account managers disable the individual’s accounts and revoke the individual’s credentials and authenticators. The leaver workflow in the ticketing system drives the disablement tasks and records their timestamps. For a termination for cause, the supervisor coordinates with the System Owner so that disablement happens at or before the moment the individual learns of the action. Before an involuntary or adverse separation, Human Resources notifies the insider threat program. The service desk also sends the program a monthly list of all separations.

The supervisor holds the exit interview and files the completed record. At out-processing, the supervisor collects the PIV card, and the identity team revokes its certificates, destroys the card, and records both actions in the ticketing system. The Organization recovers the other property it issued and receipts each item against the issue record. When an exit interview cannot happen, for example after job abandonment, the supervisor documents the exception.

Access to the information the individual held transfers to the supervisor before the accounts close.

Evidence: the timestamped disablement records, insider threat program notices and monthly separation lists, PIV collection and revocation records, the exit interview forms, the property return receipts, and the completed out-processing checklist.

PS-05 — Personnel Transfer #

Baselines: Low / Moderate / High

1. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;
2. Initiate [Assignment: organization-defined transfer or reassignment actions — to be defined] within twenty-four (24) hours;
3. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
4. Notify [Assignment: organization-defined personnel or roles — to be defined] within twenty-four (24) hours.

Procedure:

The transfer action in the personnel system opens the mover workflow. Within 4 hours of the transfer action, the losing supervisor submits the Account Change Request in the ticketing system and lists the access the old position required. In the same request, the gaining supervisor states what the new position needs. Training updates the new role requires start in the same window. Account managers make the changes: they remove the entitlements the new duties do not justify and add the ones the duties require. Physical access changes go through the same request.

The workflow sends the notification to Human Resources, Personnel Security, the IT Help Desk, and the affected network and system administrators within the 4-hour window, and it records each notification on the request. During access reviews, the ISSO samples completed transfers to confirm that the removals took effect.

Evidence: the Account Change Requests with their initiation dates, the executed access changes, the training update records, the notification log, and the review samples that confirm access matched the new position.

PS-06 — Access Agreements #

Baselines: Low / Moderate / High / Privacy

1. Develop and document access agreements for organizational systems;
2. Review and update the access agreements at least annually; and
3. Verify that individuals requiring access to organizational information and systems:

1. Sign appropriate access agreements prior to being granted access; and
2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or at least annually and any time there is a change to the user’s level of access.

Procedure:

The system’s records include the agreement set for that system. The access process includes signing: the access request captures the individual’s signed or electronically acknowledged agreements before approval, and provisioning does not proceed without them.

Every year, the CISO reviews the agreement texts, updates them for changed obligations, and publishes the current versions. Publication starts the re-signing cycle. Every individual who holds access signs the current version again, every year even when nothing changed. The ISSO tracks completion in the Agency Learning Management System (LMS) and follows up with individuals who have not signed. The System Owner suspends the access of any individual who does not sign until the signature is on file.

Each signature record ties the individual, the agreement version, and the date together, so an assessor can pick any user and see the terms that user works under. Evidence: the versioned agreements, the signature and re-signature records, the tracking for each yearly cycle, and the suspension actions for lapsed signatures.

PS-07 — External Personnel Security #

Baselines: Low / Moderate / High CSF 2.0: GV.RR (Roles, Responsibilities, and Authorities), PR.AT (Awareness and Training)

1. Establish personnel security requirements, including security roles and responsibilities for external providers;
2. Require external providers to comply with personnel security policies and procedures established by the organization;
3. Document personnel security requirements;
4. Require external providers to notify including access control personnel responsible for the system and/or facilities, as appropriate of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within twenty-four (24) hours; and
5. Monitor provider compliance with personnel security requirements.

Procedure:

Personnel security requirements enter through acquisition. The Contracting Officer (CO) makes sure that the contract carries the screening, conduct, and notification obligations. The Contracting Officer’s Representative (COR) documents the provider’s security roles and responsibilities before performance starts. When the contract requires routine access to a federally controlled facility or information system, the CO includes Federal Acquisition Regulation (FAR) clause 52.204-9. Provider personnel then receive PIV credentials under HSPD-12 and Federal Information Processing Standards (FIPS) 201-3 before they get routine access.

During performance, the provider reports personnel changes. The provider must notify the CO or COR within 4 hours of each transfer or termination of anyone who holds organizational credentials, badges, or system privileges. The notification triggers the same access actions as an internal departure. The identity team disables the accounts, recovers the PIV card and badges, and ends the privileges through the ticketing system, linking each action to the notification.

The COR, with the ISSO, monitors compliance. They check the timeliness of each notification against the access records and reconcile the provider’s personnel lists against active credentials and accounts. They document late or missed notifications. The COR reports each one to the CO, who handles it with the provider as a contract performance issue.

Evidence: the contract language, including FAR clause 52.204-9, the provider notifications with their receipt dates, the access-termination tickets they triggered, the reconciliation records, and the compliance correspondence for failures.

PS-08 — Personnel Sanctions #

Baselines: Low / Moderate / High

1. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and
2. Notify at a minimum, the ISSO and/or similar role within the organization within [Assignment: organization-defined time period — to be defined] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

Procedure:

Anyone who suspects a policy violation reports it to the ISSO and the individual’s supervisor. The ISSO and the supervisor establish the facts before the process begins: which rule, what conduct, and what evidence. When the Organization starts a formal sanctions process, the initiating office sends the notification within [PS-08 parameter 2 — to be defined] to the supervisor and to the managers of the business units concerned. When the individual’s status makes the Contracting Officer’s Representative or an employee representative the right recipient, the initiating office notifies them in the same window. The notification names the individual and the reason.

The sanction follows the personnel process for employees or the contract channel for contractor personnel. The Organization applies any interim security measures, such as suspended access or revoked privileges, through the ticketing system while the process runs. The initiating office records the outcome, and the CISO reviews each security-driven case for the policy or control gaps it exposes.

Evidence: the violation reports, the dated initiation notifications, the interim access-action tickets, and the recorded outcomes with the CISO’s review of security-relevant cases.

PS-09 — Position Descriptions #

Baselines: Low / Moderate / High

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

Procedure:

When the Organization establishes or revises a position, the supervisor writes the security and privacy responsibilities into the position description. These include the obligations every employee carries and any designated duties, such as ISSO service, System Owner accountability, or privacy responsibilities. The personnel security function reviews the draft for consistency with the position’s risk designation before the supervisor finalizes it.

Events, not the calendar, drive changes. A new system assignment, a reorganization, or a designation change prompts the supervisor to update the description, and the supervisor records the update in the position file. The duties in the description determine the role-based training assigned to the incumbent, so training follows the written role.

During personnel security reviews, the personnel security function samples the descriptions for positions with designated security roles against the duties actually performed and corrects any mismatch through a ticketing system ticket. Evidence: the position descriptions with their security and privacy duties, the recorded updates with their triggers, and the sampling records with corrections.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for PS
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric ST.01
• Evidence for IG FISMA metric ST.25

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• Designation of National Security Positions (5 CFR Part 1400): Designation of National Security Positions, June 5, 2015.
• Executive Order 13467: Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, June 30, 2008.
• Executive Order 13488: Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust, January 16, 2009.
• Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters, January 17, 2017.
• FAR 52.204-9: Personal Identity Verification of Contractor Personnel, January 2011.
• FIPS 201-3: Personal Identity Verification (PIV) of Federal Employees and Contractors, January 2022.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• Suitability and Fitness (5 CFR Part 731): Suitability and Fitness, current text.