PS-3 Personnel Screening

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	4 (0 in a baseline)

Related controls: AC-2, IA-4, MA-5, PE-2, PM-12, PS-2, PS-6, PS-7, SA-21

Control statement

• a. Screen individuals prior to authorizing access to the system; and
• b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].

NIST discussion

Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.

Control enhancements

PS-3(1) Classified Information

Baselines: Not in a baseline

Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.

Discussion and assessment objectives for PS-3(1)

Classified information is the most sensitive information that the Federal Government processes, stores, or transmits. It is imperative that individuals have the requisite security clearances and system access authorizations prior to gaining access to such information. Access authorizations are enforced by system access controls (see AC-3 ) and flow controls (see AC-4).

Determine if:

• PS-03(01)[01] individuals accessing a system processing, storing, or transmitting classified information are cleared;
• PS-03(01)[02] individuals accessing a system processing, storing, or transmitting classified information are indoctrinated to the highest classification level of the information to which they have access on the system.

Examine: Personnel security policy; procedures addressing personnel screening; records of screened personnel; system security plan; other relevant documents or records.

Interview: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for clearing and indoctrinating personnel for access to classified information.

PS-3(2) Formal Indoctrination

Baselines: Not in a baseline

Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.

Discussion and assessment objectives for PS-3(2)

Types of classified information that require formal indoctrination include Special Access Program (SAP), Restricted Data (RD), and Sensitive Compartmented Information (SCI).

Determine if individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination are formally indoctrinated for all of the relevant types of information to which they have access on the system.

Examine: Personnel security policy; procedures addressing personnel screening; indoctrination documents; records of screened personnel; system security plan; other relevant documents or records.

Interview: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for formal indoctrination for all relevant types of information to which personnel have access.

PS-3(3) Information Requiring Special Protective Measures

Baselines: Not in a baseline

Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:

• (a) Have valid access authorizations that are demonstrated by assigned official government duties; and
• (b) Satisfy [Assignment: organization-defined additional personnel screening criteria].

Discussion and assessment objectives for PS-3(3)

Organizational information that requires special protection includes controlled unclassified information. Personnel security criteria include position sensitivity background screening requirements.

Determine if:

• PS-03(03)(a) individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;
• PS-03(03)(b) individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [Assignment: organization-defined additional personnel screening criteria].

Examine: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizations; system security plan; other relevant documents or records.

Interview: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for ensuring valid access authorizations for information requiring special protection; organizational process for additional personnel screening for information requiring special protection.

PS-3(4) Citizenship Requirements

Baselines: Not in a baseline

Verify that individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].

Discussion and assessment objectives for PS-3(4)

None.

Determine if individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].

Examine: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizations; system security plan; other relevant documents or records.

Interview: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for ensuring valid access authorizations for information requiring citizenship; organizational process for additional personnel screening for information requiring citizenship.

Assessment objectives (SP 800-53A)

Objectives and methods for PS-3

Determine if:

• PS-03a. individuals are screened prior to authorizing access to the system;
• PS-03b.
  • PS-03b.[01] individuals are rescreened in accordance with [Assignment: organization-defined conditions requiring rescreening];
  • PS-03b.[02] where rescreening is so indicated, individuals are rescreened [Assignment: organization-defined frequency].

Examine: Personnel security policy; procedures addressing personnel screening; records of screened personnel; system security plan; other relevant documents or records.

Interview: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities.

Test: Organizational processes for personnel screening.

Policy statement

• The Human resources office shall screen each individual, according to the screening criteria for their position, before the individual is authorized to access a system. (PS-3a)
• The Human resources office shall rescreen individuals when Fill in: conditions requiring rescreening of individuals Typical: the individual moves to a position with a higher risk designation, or information comes to light that raises a concern about their suitability, and, where the screening criteria call for periodic rescreening, Fill in: the frequency of rescreening individuals where it is so indicated Typical: every 5 years for positions designated high risk. (PS-3b)

Federal systems

5 CFR 731.106 (as amended June 30, 2026) requires a background investigation for each individual entering a covered position, initiated before appointment where possible (731.106(c)(1)), and bars criminal or credit history inquiries before a conditional offer of employment, with limited exceptions (731.106(g)). Rescreening is now continuous vetting: “Continuous vetting for an individual in a public trust position satisfies the requirement for a periodic reinvestigation” (731.106(d)(1)), and an upgraded investigation for a move to a higher risk level “should be initiated within 14 days” (731.106(e)). FIPS 201-3 (January 2022), section 2.2, requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation. Checked September 2026.

• The Human resources office shall initiate the background investigation the position’s risk level requires before the individual is appointed, or as soon as possible where it was not initiated in time. (PS-3a)
• The Human resources office shall not ask an applicant about criminal or credit history before a conditional offer of employment, except as 5 CFR 731.106(g) allows. (PS-3a)
• The Human resources office shall ensure the FBI National Criminal History Check is completed and favorably adjudicated before a PIV Card is issued to an individual with no prior investigation. (PS-3a)
• The Human resources office shall ensure individuals in positions subject to investigation are continuously vetted under 5 CFR 731.106(d) and the standards OPM issues. (PS-3b)
• The Human resources office shall notify each covered employee of the continuous vetting requirements. (PS-3b)
• The Human resources office shall initiate any upgraded investigation within 14 days after an individual’s move to a higher position risk level is final. (PS-3b)

From the Personnel Security Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PS-3 asks you to screen people before you authorize their access to a system, and to rescreen them under conditions and, where called for, at a frequency you set. The screening is what the position’s risk designation requires (PS-2). NIST’s PS-3 discussion gives background investigations and agency checks as examples. It also lets you set different rescreening conditions and frequencies by the kind of information a system handles.

Common implementations. The human resources office, or a screening vendor it hires, runs the checks the position’s level requires and records the completion date. Employment and privacy laws limit what may be checked and when, and they vary by country and state, so settle the screening criteria with legal counsel. The access request form has a line for screening, so the account manager confirms it is complete before creating the account. On a transfer to a position with a higher designation, the onboarding, transfer and termination checklist has a rescreening step before the new access is granted.

For contractors, the contract requires the provider to screen its staff to the same criteria as employees in comparable positions, and to give you evidence (PS-7).

Organization-defined parameters. Typical values, from the Personnel Security policy, which your organization may set differently:

Parameter	Typical value
Conditions that require rescreening (b)	The individual moves to a position with a higher risk designation, or information comes to light that raises a concern about their suitability
Rescreening frequency, where periodic rescreening applies (b)	Every 5 years for positions designated high risk

In the policy, the human resources office does the screening and the rescreening.

Evidence assessors ask for.

• The screening criteria for each position designation
• For a sample of users, the screening completion date compared with the date their account was created
• Rescreening records for people who moved to positions with a higher designation
• For high-risk positions, the date of each person’s last screening
• Evidence from external providers that their staff were screened

Inheritance. PS-3 is a common control, run by the human resources office. A system with users outside the organization’s screening, such as contractor administrators or partner staff, must show how they were screened, which makes it hybrid for those users.

Common findings.

• Accounts created before screening was complete, with no recorded decision allowing it.
• Contractor staff screened by their employer, with no evidence given to the organization.
• No rescreening when someone moved into a privileged or higher-risk role.
• Periodic rescreening overdue for high-risk positions.

Enhancements in the Moderate baseline. None. PS-3(1) classified information, PS-3(2) formal indoctrination, PS-3(3) information requiring special protective measures and PS-3(4) citizenship requirements are in no baseline.

Federal systems (as of October 2026). 5 CFR 731.106 (as amended June 30, 2026) requires a background investigation for each person entering a covered position. It should be initiated before appointment, or as soon as possible where the agency did not initiate it in time (731.106(c)(1)). A hiring agency may not ask about criminal history, and for competitive service or career Senior Executive Service positions about credit history, before a conditional offer of employment, with limited exceptions (731.106(g)). Rescreening is now continuous vetting: “Continuous vetting for an individual in a public trust position satisfies the requirement for a periodic reinvestigation” (731.106(d)(1)). The agency must tell each covered employee of the requirement (731.106(d)(3)). So for federal positions, record the frequency parameter as continuous vetting to OPM’s standards in place of a fixed interval. An upgraded investigation after a move to a higher risk level “should be initiated within 14 days” (731.106(e)). FIPS 201-3 (January 2022), section 2.2, requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation.

Artifacts

• Onboarding, Transfer and Termination Checklist
• Personnel Security Decision Worksheet
• Personnel Security Policy