# Personnel Security Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ps/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet PS-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PS-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Personnel Security, and who is accountable for meeting those requirements. (PS-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PS-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (PS-1a.1(a))
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (PS-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (PS-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (PS-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PS-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PS-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PS-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PS-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (PS-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (PS-1a.1(a))

## Procedures

The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (PS-1a.2)

## Dissemination

- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the personnel security policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PS-1a)
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the personnel security procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PS-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Position risk designation (PS-2)

> **Guidance:** A risk designation rates each position by the harm a person in it could do through misconduct, usually low, moderate or high. Positions with privileged access, control of money or access to large amounts of sensitive information rate higher. The designation sets the screening each position needs (PS-3), so write the screening criteria for each level in one table.

- The [Human resources office] shall assign a risk designation to every organizational position, in consultation with the [Chief Information Security Officer]. (PS-2a)
- The [Human resources office] shall establish screening criteria for the individuals who fill each position, according to its risk designation. (PS-2b)
- The [Human resources office] shall review and update position risk designations [Fill in: the frequency at which to review and update position risk designations. Typical: at least every 3 years, and whenever a position's duties change]. (PS-2c)

#### Federal systems

[5 CFR 731.106](https://www.ecfr.gov/current/title-5/section-731.106) (OPM; last amended June 30, 2026) requires the agency head to designate every covered position, including positions filled by contractor employees, "at high, moderate, or low risk level" by the position's potential for adverse impact to the efficiency or integrity of the service. Each such position also gets a sensitivity designation: Special-Sensitive, Critical-Sensitive, Noncritical-Sensitive or Non-sensitive (731.106(c)(2)); [5 CFR 1400.201](https://www.ecfr.gov/current/title-5/section-1400.201) defines the levels for national security positions. OPM and the Defense Counterintelligence and Security Agency provide the [Position Designation Tool](https://www.opm.gov/suitability/suitability-executive-agent/position-designation-tool/) for making these designations. Checked September 2026.

- The [Human resources office] shall designate each covered position, including positions filled by contractor employees, at a high, moderate or low risk level, as 5 CFR 731.106(a) requires. (PS-2a)
- The [Human resources office] shall give each covered position a sensitivity designation under 5 CFR 731.106(c)(2) and 5 CFR part 1400. (PS-2a)

### Personnel screening (PS-3)

> **Guidance:** Screening is what the position's risk designation calls for: identity and employment checks at the low level, and more, such as criminal history checks, at higher levels. Employment and privacy laws limit what may be checked and how, and they vary by country and state, so settle the screening criteria with legal counsel. Assessors compare screening completion dates with account creation dates.

- The [Human resources office] shall screen each individual, according to the screening criteria for their position, before the individual is authorized to access a system. (PS-3a)
- The [Human resources office] shall rescreen individuals when [Fill in: conditions requiring rescreening of individuals. Typical: the individual moves to a position with a higher risk designation, or information comes to light that raises a concern about their suitability], and, where the screening criteria call for periodic rescreening, [Fill in: the frequency of rescreening individuals where it is so indicated. Typical: every 5 years for positions designated high risk]. (PS-3b)

#### Federal systems

[5 CFR 731.106](https://www.ecfr.gov/current/title-5/section-731.106) (as amended June 30, 2026) requires a background investigation for each individual entering a covered position, initiated before appointment where possible (731.106(c)(1)), and bars criminal or credit history inquiries before a conditional offer of employment, with limited exceptions (731.106(g)). Rescreening is now continuous vetting: "Continuous vetting for an individual in a public trust position satisfies the requirement for a periodic reinvestigation" (731.106(d)(1)), and an upgraded investigation for a move to a higher risk level "should be initiated within 14 days" (731.106(e)). [FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022), section 2.2, requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation. Checked September 2026.

- The [Human resources office] shall initiate the background investigation the position's risk level requires before the individual is appointed, or as soon as possible where it was not initiated in time. (PS-3a)
- The [Human resources office] shall not ask an applicant about criminal or credit history before a conditional offer of employment, except as 5 CFR 731.106(g) allows. (PS-3a)
- The [Human resources office] shall ensure the FBI National Criminal History Check is completed and favorably adjudicated before a PIV Card is issued to an individual with no prior investigation. (PS-3a)
- The [Human resources office] shall ensure individuals in positions subject to investigation are continuously vetted under 5 CFR 731.106(d) and the standards OPM issues. (PS-3b)
- The [Human resources office] shall notify each covered employee of the continuous vetting requirements. (PS-3b)
- The [Human resources office] shall initiate any upgraded investigation within 14 days after an individual's move to a higher position risk level is final. (PS-3b)

### Personnel termination (PS-4)

> **Guidance:** Termination is the most tested personnel control: assessors take a list of recent departures and check when each account was disabled. The time period should agree with the notice time in AC-2h.2. NIST notes that for a termination for cause, organizations consider disabling accounts before the individual is told, and that an exit interview is not always possible. The [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) lists each step with its owner.

- The [Account manager] shall disable the individual's system access within [Fill in: a time period within which to disable system access. Typical: 24 hours, or the same day for privileged users; for an involuntary termination, no later than when the individual is told] of the termination of their employment. (PS-4a)
- The [Account manager] shall terminate or revoke every authenticator and credential associated with the individual, including tokens, certificates and building passes. (PS-4b)
- The [Human resources office] shall conduct an exit interview with the individual that includes a discussion of [Fill in: information security topics to be discussed when conducting exit interviews. Typical: the individual's continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used]. (PS-4c)
- The [Supervisor] shall retrieve all security-related organizational property from the individual, such as devices, authentication tokens, keys, identification cards and building passes. (PS-4d)
- The [Supervisor] shall ensure the organization keeps access to the organizational information and systems the individual controlled. (PS-4e)

#### Federal systems

[FIPS 201-3](https://csrc.nist.gov/pubs/fips/201-3/final) (January 2022), section 2.9.4, requires a PIV Card to be terminated when, among other circumstances, "A federal employee separates (voluntarily or involuntarily) from federal service" or "A contractor changes positions and no longer needs access to federal buildings or systems." Checked September 2026.

- The [Human resources office] shall ensure the PIV Card issuer terminates the individual's PIV Card in each circumstance FIPS 201-3 section 2.9.4 lists, including separation from federal service. (PS-4b)

### Personnel transfer (PS-5)

> **Guidance:** A transfer is where access accumulates: people keep what they had and gain what the new job needs. PS-5 applies to reassignments that are permanent or long enough to warrant the actions. The notice time should agree with AC-2h.2. The [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) has a transfer section.

- The [Supervisor] shall review and confirm the ongoing operational need for an individual's current logical and physical access authorizations to systems and facilities when the individual is reassigned or transferred to another position within the organization. (PS-5a)
- The [Human resources office] shall initiate [Fill in: transfer or reassignment actions to be initiated following transfer or reassignment. Typical: a review of the individual's access by the losing and gaining supervisors, removal of access the new position does not need, and the return or issue of keys, badges and equipment] within [Fill in: the time period within which transfer or reassignment actions must occur following transfer or reassignment. Typical: 5 business days] following the formal transfer action. (PS-5b)
- The [Account manager] shall modify the individual's access authorizations to match any change in operational need caused by the reassignment or transfer. (PS-5c)
- The [Human resources office] shall notify [Fill in: personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization. Typical: the account managers and system owners of the systems the individual has access to] of the reassignment or transfer within [Fill in: time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization. Typical: 24 hours]. (PS-5d)

### Access agreements (PS-6)

> **Guidance:** Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior and conflict-of-interest agreements (SP 800-53 PS-6 discussion). The [access agreement](https://kston83.github.io/nist-guide/templates/forms/access-agreement/) template covers nondisclosure and acceptable use, and takes in the [Rules of Behavior](https://kston83.github.io/nist-guide/templates/forms/rules-of-behavior/) by reference; keeping both on the same annual cycle means one signature event a year. Electronic signatures are acceptable unless organizational policy prohibits them. PS-6 is also in the Privacy baseline.

- The [Chief Information Security Officer] shall develop and document access agreements for organizational systems. (PS-6a)
- The [Chief Information Security Officer] shall review and update the access agreements [Fill in: the frequency at which to review and update access agreements. Typical: annually]. (PS-6b)
- The [Account manager] shall verify that each individual who requires access to organizational information and systems has signed the appropriate access agreements before granting access. (PS-6c.1)
- The [Account manager] shall verify that each individual re-signs the access agreements when they are updated, and [Fill in: the frequency at which to re-sign access agreements to maintain access to organizational information. Typical: annually], to keep access to organizational systems. (PS-6c.2)
- The [Account manager] shall suspend the access of an individual who does not re-sign an updated access agreement until the individual signs it. (PS-6c.2)

### External personnel security (PS-7)

> **Guidance:** External providers include contractors, service bureaus, and organizations providing development, IT, assessment or security services. Put these requirements in the contract: screening to the same criteria as employees in comparable positions, signed access agreements, required training, and the notice of transfers and terminations. Monitor compliance by comparing the provider's staff roster with the accounts and badges issued to its people.

- The [Chief Information Security Officer] shall establish personnel security requirements, including security roles and responsibilities, for external providers. (PS-7a)
- The [Chief Information Security Officer] shall require external providers to comply with the organization's personnel security policies and procedures. (PS-7b)
- The [Chief Information Security Officer] shall document personnel security requirements for external providers in their contracts or agreements. (PS-7c)
- The [Chief Information Security Officer] shall require external providers to notify [Fill in: personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges. Typical: the organization's contract manager for the provider, and the account managers of the systems the individual has access to] within [Fill in: time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges. Typical: 24 hours] of any transfer or termination of their personnel who hold organizational credentials or badges, or who have system privileges. (PS-7d)
- The [Chief Information Security Officer] shall monitor external provider compliance with personnel security requirements. (PS-7e)

### Personnel sanctions (PS-8)

> **Guidance:** Sanctions are usually part of the general human resources disciplinary process; this policy makes security and privacy violations subject to it and names who is told. Describe the sanctions in the access agreement and the rules of behavior so people know them before they sign. NIST advises consulting legal counsel on sanctions matters.

- The [Human resources office] shall employ a formal sanctions process for individuals who fail to comply with the organization's information security and privacy policies and procedures. (PS-8a)
- The [Human resources office] shall notify [Fill in: personnel or roles to be notified when a formal employee sanctions process is initiated. Typical: the Chief Information Security Officer, and the senior privacy official when the violation concerns privacy] within [Fill in: the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated. Typical: 2 business days] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. (PS-8b)

### Position descriptions (PS-9)

> **Guidance:** Every position description should carry the general duties all users have, such as following the rules of behavior and reporting incidents. Positions with security or privacy roles, such as system administrators, system security officers and privacy officers, need those roles written in, which also tells the training plan who needs role-based training (AT-3).

- The [Human resources office] shall incorporate security and privacy roles and responsibilities into organizational position descriptions. (PS-9)

## Review and update

- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current personnel security policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current personnel security policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PS-1c.1)
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current personnel security procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the personnel security procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PS-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PS-1a.1(b))