# Personnel Security Policy

**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/ps/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet PS-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PS-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Personnel Security, and who is accountable for meeting those requirements. (PS-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PS-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (PS-1a.1(a))
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (PS-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (PS-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (PS-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (PS-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PS-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (PS-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (PS-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (PS-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (PS-1a.1(a))

## Procedures

The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (PS-1a.2)

## Dissemination

- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the personnel security policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (PS-1a)
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the personnel security procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (PS-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Access agreements (PS-6)

> **Guidance:** Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior and conflict-of-interest agreements (SP 800-53 PS-6 discussion). The [access agreement](https://kston83.github.io/nist-guide/templates/forms/access-agreement/) template covers nondisclosure and acceptable use, and takes in the [Rules of Behavior](https://kston83.github.io/nist-guide/templates/forms/rules-of-behavior/) by reference; keeping both on the same annual cycle means one signature event a year. Electronic signatures are acceptable unless organizational policy prohibits them. PS-6 is also in the Privacy baseline.

- The [Chief Information Security Officer] shall develop and document access agreements for organizational systems. (PS-6a)
- The [Chief Information Security Officer] shall review and update the access agreements [Fill in: the frequency at which to review and update access agreements. Typical: annually]. (PS-6b)
- The [Account manager] shall verify that each individual who requires access to organizational information and systems has signed the appropriate access agreements before granting access. (PS-6c.1)
- The [Account manager] shall verify that each individual re-signs the access agreements when they are updated, and [Fill in: the frequency at which to re-sign access agreements to maintain access to organizational information. Typical: annually], to keep access to organizational systems. (PS-6c.2)
- The [Account manager] shall suspend the access of an individual who does not re-sign an updated access agreement until the individual signs it. (PS-6c.2)

## Review and update

- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current personnel security policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current personnel security policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (PS-1c.1)
- The [Fill in: an official to manage the personnel security policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current personnel security procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require the personnel security procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (PS-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PS-1a.1(b))