Personnel Security Policy

Personnel Security Policy template: Ready-to-adopt Personnel Security policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Personnel Security policy states what the organization requires for personnel security and who is accountable for it. It meets PS-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. PS-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
PS-1	Policy and Procedures	Yes	Yes	Yes	Yes
PS-2	Position Risk Designation	Yes	Yes	Yes
PS-3	Personnel Screening	Yes	Yes	Yes
PS-4	Personnel Termination	Yes	Yes	Yes
PS-4(2)	Automated Actions			Yes
PS-5	Personnel Transfer	Yes	Yes	Yes
PS-6	Access Agreements	Yes	Yes	Yes	Yes
PS-7	External Personnel Security	Yes	Yes	Yes
PS-8	Personnel Sanctions	Yes	Yes	Yes
PS-9	Position Descriptions	Yes	Yes	Yes

Decisions to make first

The policy has 26 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who designates position risk, and what screening does each risk level require?	PS-2, PS-3	The human resources office designates positions with the security team; a table sets the screening for each level, from identity and employment checks for low risk to criminal history checks for high risk, where the law allows them.	Human resources office, with the Chief Information Security Officer
How do account managers learn of departures and transfers?	PS-4, PS-5	An automated feed from the human resources system to the identity provider, plus a same-day call or ticket for an involuntary termination.	Chief Information Security Officer
Which access agreements does each person sign?	PS-6	Everyone signs the access agreement and the rules of behavior; administrators also sign a privileged user agreement; conflict-of-interest agreements where the role calls for one.	Chief Information Security Officer
How do external providers report changes to their staff, and how is that checked?	PS-7	A contract clause requiring notice within 24 hours, and a monthly comparison of the provider’s staff roster with the accounts and badges issued to its people.	Chief Information Security Officer

Record your values in the Personnel Security decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: PS pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet PS-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the PS-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Personnel Security, and who is accountable for meeting those requirements. (PS-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (PS-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (PS-1a.1(a))
• The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (PS-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (PS-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (PS-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (PS-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (PS-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (PS-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (PS-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (PS-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (PS-1a.1(a))

Procedures

The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (PS-1a.2)

Dissemination

• The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the personnel security policy is to be disseminated Typical: everyone within its scope, through the policy library. (PS-1a)
• The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the personnel security procedures are to be disseminated Typical: the people who carry them out, and the system owners. (PS-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Position risk designation (PS-2)

Guidance

A risk designation rates each position by the harm a person in it could do through misconduct, usually low, moderate or high. Positions with privileged access, control of money or access to large amounts of sensitive information rate higher. The designation sets the screening each position needs (PS-3), so write the screening criteria for each level in one table.

• The Human resources office shall assign a risk designation to every organizational position, in consultation with the Chief Information Security Officer. (PS-2a)
• The Human resources office shall establish screening criteria for the individuals who fill each position, according to its risk designation. (PS-2b)
• The Human resources office shall review and update position risk designations Fill in: the frequency at which to review and update position risk designations Typical: at least every 3 years, and whenever a position’s duties change. (PS-2c)

Federal systems

5 CFR 731.106 (OPM; last amended June 30, 2026) requires the agency head to designate every covered position, including positions filled by contractor employees, “at high, moderate, or low risk level” by the position’s potential for adverse impact to the efficiency or integrity of the service. Each such position also gets a sensitivity designation: Special-Sensitive, Critical-Sensitive, Noncritical-Sensitive or Non-sensitive (731.106(c)(2)); 5 CFR 1400.201 defines the levels for national security positions. OPM and the Defense Counterintelligence and Security Agency provide the Position Designation Tool for making these designations. Checked September 2026.

• The Human resources office shall designate each covered position, including positions filled by contractor employees, at a high, moderate or low risk level, as 5 CFR 731.106(a) requires. (PS-2a)
• The Human resources office shall give each covered position a sensitivity designation under 5 CFR 731.106(c)(2) and 5 CFR part 1400. (PS-2a)

Personnel screening (PS-3)

Guidance

Screening is what the position’s risk designation calls for: identity and employment checks at the low level, and more, such as criminal history checks, at higher levels. Employment and privacy laws limit what may be checked and how, and they vary by country and state, so settle the screening criteria with legal counsel. Assessors compare screening completion dates with account creation dates.

• The Human resources office shall screen each individual, according to the screening criteria for their position, before the individual is authorized to access a system. (PS-3a)
• The Human resources office shall rescreen individuals when Fill in: conditions requiring rescreening of individuals Typical: the individual moves to a position with a higher risk designation, or information comes to light that raises a concern about their suitability, and, where the screening criteria call for periodic rescreening, Fill in: the frequency of rescreening individuals where it is so indicated Typical: every 5 years for positions designated high risk. (PS-3b)

Federal systems

5 CFR 731.106 (as amended June 30, 2026) requires a background investigation for each individual entering a covered position, initiated before appointment where possible (731.106(c)(1)), and bars criminal or credit history inquiries before a conditional offer of employment, with limited exceptions (731.106(g)). Rescreening is now continuous vetting: “Continuous vetting for an individual in a public trust position satisfies the requirement for a periodic reinvestigation” (731.106(d)(1)), and an upgraded investigation for a move to a higher risk level “should be initiated within 14 days” (731.106(e)). FIPS 201-3 (January 2022), section 2.2, requires the FBI National Criminal History Check to be completed and favorably adjudicated before a PIV Card is issued to someone with no prior investigation. Checked September 2026.

• The Human resources office shall initiate the background investigation the position’s risk level requires before the individual is appointed, or as soon as possible where it was not initiated in time. (PS-3a)
• The Human resources office shall not ask an applicant about criminal or credit history before a conditional offer of employment, except as 5 CFR 731.106(g) allows. (PS-3a)
• The Human resources office shall ensure the FBI National Criminal History Check is completed and favorably adjudicated before a PIV Card is issued to an individual with no prior investigation. (PS-3a)
• The Human resources office shall ensure individuals in positions subject to investigation are continuously vetted under 5 CFR 731.106(d) and the standards OPM issues. (PS-3b)
• The Human resources office shall notify each covered employee of the continuous vetting requirements. (PS-3b)
• The Human resources office shall initiate any upgraded investigation within 14 days after an individual’s move to a higher position risk level is final. (PS-3b)

Personnel termination (PS-4)

Guidance

Termination is the most tested personnel control: assessors take a list of recent departures and check when each account was disabled. The time period should agree with the notice time in AC-2h.2. NIST notes that for a termination for cause, organizations consider disabling accounts before the individual is told, and that an exit interview is not always possible. The onboarding, transfer and termination checklist lists each step with its owner.

• The Account manager shall disable the individual’s system access within Fill in: a time period within which to disable system access Typical: 24 hours, or the same day for privileged users; for an involuntary termination, no later than when the individual is told of the termination of their employment. (PS-4a)
• The Account manager shall terminate or revoke every authenticator and credential associated with the individual, including tokens, certificates and building passes. (PS-4b)
• The Human resources office shall conduct an exit interview with the individual that includes a discussion of Fill in: information security topics to be discussed when conducting exit interviews Typical: the individual’s continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used. (PS-4c)
• The Supervisor shall retrieve all security-related organizational property from the individual, such as devices, authentication tokens, keys, identification cards and building passes. (PS-4d)
• The Supervisor shall ensure the organization keeps access to the organizational information and systems the individual controlled. (PS-4e)

Federal systems

FIPS 201-3 (January 2022), section 2.9.4, requires a PIV Card to be terminated when, among other circumstances, “A federal employee separates (voluntarily or involuntarily) from federal service” or “A contractor changes positions and no longer needs access to federal buildings or systems.” Checked September 2026.

• The Human resources office shall ensure the PIV Card issuer terminates the individual’s PIV Card in each circumstance FIPS 201-3 section 2.9.4 lists, including separation from federal service. (PS-4b)

Personnel transfer (PS-5)

Guidance

A transfer is where access accumulates: people keep what they had and gain what the new job needs. PS-5 applies to reassignments that are permanent or long enough to warrant the actions. The notice time should agree with AC-2h.2. The onboarding, transfer and termination checklist has a transfer section.

• The Supervisor shall review and confirm the ongoing operational need for an individual’s current logical and physical access authorizations to systems and facilities when the individual is reassigned or transferred to another position within the organization. (PS-5a)
• The Human resources office shall initiate Fill in: transfer or reassignment actions to be initiated following transfer or reassignment Typical: a review of the individual’s access by the losing and gaining supervisors, removal of access the new position does not need, and the return or issue of keys, badges and equipment within Fill in: the time period within which transfer or reassignment actions must occur following transfer or reassignment Typical: 5 business days following the formal transfer action. (PS-5b)
• The Account manager shall modify the individual’s access authorizations to match any change in operational need caused by the reassignment or transfer. (PS-5c)
• The Human resources office shall notify Fill in: personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization Typical: the account managers and system owners of the systems the individual has access to of the reassignment or transfer within Fill in: time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization Typical: 24 hours. (PS-5d)

Access agreements (PS-6)

Guidance

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior and conflict-of-interest agreements (SP 800-53 PS-6 discussion). The access agreement template covers nondisclosure and acceptable use, and takes in the Rules of Behavior by reference; keeping both on the same annual cycle means one signature event a year. Electronic signatures are acceptable unless organizational policy prohibits them. PS-6 is also in the Privacy baseline.

• The Chief Information Security Officer shall develop and document access agreements for organizational systems. (PS-6a)
• The Chief Information Security Officer shall review and update the access agreements Fill in: the frequency at which to review and update access agreements Typical: annually. (PS-6b)
• The Account manager shall verify that each individual who requires access to organizational information and systems has signed the appropriate access agreements before granting access. (PS-6c.1)
• The Account manager shall verify that each individual re-signs the access agreements when they are updated, and Fill in: the frequency at which to re-sign access agreements to maintain access to organizational information Typical: annually, to keep access to organizational systems. (PS-6c.2)
• The Account manager shall suspend the access of an individual who does not re-sign an updated access agreement until the individual signs it. (PS-6c.2)

External personnel security (PS-7)

Guidance

External providers include contractors, service bureaus, and organizations providing development, IT, assessment or security services. Put these requirements in the contract: screening to the same criteria as employees in comparable positions, signed access agreements, required training, and the notice of transfers and terminations. Monitor compliance by comparing the provider’s staff roster with the accounts and badges issued to its people.

• The Chief Information Security Officer shall establish personnel security requirements, including security roles and responsibilities, for external providers. (PS-7a)
• The Chief Information Security Officer shall require external providers to comply with the organization’s personnel security policies and procedures. (PS-7b)
• The Chief Information Security Officer shall document personnel security requirements for external providers in their contracts or agreements. (PS-7c)
• The Chief Information Security Officer shall require external providers to notify Fill in: personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges Typical: the organization’s contract manager for the provider, and the account managers of the systems the individual has access to within Fill in: time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges Typical: 24 hours of any transfer or termination of their personnel who hold organizational credentials or badges, or who have system privileges. (PS-7d)
• The Chief Information Security Officer shall monitor external provider compliance with personnel security requirements. (PS-7e)

Personnel sanctions (PS-8)

Guidance

Sanctions are usually part of the general human resources disciplinary process; this policy makes security and privacy violations subject to it and names who is told. Describe the sanctions in the access agreement and the rules of behavior so people know them before they sign. NIST advises consulting legal counsel on sanctions matters.

• The Human resources office shall employ a formal sanctions process for individuals who fail to comply with the organization’s information security and privacy policies and procedures. (PS-8a)
• The Human resources office shall notify Fill in: personnel or roles to be notified when a formal employee sanctions process is initiated Typical: the Chief Information Security Officer, and the senior privacy official when the violation concerns privacy within Fill in: the time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated Typical: 2 business days when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. (PS-8b)

Position descriptions (PS-9)

Guidance

Every position description should carry the general duties all users have, such as following the rules of behavior and reporting incidents. Positions with security or privacy roles, such as system administrators, system security officers and privacy officers, need those roles written in, which also tells the training plan who needs role-based training (AT-3).

• The Human resources office shall incorporate security and privacy roles and responsibilities into organizational position descriptions. (PS-9)

Review and update

• The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current personnel security policy is reviewed and updated Typical: annually and following Fill in: events that would require the current personnel security policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (PS-1c.1)
• The Fill in: an official to manage the personnel security policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current personnel security procedures are reviewed and updated Typical: annually and following Fill in: events that would require the personnel security procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (PS-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (PS-1a.1(b))