Personnel Security Decision Worksheet

Personnel Security Decision Worksheet template: Every decision the Personnel Security family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Personnel Security family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every PS control in the baseline, with a typical value where the Personnel Security Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

27 decisions.

Decision	Control	Typical value	Who decides
Who designates position risk, and what screening does each risk level require?	PS-2, PS-3	The human resources office designates positions with the security team; a table sets the screening for each level, from identity and employment checks for low risk to criminal history checks for high risk, where the law allows them.	Human resources office, with the Chief Information Security Officer
How do account managers learn of departures and transfers?	PS-4, PS-5	An automated feed from the human resources system to the identity provider, plus a same-day call or ticket for an involuntary termination.	Chief Information Security Officer
Which access agreements does each person sign?	PS-6	Everyone signs the access agreement and the rules of behavior; administrators also sign a privileged user agreement; conflict-of-interest agreements where the role calls for one.	Chief Information Security Officer
How do external providers report changes to their staff, and how is that checked?	PS-7	A contract clause requiring notice within 24 hours, and a monthly comparison of the provider’s staff roster with the accounts and badges issued to its people.	Chief Information Security Officer
Personnel or roles to whom the personnel security policy is to be disseminated	PS-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the personnel security procedures are to be disseminated	PS-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	PS-1	Organization-level	Chief Information Security Officer
An official to manage the personnel security policy and procedures	PS-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current personnel security policy is reviewed and updated	PS-1	Annually	Chief Information Security Officer
Events that would require the current personnel security policy to be reviewed and updated	PS-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current personnel security procedures are reviewed and updated	PS-1	Annually	Chief Information Security Officer
Events that would require the personnel security procedures to be reviewed and updated	PS-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
The frequency at which to review and update position risk designations	PS-2	At least every 3 years, and whenever a position’s duties change	Chief Information Security Officer
Conditions requiring rescreening of individuals	PS-3	The individual moves to a position with a higher risk designation, or information comes to light that raises a concern about their suitability	Chief Information Security Officer
The frequency of rescreening individuals where it is so indicated	PS-3	Every 5 years for positions designated high risk	Chief Information Security Officer
A time period within which to disable system access	PS-4	24 hours, or the same day for privileged users; for an involuntary termination, no later than when the individual is told	Chief Information Security Officer
Information security topics to be discussed when conducting exit interviews	PS-4	The individual’s continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used	Chief Information Security Officer
Transfer or reassignment actions to be initiated following transfer or reassignment	PS-5	A review of the individual’s access by the losing and gaining supervisors, removal of access the new position does not need, and the return or issue of keys, badges and equipment	Chief Information Security Officer
The time period within which transfer or reassignment actions must occur following transfer or reassignment	PS-5	5 business days	Chief Information Security Officer
Personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization	PS-5	The account managers and system owners of the systems the individual has access to	Chief Information Security Officer
Time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization	PS-5	24 hours	Chief Information Security Officer
The frequency at which to review and update access agreements	PS-6	Annually	Chief Information Security Officer
The frequency at which to re-sign access agreements to maintain access to organizational information	PS-6	Annually	Chief Information Security Officer
Personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges	PS-7	The organization’s contract manager for the provider, and the account managers of the systems the individual has access to	Chief Information Security Officer
Time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges	PS-7	24 hours	Chief Information Security Officer
Personnel or roles to be notified when a formal employee sanctions process is initiated	PS-8	The Chief Information Security Officer, and the senior privacy official when the violation concerns privacy	Chief Information Security Officer
The time period within which organization-defined personnel or roles must be notified when a formal employee sanctions process is initiated	PS-8	2 business days	Chief Information Security Officer