Personnel Security Policy
Personnel Security Domain (PS)
📖 What This Policy Covers
Personnel Security addresses the human element -- ensuring the people who access your CUI are trustworthy and that information is protected when their status changes. This policy covers pre-employment background checks (criminal history, employment verification, education verification, credit checks for sensitive roles), screening frequency (initial, periodic re-screening), termination procedures (account disablement, device retrieval, badge deactivation within 1 hour), role change/transfer procedures, and leave-of-absence handling. With only 2 practices, this is the smallest CMMC domain, but it's foundational.
Purpose
This policy ensures individuals are screened before receiving CUI access, CUI is protected during personnel transitions (hire, transfer, termination), and the organization can verify trustworthiness of personnel handling sensitive information.
Scope
Applies to all employees, contractors, and third-party personnel who access or may access CUI systems. Covers the full employment lifecycle from pre-hire screening through post-termination.
🎯 Why It Matters
Insider threats account for 25% of data breaches (Verizon DBIR). The period right before and after termination is the highest-risk window -- disgruntled employees may exfiltrate data. A terminated employee with active accounts is an immediate risk. Assessors specifically look for evidence that termination disables access within hours, not days, and that background checks are documented before CUI access is granted.
🔐 Key Requirements
1. Personnel Screening
Background checks before granting CUI access.
- ✓ Background check before CUI access: criminal history, employment verification, education verification
- ✓ Credit check for financially sensitive roles
- ✓ Conducted by HR using approved vendor (HireRight, Sterling, Accurate)
- ✓ Initial screening before CUI access granted
- ✓ Periodic re-screening: every 5 years for employees, every 3 years for contractors
- ✓ Adjudication: HR + CISO review results and approve/deny CUI access
- ✓ Foreign nationals: additional screening if accessing DoD CUI (may require export control review)
- ✓ Results stored in confidential HR personnel file
2. Personnel Actions
Protect CUI during termination, transfer, and leave.
- ✓ Termination (within 1 hour of notification): IT disables all accounts (AD, Azure AD, VPN, apps), Facilities deactivates badge, IT retrieves company devices (laptop, phone, badge, keys), Manager retrieves CUI materials (documents, USB drives, printouts), IT wipes devices remotely if not retrieved, Legal reminds of NDA obligations, IT Security reviews access logs for 30 days prior
- ✓ Transfer/role change (within 5 business days): manager submits access change, IT modifies permissions to new role, IT removes old role access, HR updates personnel file
- ✓ Leave of absence (>30 days): accounts disabled, data retained, re-enabled after identity verification on return
👥 Roles & Responsibilities
HR Department
- • Conduct background checks using approved vendors
- • Notify IT within 24 hours of personnel status changes
- • Maintain personnel records and screening documentation
- • Coordinate termination logistics with IT and Facilities
CISO / IT Director
- • Approve CUI access after screening review
- • Review access logs for terminated employees
- • Ensure 1-hour termination SLA is met
- • Approve re-screening schedule
IT Department
- • Disable accounts within 1 hour of termination notification
- • Modify access within 5 days of role change
- • Remote wipe devices not returned
- • Verify no access post-termination
Managers
- • Notify HR immediately of any personnel actions
- • Retrieve CUI materials from departing employees
- • Submit access change requests for transfers
- • Monitor for insider threat indicators
🛠️ Implementation Roadmap (4 Weeks)
Screening Process
Weeks 1-2- → Select background check vendor (HireRight, Sterling)
- → Establish screening criteria and approval workflow
- → Train HR on screening process and documentation
- → Create re-screening schedule for existing employees with CUI access
Termination Process
Weeks 3-4- → Create termination checklist with 1-hour SLA
- → Integrate with HR system for automatic IT notification
- → Train managers on CUI material retrieval
- → Test termination process with mock scenario
- → Create role-change access modification workflow
Recommended Tools
📊 CMMC Practice Mapping
| Practice ID | Requirement | Policy Section |
|---|---|---|
| PS.L2-3.9.1 | Screen individuals before authorizing access | 1 |
| PS.L2-3.9.2 | Ensure CUI protection during personnel actions | 2 |
📋 Evidence Requirements
These are the artifacts a C3PAO assessor will ask for. Start collecting early.
Background Check Summary
Completed Termination Checklists
Post-Termination Access Logs
Screening Policy & Vendor Agreement
⚠️ Common Gaps (What Assessors Flag)
1. No background checks for existing employees
2. Termination SLA not met (accounts active for days)
3. No process for contractor screening
📝 Template Customization Guide
When filling in the downloadable template for this policy, replace these placeholders with your organization's specifics:
[COMPANY NAME] Your organization's legal name
Example: Acme Defense Systems, LLC
[CISO Name] Name of your CISO or HR Director
Example: Jane Smith
Customization Tips
- 💡 Specify your exact background check vendor and what checks are included
- 💡 Document your HR notification process (automated vs. manual) for terminations
- 💡 If you use an HRIS system, describe how it triggers IT account disablement
- 💡 For small organizations, the 1-hour SLA may require a direct phone call from HR to IT -- document this process