Skip to main content
NetStable
Level 2 PS.L2-3.9.1

Screen individuals prior to authorizing access to systems containing CUI

📖 What This Means

This control requires organizations to vet individuals before granting them access to systems handling Controlled Unclassified Information (CUI). Screening ensures only trustworthy personnel can access sensitive data. It typically involves background checks, employment history verification, and reference checks. For example, a defense contractor must verify a new IT admin's criminal record before allowing them to manage servers storing CUI. Another example: a subcontractor's employees must pass basic employment verification before accessing CUI in shared cloud systems. The goal is to prevent insider threats and unauthorized access.

🎯 Why It Matters

Failing to screen personnel risks insider threats, data leaks, and compliance violations. A 2022 Verizon DBIR report found that 22% of breaches involved internal actors. In one case, an unscreened employee at a defense supplier stole CUI and sold it to foreign entities, costing the company $2.3M in fines. The DoD mandates this control because CUI requires protection from both external and internal threats. Proper screening reduces risks of espionage, sabotage, and accidental exposure by ensuring only vetted individuals handle sensitive data.

How to Implement

  1. 1. Integrate HR systems with IAM (e.g., Azure AD or AWS IAM) to enforce access only after screening completion
  2. 2. Configure conditional access policies requiring 'employment verified' attribute for CUI systems
  3. 3. Use AWS/Azure Privileged Identity Management (PIM) to require screening documentation for elevated roles
  4. 4. Automate screening reminders with Microsoft 365 Retention Labels or AWS WorkMail
  5. 5. Store background check results in encrypted cloud storage (e.g., S3 buckets with KMS) linked to employee records
⏱️
Estimated Effort
Initial setup: 8-16 hours (HR + IT collaboration). Ongoing: 1-2 hours per new hire. Skill level: HR generalist with basic IT coordination.

📋 Evidence Examples

Screening Policy Document

Format: PDF/DOCX
Frequency: Annual updates
Contents: Defines required checks (criminal, employment, education), approval workflow, and retention period
Collection: Export from HR policy repository

Completed Background Check Report

Format: Redacted PDF
Frequency: Per hire/re-screening
Contents: Third-party verification showing cleared criminal history and employment verification
Collection: HR personnel file (encrypted storage)

Access Control List with Screening Status

Format: CSV/Excel
Frequency: Monthly
Contents: List of users with CUI access + 'Screening Completed' date column
Collection: Export from IAM system

Signed Acceptable Use Policy

Format: Digitally signed PDF
Frequency: Per hire/refresh
Contents: Employee acknowledgment of CUI handling rules
Collection: eSignature platform export

Screening Exception Log

Format: Spreadsheet
Frequency: Per exception
Contents: Documented temporary access approvals with risk mitigation plans
Collection: HR shared drive

📝 SSP Guidance

Use this guidance when writing the System Security Plan (SSP) narrative for this control.

How to Write the SSP Narrative

For PS.L2-3.9.1 ("Screen individuals prior to authorizing access to systems containing CUI"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your personnel security program, including background check requirements, screening frequency, and procedures for protecting CUI during personnel actions (hiring, transfer, termination). Be specific -- name your actual products, settings, and responsible personnel.

Example SSP Narratives

Cloud (Azure/AWS)

"PS.L2-3.9.1 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to screen individuals prior to authorizing access to systems containing cui. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."

On-Premise

"PS.L2-3.9.1 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to screen individuals prior to authorizing access to systems containing cui. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."

Hybrid

"PS.L2-3.9.1 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."

System Boundary Considerations

  • Identify all personnel categories with CUI access
  • Document the screening process and vendor
  • Specify termination SLAs for account disablement
  • Ensure this control covers all systems within your defined CUI boundary where screen individuals prior to authorizing access to systems containing cui applies
  • Document any systems where this control is not applicable and explain why

Key Documentation to Reference in SSP

  • 📄 Personnel Security Policy
  • 📄 Background check summary (aggregate, not individual)
  • 📄 Termination checklists
  • 📄 HR-IT notification process documentation
  • 📄 Evidence artifacts specific to PS.L2-3.9.1
  • 📄 POA&M entry if control is not fully implemented

What the Assessor Looks For

The assessor will verify that all CUI-access personnel have been screened, test the termination process timeline (accounts disabled within 1 hour), and review sample termination checklists.

💬 Self-Assessment Questions

Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.

Question 1: Do you have a written policy defining required screening procedures for CUI access?

✅ YES → Proceed to Q2
❌ NO → GAP: Create screening policy template within 14 days. Use NIST SP 800-171 Appendix F as reference.
Remediation:
Template available at: [LINK]

Question 2: Are background checks completed for 100% of personnel with CUI access?

✅ YES → Proceed to Q3
❌ NO → GAP: Immediately suspend uncertified access. Complete checks within 30 days or revoke privileges.
Remediation:
Use approved vendors like Sterling or HireRight

Question 3: Is screening status verified before provisioning access in IAM systems?

✅ YES → Proceed to Q4
❌ NO → GAP: Implement HR-IT handoff process within 7 days. Azure AD/Okta conditional access templates available.
Remediation:
See implementation guide section 3.1

Question 4: Are screening records retained for at least 3 years after employment ends?

✅ YES → Proceed to Q5
❌ NO → GAP: Establish encrypted archive for terminated employee records. Complete within 21 days.
Remediation:
Use AWS S3 Glacier or Azure Archive Storage

Question 5: Do you conduct annual audits comparing CUI access lists against screening records?

✅ YES → COMPLIANT
❌ NO → GAP: Schedule audit within 30 days using template evidence report.
Remediation:
Template: [LINK]

⚠️ Common Mistakes (What Auditors Flag)

1. Assuming subcontractor employees are screened by their employer

Why this happens: Prime contractors often overlook flow-down requirements
How to avoid: Include screening clauses in subcontracts and collect certificates

2. Keeping only 'pass/fail' results without detailed reports

Why this happens: Privacy concerns lead to over-redaction
How to avoid: Store full reports (encrypted) with redacted versions for routine access

3. Not screening temporary/contract workers

Why this happens: Assuming short-term access is low-risk
How to avoid: Apply same standards to all CUI handlers regardless of employment type

4. Manual processes causing delays in access revocation

Why this happens: Lack of HR-IT automation
How to avoid: Integrate Workday/BambooHR with Active Directory via tools like Okta

5. No documentation for screening exceptions

Why this happens: Emergency access needs bypassing procedures
How to avoid: Require CISO-approved risk acceptance forms for any exceptions

📚 Parent Policy

This practice is governed by the Personnel Security Policy

View PS Policy →

📚 Related Controls