Ensure that CUI and organizational systems are protected during and after personnel actions
📖 What This Means
This practice requires organizations to safeguard Controlled Unclassified Information (CUI) and their systems when employees are hired, leave, or change roles. It means having processes in place to ensure that employees only access the information they need and that access is revoked promptly when they no longer need it. For example, when an employee leaves the company, their access to systems and CUI should be immediately removed to prevent unauthorized access. Similarly, during hiring, background checks and role-specific access controls should be implemented to ensure new employees can only access necessary systems. This control is crucial to prevent insider threats and accidental exposure of sensitive information.
🎯 Why It Matters
Failing to protect CUI during personnel actions can lead to significant data breaches. For instance, a terminated employee with lingering access could steal sensitive data or sabotage systems. According to the 2023 Verizon Data Breach Investigations Report, insider threats account for 20% of data breaches, often due to poor access management. The DoD emphasizes this control because compromised CUI can jeopardize national security and defense contracts. The financial and reputational damage from such breaches can be devastating, potentially costing millions in fines and lost business.
✅ How to Implement
- 1. Use Identity and Access Management (IAM) tools to assign role-based access controls (RBAC) in AWS/Azure/GCP.
- 2. Automate access revocation upon termination using scripts or cloud-native tools like AWS Lambda or Azure Automation.
- 3. Integrate HR systems with cloud platforms to trigger access changes based on employment status.
- 4. Enable logging and monitoring for all access changes using tools like CloudTrail or Azure Monitor.
- 5. Conduct regular audits of user access permissions to ensure compliance.
📋 Evidence Examples
Access Revocation Log
Termination Checklist
Access Review Report
Background Check Records
Signed Employment Agreement
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For PS.L2-3.9.2 ("Ensure that CUI and organizational systems are protected during and after personnel actions"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe your personnel security program, including background check requirements, screening frequency, and procedures for protecting CUI during personnel actions (hiring, transfer, termination). Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"PS.L2-3.9.2 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to ensure that cui and organizational systems are protected during and after person.... The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"PS.L2-3.9.2 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to ensure that cui and organizational systems are protected during and after person.... Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"PS.L2-3.9.2 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all personnel categories with CUI access
- • Document the screening process and vendor
- • Specify termination SLAs for account disablement
- • Ensure this control covers all systems within your defined CUI boundary where ensure that cui and organizational systems are protected during and after personnel actions applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Personnel Security Policy
- 📄 Background check summary (aggregate, not individual)
- 📄 Termination checklists
- 📄 HR-IT notification process documentation
- 📄 Evidence artifacts specific to PS.L2-3.9.2
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that all CUI-access personnel have been screened, test the termination process timeline (accounts disabled within 1 hour), and review sample termination checklists.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a documented process for revoking access upon termination?
Question 2: Are background checks conducted for all new hires?
Question 3: Do you conduct regular access reviews?
Question 4: Are access changes logged and audited?
Question 5: Do employees sign acceptable use policies?
⚠️ Common Mistakes (What Auditors Flag)
1. Delayed access revocation
2. Incomplete background checks
3. Missing access reviews
4. Inconsistent documentation
5. Failure to log access changes
📚 Parent Policy
This practice is governed by the Personnel Security Policy