Personnel Security

Personnel Security is the HR handshake with information security. Only two requirements, but both involve processes that cross organizational boundaries.

The Big Picture

These two requirements bookend the employee lifecycle: screen before access, revoke on departure. The assessor will pick a recent hire and a recent termination and check the dates. If CUI access was granted before screening cleared, or if an account was still active after termination, that’s a finding.

---

All 2 Requirements

Ref	Short Name	What It Covers
3.9.1	Screen Before Access	Background checks before CUI access
3.9.2	Revoke on Departure	Same-day access revocation and device collection