Personnel Screening (03.09.01)_personnel-screening

Personnel Screening (03.09.01) Personnel Screening

High-Level Description

Family: Personnel Security Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Screen individuals prior to authorizing access to the system. Rescreen individuals in accordance with [organization-defined].

What to Check

• Verify Personnel Screening (03.09.01) Personnel Screening is implemented for CUI systems
• Review SSP documentation for Personnel Screening (03.09.01)
• Validate CMMC Level 2 assessment objective for Personnel Screening (03.09.01)
• Confirm POA&M addresses any gaps for Personnel Screening (03.09.01)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Personnel Screening (03.09.01) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Screen individuals prior to authorizing access to the system. Rescreen individuals in accordance with [organization-defined].

Supplemental Guidance

Personnel security screening activities involve the assessment of the conduct, integrity, judgment, loyalty, reliability, and stability of an individual (i.e., the individual’s trustworthiness) prior to authorizing access to the system or when elevating system access. The screening and rescreening activities reflect applicable federal laws, Executive Orders, directives, policies, regulations, and criteria established for the level of access required for the assigned position.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Personnel Screening (03.09.01) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active