Requirements 3.9
3.9 Personnel Security: the NIST SP 800-171 requirements
The 2 requirements of family 3.9, Personnel Security, in NIST SP 800-171 Rev 2, worth 8 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.9.1 Personnel Screening
Screen individuals prior to authorizing access to organizational systems containing CUI.
Points: 3 points.
Assessment objectives (NIST SP 800-171A)
- [a]individuals are screened prior to authorizing access to organizational systems containing CUI.
How to meet it
Screen individuals before granting CUI access: run background checks (identity, criminal history, employment verification) through a screening service as part of hiring, and document the screening requirement in HR policy: including for contractors and temps who will touch CUI. Apply it retroactively to current CUI users if never done. Evidence: the screening policy and completion records (dates, not report contents) for each person with CUI access.
3.9.2 Personnel Actions
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]a policy and/or process for terminating system access and any credentials coincident with personnel actions is established.
- [b]system access and credentials are terminated consistent with personnel actions such as termination or transfer.
- [c]the system is protected during and after personnel transfer actions.
How to meet it
Build a termination/transfer checklist executed the day of the event: disable all accounts (directory, cloud, VPN, SaaS), collect badges, keys, laptops, and media, and adjust access on role change rather than letting permissions accumulate. Automate account disablement via an HR-to-IT notification step so nothing depends on memory. Evidence: the checklist template and completed checklists for recent departures, plus directory timestamps showing same-day disablement.