Skip to content

Family 3.9 2 requirements

Personnel Security.

Screen before. Revoke after.

The big picture

Two requirements only — but they bracket every employment relationship. Both feed straight into Access Control.

Theme 1

All practices.

3.9.1 — 3.9.2

Screening individuals before granting access, and protecting CUI when people leave or transfer.

3.9.1 Screen Before Access. Background checks before granting CUI access. No exceptions for employees or contractors. 1 pts

3.9.2 Revoke on Departure. Same-day access revocation on termination or transfer. Collect devices. No orphaned accounts. 3 pts