NIST SP 800-171 Rev 2 · 3.9 Personnel Security
3.9.2 Protect CUI during personnel actions
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
- SPRS weight
- 5
- 5 points deducted from 110 when not implemented.
- CMMC level
- L2
- Level 2 only; not among the 17 Level 1 practices.
- Assessment objectives
- 3
- From NIST SP 800-171A, each one a “determine if” an assessor answers.
What an assessor checks
NIST SP 800-171A breaks 3.9.2 into 3 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.
- [a]Determine if a policy and/or process for terminating system access authorization and any credentials coincident with personnel actions is established.
- [b]Determine if system access and credentials are terminated consistent with personnel actions such as termination or transfer.
- [c]Determine if the system is protected during and after personnel transfer actions.
- Examine
- [SELECT FROM: Personnel security policy; procedures addressing personnel transfer and termination; records of personnel transfer and termination actions; list of system accounts; records of terminated or revoked authenticators and credentials; records of exit interviews; other relevant documents or records].
- Interview
- [SELECT FROM: Personnel with personnel security responsibilities; personnel with account management responsibilities; system or network administrators; personnel with information security responsibilities].
- Test
- [SELECT FROM: Organizational processes for personnel transfer and termination; mechanisms supporting or implementing personnel transfer and termination notifications; mechanisms for disabling system access and revoking authenticators].
If it is open: POA&M eligibility
Not POA&M-eligible: above the 1-point ceiling · 5 points deducted
Worth 5 points. No requirement over 1 point may appear on a Level 2 POA&M, so this has to be closed before the assessment.
A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.
Where 3.9.2 maps
NIST SP 800-53 Rev 5
- PS-1 Personnel Security Policy
- PS-4 Personnel Termination
- PS-5 Personnel Transfer
- PS-8 Personnel Sanctions
NIST CSF 2.0
- Personnel actions are managed
SOC 2
No direct mapping.
Query it from your own tools
This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.
lookup_control 3.9.2 get_assessment_objectives 3.9.2 generate_poam_entries ["3.9.2"]
Install the MCP server, free, no account.
From MacZine