Navigate

CCI-001507

CCI-001507 Definition

Defines the frequency with which to review and update the current personnel security policy.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the current personnel security policy is reviewed and updated [PS-01_ODP[05]; the frequency at which the current personnel security policy is reviewed and updated is defined]. - the current personnel security policy is reviewed and updated following [PS-01_ODP[06]; events that would require the current personnel security policy to be reviewed and updated are defined].

Validation Procedures

"Examine: [SELECT FROM: Personnel security policy; personnel security procedures; system security plan; privacy plan; risk management strategy documentation; audit findings; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities]."

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001507.

Control	Description
PS-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] personnel security policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls; b: Designate an [an official to manage the personnel security policy and procedures is defined;] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and c: Review and update the current personnel security: 1: Policy [the frequency at which the current personnel security policy is reviewed and updated is defined;] and following [events that would require the current personnel security policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current personnel security procedures are reviewed and updated is defined;] and following [events that would require the personnel security procedures to be reviewed and updated are defined;].

Control

Description

PS-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] personnel security policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls;

b: Designate an [an official to manage the personnel security policy and procedures is defined;] to manage the development, documentation, and dissemination of the personnel security policy and procedures; and

c: Review and update the current personnel security:
- 1: Policy [the frequency at which the current personnel security policy is reviewed and updated is defined;] and following [events that would require the current personnel security policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current personnel security procedures are reviewed and updated is defined;] and following [events that would require the personnel security procedures to be reviewed and updated are defined;].