Navigate

CCI-001539

CCI-001539 Definition

Establish personnel security requirements including security roles and responsibilities for external providers.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if personnel security requirements are established, including security roles and responsibilities for external providers.

Validation Procedures

Examine: [SELECT FROM: Personnel security policy; procedures addressing external personnel security; list of personnel security requirements; acquisition documents; service-level agreements; compliance monitoring process; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities; external providers; system/network administrators; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for managing and monitoring external personnel security; mechanisms supporting and/or implementing the monitoring of provider compliance].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001539.

Control	Description
PS-7	a: Establish personnel security requirements, including security roles and responsibilities for external providers; b: Require external providers to comply with personnel security policies and procedures established by the organization; c: Document personnel security requirements; d: Require external providers to notify [personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined;] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined;] ; and e: Monitor provider compliance with personnel security requirements.

Control

Description

PS-7

a: Establish personnel security requirements, including security roles and responsibilities for external providers;

b: Require external providers to comply with personnel security policies and procedures established by the organization;

c: Document personnel security requirements;

d: Require external providers to notify [personnel or roles to be notified of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is/are defined;] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [time period within which third-party providers are required to notify organization-defined personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges is defined;] ; and

e: Monitor provider compliance with personnel security requirements.