Navigate

CCI-003031

CCI-003031 Definition

Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer.

Validation Procedures

Examine: [SELECT FROM: Personnel security policy; procedures addressing personnel transfer; records of personnel transfer actions; list of system and facility access authorizations; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for personnel transfer; mechanisms supporting and/or implementing personnel transfer notifications; mechanisms for disabling system access/revoking authenticators].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003031.

Control	Description
PS-5	a: Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization; b: Initiate [transfer or reassignment actions to be initiated following transfer or reassignment are defined;] within [the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined;]; c: Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and d: Notify [personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined;] within [time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined;].

Control

Description

PS-5

a: Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;

b: Initiate [transfer or reassignment actions to be initiated following transfer or reassignment are defined;] within [the time period within which transfer or reassignment actions must occur following transfer or reassignment is defined;];

c: Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and

d: Notify [personnel or roles to be notified when individuals are reassigned or transferred to other positions within the organization is/are defined;] within [time period within which to notify organization-defined personnel or roles when individuals are reassigned or transferred to other positions within the organization is defined;].