Navigate

PS-5

PS-5: Personnel Transfer

The organization:

PS-5a.: Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization;

PS-5b.: Initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action];

PS-5c.: Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and

PS-5d.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Supplemental

This control applies when reassignments or transfers of individuals are permanent or of such extended durations as to make the actions warranted. Organizations define actions appropriate for the types of reassignments or transfers, whether permanent or extended. Actions that may be required for personnel transfers or reassignments to other positions within organizations include, for example: (i) returning old and issuing new keys, identification cards, and building passes; (ii) closing information system accounts and establishing new accounts; (iii) changing information system access authorizations (i.e., privileges); and (iv) providing for access to official records to which individuals had access at previous work locations and in previous information system accounts.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to PS-5.

Control	Description
AC-2	The organization: AC-2a.: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; AC-2b.: Assigns account managers for information system accounts; AC-2c.: Establishes conditions for group and role membership; AC-2d.: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; AC-2e.: Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts; AC-2f.: Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; AC-2g.: Monitors the use of information system accounts; AC-2h.: Notifies account managers: AC-2h.1.: When accounts are no longer required; AC-2h.2.: When users are terminated or transferred; and AC-2h.3.: When individual information system usage or need-to-know changes; AC-2i.: Authorizes access to the information system based on: AC-2i.1.: A valid access authorization; AC-2i.2.: Intended system usage; and AC-2i.3.: Other attributes as required by the organization or associated missions/business functions; AC-2j.: Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency]; and AC-2k.: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
IA-4	The organization manages information system identifiers by: IA-4a.: Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier; IA-4b.: Selecting an identifier that identifies an individual, group, role, or device; IA-4c.: Assigning the identifier to the intended individual, group, role, or device; IA-4d.: Preventing reuse of identifiers for [Assignment: organization-defined time period]; and IA-4e.: Disabling the identifier after [Assignment: organization-defined time period of inactivity].
PE-2	The organization: PE-2a.: Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides; PE-2b.: Issues authorization credentials for facility access; PE-2c.: Reviews the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency]; and PE-2d.: Removes individuals from the facility access list when access is no longer required.
PS-4	The organization, upon termination of individual employment: PS-4a.: Disables information system access within [Assignment: organization-defined time period]; PS-4b.: Terminates/revokes any authenticators/credentials associated with the individual; PS-4c.: Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics]; PS-4d.: Retrieves all security-related organizational information system-related property; PS-4e.: Retains access to organizational information and information systems formerly controlled by terminated individual; and PS-4f.: Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

Enhancements

The controls below (if any) add on to the requirements of PS-5.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PS-5.

CCI	Definition
CCI-001527	The organization reviews and confirms the ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization.
CCI-001528	The organization initiates organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.
CCI-001529	The organization defines transfer or reassignment actions to initiate within an organization-defined time period following the formal personnel transfer action.
CCI-001530	The organization defines the time period within which the organization initiates organization-defined transfer or reassignment actions following the formal personnel transfer action.
CCI-003031	The organization modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.
CCI-003032	The organization notifies organization-defined personnel or roles within an organization-defined time period when individuals are transferred or reassigned to other positions within the organization.
CCI-003033	The organization defines personnel or roles to be notified when individuals are transferred or reassigned to other positions within the organization.
CCI-003034	The organization defines the time period within which organization-defined personnel or roles are to be notified when individuals are transferred or reassigned to other positions within the organization.