3.9.2e

Requirement

Ensure that organizational systems are protected if adverse information develops or is obtained about individuals with access to CUI.

Discussion

If adverse information develops or is obtained about an individual with access to CUI which calls into question whether the individual should have continued access to systems containing CUI, actions are taken (e.g., preclude or limit further access by the individual, audit actions taken by the individual) to protect the CUI while the adverse information is resolved.

NIST 800-172A Assessment Guidance

Examine

[SELECT FROM: Personnel security policy; system and services acquisition policy; procedures addressing personnel screening; records of screened personnel; enterprise architecture documentation; system design documentation; system architecture and configuration documentation; security plan; list of individuals who have been identified as posing an increased level of risk; list of appropriate access authorizations required for system personnel; personnel screening criteria and associated documentation; other relevant documents or records].
Interview

[SELECT FROM: Organizational personnel responsible for personnel security; organizational personnel responsible for information security; organizational personnel responsible for system and services acquisition; organizational personnel responsible for personnel screening].
Test

[SELECT FROM: Organizational processes for personnel screening; mechanisms supporting personnel screening].

ID	Assessment Objectives
3.9.2e[d]	Mechanisms are in place to protect organizational systems if adverse information develops or is obtained about individuals with access to CUI.
3.9.2e[b]	Adverse information about individuals with access to CUI is defined.
3.9.2e[c]	Organizational systems to which individuals have access are identified.
3.9.2e[a]	Individuals with access to CUI are identified.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!