PS-3(3)

Requirement
Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:
1. Have valid access authorizations that are demonstrated by assigned official government duties; and
2. Satisfy [Assignment: organization-defined additional personnel screening criteria].

Discussion

Organizational information that requires special protection includes controlled unclassified information. Personnel security criteria include position sensitivity background screening requirements.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Personnel security policy; access control policy, procedures addressing personnel screening; records of screened personnel; screening criteria; records of access authorizations; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for ensuring valid access authorizations for information requiring special protection; organizational process for additional personnel screening for information requiring special protection].

ID	Assessment Objectives
PS-03(03)(a)	individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties;
PS-03(03)(b)	individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy <PS-03(03)_ODP additional personnel screening criteria>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!