PS-9

Requirement

Incorporate security and privacy roles and responsibilities into organizational position descriptions.

Discussion

Specification of security and privacy roles in individual organizational position descriptions facilitates clarity in understanding the security or privacy responsibilities associated with the roles and the role-based security and privacy training requirements for the roles.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing position descriptions; security and privacy position descriptions; system security plan; privacy plan; privacy program plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel with information security and privacy responsibilities; organizational personnel with human capital management responsibilities].

Test

[SELECT FROM: Organizational processes for managing position descriptions].

ID	Assessment Objectives
PS-09[01]	security roles and responsibilities are incorporated into organizational position descriptions;
PS-09[02]	privacy roles and responsibilities are incorporated into organizational position descriptions.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!