Task 2 RMF_Personnel Security Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Personnel Security Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 5200.02, "DoD Personnel Security Program (PSP)"

ii. DoD Regulation 5200.02-R, "Personnel Security Program (PSP)", as amended

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

PERSONNEL SECURITY PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The purpose of the DoD Personnel Security Program is to establish policies and procedures to ensure that acceptance and retention of personnel in the Armed Forces, acceptance and retention of civilian employees in the Department of defense, and granting members of the Armed Forces, DoD civilian employees, DoD contractors, and other affiliated persons access to information are clearly consistent with the interests of national security.

This Personnel Security Plan ensures that {ACRONYM} follows and implements the DoD Personnel Security Program.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

2.0 PERSONNEL SECURITY POLICIES AND PROCEDURES

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R. DoD has defined the roles as organizational personnel with access control responsibilities. DoD disseminates DoD 5200.2-R via the DoD Issuance site: http://www.dtic.mil/whs/directives/corres/pub1.html to meet the DoD requirements for personnel security policy and procedures.

3.0 POSITION RISK DESIGNATION

Proper position designation is the foundation of an effective and consistent suitability and personnel security program. In order to ensure a systematic, dependable, and uniform way of making position designations, OPM provides the Position Designation Automated Tool (PDT) for those individuals within agencies charged with position designation responsibilities.

The Position Designation System assesses the duties and responsibilities of a position to determine the degree of potential damage to the efficiency or integrity of the service from misconduct of an incumbent of a position. This establishes the risk level of that position. This assessment also determines if a position’s duties and responsibilities present the potential for position incumbents to bring about a material adverse effect on the national security, and the degree of that potential effect, which establishes the sensitivity level of a position. The results of this assessment determine what level of investigation should be conducted for a position.

Enclosure 1 of this document lists the Position Designations and record of review, which must be performed annually.

4.0 PERSONNEL SCREENING

Personnel screening ensures all government and contract personnel meet the appropriate ADP/IT level designation requirements IAW DoD 5200.2-R prior to authorizing access to the {ACRONYM}.

Is the {ACRONYM} Access List contained in the Access Control Artifact?

☐ No

☐ Yes

Has the appropriate Position Designation clearance level been granted for personnel on the {ACRONYM} Access List?

☐ No

☐ Yes

Rescreening ensures that personnel assigned to the {ACRONYM} are periodically verified to ensure they still meet Position Designation requirements. The conditions required for rescreening follow established Defense Security Service (DSS) processes.

5.0 PERSONNEL TERMINATION

The purpose of this section is to define post-employment requirements for the protection of {ACRONYM} information. The process defined in this section is in addition to {ACRONYM} policies, such as Security Clearance termination. Reasons for termination vary and are facilitated through the Human Resources and Legal Departments.

The checklist, found in Enclosure 2 of this document, will be utilized to ensure that terminated personnel no longer have access to {ACRONYM} information and all property is properly returned.

Have any personnel assigned to {ACRONYM} been terminated within the last year?

☐ No

☐ Yes

If Yes, is the Personnel Termination Checklist (Enclosure 2) on file?

☐ No

☐ Yes

6.0 PERSONNEL TRANSFER

The purpose of this section is to document and implement a process to modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer. It is assumed that the person being transferred is still in good employment standing and requires continued access to DoD IT systems.

The checklist, found in Enclosure 3 of this document, will be utilized to ensure that transferred personnel no longer have access to {ACRONYM} information and all property is properly returned. Access and authorizations for newly assigned systems will follow the SAAR process.

Have any personnel assigned to {ACRONYM} been transferred within the last year?

☐ No

☐ Yes

If Yes, is the Personnel Transfer Checklist (Enclosure 3) on file?

☐ No

☐ Yes

7.0 ACCESS AGREEMENTS

{ACRONYM} utilizes DD Form 2875 (System Access Authorization Agreement (SAAR)) as the methodology to request and grant access to {ACRONYM}. In addition to the SAAR, if a user has administrative rights a Privileged Access Agreement (PAA) must also be signed.

{ACRONYM} requires that individuals re-sign SAARs to maintain access to {ACRONYM} when access agreements have been updated or when there is a change to the user's level of access.

In the event a person is terminated or transferred, the Checklist contained in Enclosure 2 or Enclosure 3 will be used to document the action.

Do all personnel identified in the Access Control List have a valid SAAR on file?

☐ No

☐ Yes

8.0 THIRD-PARTY PERSONNEL SECURITY

All third parties providing support to {ACRONYM} must meet DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41 and any {ACRONYM} policies for personnel security.

Does {ACRONYM} employ Third Parties for support?

☐ No

☐ Yes

If Yes, does the contract require compliance with DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41 and any {ACRONYM} policies for personnel security?

☐ No

☐ Yes

In addition to any existing contract requirements, third-party providers are required to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately. Enclosure 2 and Enclosure 3 of this document contain checklists that must be completed for all third-party providers in the event of personnel termination or transfer.

The Contracting Officer’s Technical Representative (COTR) is responsible for monitoring third-party provider compliance with personnel security requirements.

9.0 PERSONNEL SANCTIONS

In the event personnel fail to comply with established information security policies and procedures for {ACRONYM}, formal sanctions will be employed.

The ISSO will be immediately notified when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

Formal Sanctions are part of the general personnel policies and procedures for the {ACRONYM}. The process addresses the following:

· Informal corrective actions.

· Formal disciplinary actions.

· Severe disciplinary actions.

· Removal of system access.

· Possible criminal and/or civil penalties.

NOTE: Any person who improperly discloses classified or sensitive information is subject to criminal and civil penalties and sanctions.

Have Formal Sanctions been performed for any {ACRONYM} personnel?

☐ No

☐ Yes

If Yes, was the ISSO immediately notified?

☐ No

☐ Yes

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with access control responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with access control responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for personnel security policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Enclosure 1

Moderate Low High Moderate Low High Moderate Low DoD 5200.2-R meets the DoD requirements for establishing screening criteria for individuals filling organizational positions.

DoD organizations are automatically compliant with this control as they are covered at the DoD level by DoD 5200.2-R.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment reviews the audit records of the position designation reviews to ensure reviews are done annually.

DoD has defined the frequency as annually.

Section 3 Enclosure 1

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the additional personnel screening criteria is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low

Moderate Low High Moderate Low

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documentation of conditions requiring rescreening of individuals for access to the information system.

DoD has determined the list of conditions is not appropriate to define at the Enterprise level.

Section 4

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documentation defining the required frequency for rescreening individuals for access to the system.

DoD has determined the frequency is not appropriate to define at the Enterprise level.

Section 4

Moderate Low

Enclosure 2

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.

Section 5

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines organizational security policy and procedures documentation and audit records of account termination actions to ensure account termination actions are conducted immediately and IAW organizational security policy and procedures.

DoD has defined the time period as immediately.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as immediately.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented information security topics to ensure the organization being inspected/assessed defines information security topics to be discussed while conducting exit interviews.

DoD has determined the information security topics are not appropriate to define at the Enterprise level.

Section 5

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records of termination notification to ensure the organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for revoking credentials immediately or within 24 hours upon termination of individual employment.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.

DoD has defined the time period as immediately or within 24 hours.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for revoking credentials.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as immediately or within 24 hours.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Enclosure 3

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines appropriate organization security-related organizational physical and logical access documentation/logs and compares to transferred personnel documentation to ensure appropriate logical and physical access have been revoked for previous positions and granted for new positions immediately.

DoD defines the time period as immediately.

Section 6 Enclosure 3

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD defines transfer or reassignment actions as actions to ensure all system accesses no longer required are removed.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD defines the time period as immediately.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Enclosure 3

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records of transfer/reassignment notifications to ensure the organization being inspected/assessed notifies at a minimum, the ISSO and personnel responsible for transferring credentials within 24 hours when individuals are transferred or reassigned to other positions within the organization.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.

DoD has defined the time period as within 24 hours.

Section 6 Enclosure 3

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as immediately.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

Moderate Low High Moderate Low

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines a sampling of re-signed access agreements to ensure the organization being inspected/assessed requires that individuals re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or when there is a change to the user's level of access.

DoD has defined the frequency as when there is a change to the user's level of access.

Section 7

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as when there is a change to the user's level of access.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41 meet the DoD personnel security requirements including security roles and responsibilities for third-party providers.

DoD Components are automatically compliant with this control because they are covered by the DoD level policies, DoD 5220.22-M, DoD 5220.22-R, DoD 5200.2-R, DoD 8570.01-M and DoDI 3020.41.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

Moderate Low High Moderate Low

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires third-party providers to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.

DoD has defined the time period as immediately.

Section 8

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as immediately.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the records of notifications of employee sanctions to ensure the organization being inspected/assessed notifies at a minimum, the ISSO immediately when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

DoD has defined the personnel or roles as at a minimum, the ISSO.

DoD has defined the time period as immediately.

Section 9

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the time period as immediately.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as at a minimum, the ISSO.

Automatically compliant with this CCI because they are covered at the DoD level

ENCLOSURE 1 – POSITION DESIGNATION

AUTHORIZED POSITION DESIGNATIONS

Low Risk Non-Sensitive NACI

Moderate Risk Non-Sensitive (Public Trust) MBI

High Risk Non-Sensitive (Public Trust)

Low Risk Non-Critical Sensitive

Moderate Risk Non-Critical Sensitive

High Risk Non-Critical Sensitive

Critical Sensitive (automatic high risk)

Special Sensitive (automatic high risk)

ENCLOSURE 2 – PERSONNEL TERMINATION CHECKLIST

PERSONNEL TERMINATION CHECKLIST

PERSON INFORMATION

SYSTEM INFORMATION

ACTIONS

Notes: Enter text.

USER SIGNATURE

VALIDATION

Signature:

Date: Enter a date.

ENCLOSURE 3 – PERSONNEL TRANSFER CHECKLIST

PERSONNEL TRANSFER CHECKLIST

PERSON INFORMATION

SYSTEM INFORMATION

ACTIONS

Notes: Enter text.

USER SIGNATURE

VALIDATION

Signature:

Date: Enter a date.

FOR OFFICIAL USE ONLY 11

image2.emf image1.gif