Personnel Security is the smallest family in NIST SP 800-171 — two requirements — and the one with the highest point density, at four points per requirement. It covers the two moments when people are the risk: before they get access, and when their relationship with the organization changes.
Its two requirements are short, but they connect HR processes to IT processes in a way many organizations have never formalized. That connection is what assessors test.
What the Personnel Security family covers
Personnel Security contains 2 requirements, numbered 3.9.1 to 3.9.2 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix PS.L2, so 3.9.1 appears as PS.L2-3.9.1.
3.9.1 requires screening individuals before authorizing access to systems containing CUI. 3.9.2 requires protecting CUI and systems during and after personnel actions such as terminations and transfers. Both depend on the account management requirements 3.1.1 and 3.1.2 in Access Control, which is where the actual granting and removal of access happens.
NIST SP 800-171 does not define what screening must consist of. That is left to the organization, consistent with law and with any contractual or export control requirement. Common practice is identity verification, employment history, and a background check appropriate to the role, plus confirmation of US-person status where export-controlled data is involved — see aerospace and defense.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.9.1 | Screen individuals prior to authorizing access to systems containing CUI | 3 | No |
| 3.9.2 | Ensure CUI and systems are protected during and after personnel actions such as terminations and transfers | 5 | No |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 8 of the 313 deductible points in the SPRS score at risk. The five-point requirement is 3.9.2. 3.9.1 is worth three points.
Eight points sit in two requirements, so a company with no personnel security process loses them quickly. Because neither requirement is worth one point, neither can be deferred under the CMMC rule.
Where personnel security fails
The usual failure is timing. Screening happens, but after the new starter has already been given an account. Or an employee leaves on Friday and their accounts are disabled on Tuesday, after the help desk gets around to the ticket. Transfers are worse: someone moving from engineering to sales keeps their access to the engineering share because nobody told IT.
The fix is a documented handoff between HR and IT with defined timeframes — access disabled at or before departure, access reviewed on transfer, equipment and media recovered — and records showing it happened. Remote workers add a step: recovering laptops and any printed CUI from home offices.
Making HR and IT work as one process
The simplest evidence comes from a single workflow. HR opens a ticket when an offer is accepted; IT cannot create accounts until HR marks screening complete. HR opens a ticket on the day notice is given or a transfer is approved; IT disables or adjusts access by an agreed deadline and records the time. Managers confirm the return of laptops, badges, keys and any printed CUI. The ticket history then shows timing for every person, which is exactly what an assessor will sample.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes nothing eligible for deferral.
Neither 3.9.1 nor 3.9.2 is deferrable, so both must be in place before an assessment. The good news is that both are process requirements that can usually be implemented quickly once HR and IT agree the workflow.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- A screening policy describing what checks are performed for which roles.
- Screening records for people with access, dated before access was granted.
- Termination and transfer checklists with timestamps for account removal.
- Records of equipment, badge and media recovery at departure.
- Access reviews performed after transfers.
Frequently asked questions
Does NIST 800-171 require background checks?
It requires screening but does not define it. Background checks are the most common way to satisfy 3.9.1, scaled to the role.
How quickly must access be removed when someone leaves?
The standard does not set a time. Your policy should, and assessors expect it to be prompt — typically on or before the last day.
Do contractors need screening?
Yes, if they will have access to systems containing CUI.
What about people on long-term leave?
Treat extended leave as a personnel action: suspend access during the absence and review it on return. Document the rule in policy.