NIST SP 800-53 PS Personnel Security: Key Controls, Enhancements and How to Evidence Them

The Personnel Security (PS) family is short, but its controls fail at the seams between HR, IT and suppliers, where nobody owns the hand-off and the organisation-defined parameters are never written down. This guide works through the PS family control by control: what each control and enhancement requires, which baselines select it, which parameters you must set, and what evidence an assessor will ask for under SP 800-53A. It is written for control owners, system security plan authors, HR and IAM leads and assessors. Screening practice itself (UK and US checks, data protection limits, remote hiring fraud) is covered in the Personnel Security and Background Screening Guide; this page stays at the control and evidence level. For the catalogue as a whole, see the NIST SP 800-53 Guide.

Key takeaways

• Every base control is in every baseline. PS-1 to PS-9 are all selected at Low, Moderate and High in the Release 5.2.0 baseline profiles. Only one enhancement, PS-4(2) Automated Actions, is selected, and only at High.
• PS-4 is an identity control. Termination requires disabling system access within a time you define and revoking any authenticators and credentials associated with the person, which includes keys, tokens and service account secrets they created or knew.
• Transfers matter as much as leavers. PS-5 requires reviewing and adjusting logical and physical access when people change role, with actions and notifications inside times you set. Privilege accumulation from moves is a PS-5 finding.
• Suppliers must tell you when their staff leave. PS-7(d) requires external providers to notify you of transfers or terminations of their personnel who hold your credentials, badges or privileges, within a time you define.
• The parameters are the control. Rescreening conditions, the disable window, transfer actions and notification times are all organisation-defined. Blank parameters are the most common PS finding.

The PS family at a glance

The table lists every current PS control with its baseline allocation from NIST's OSCAL Release 5.2.0 baseline profiles (L = Low, M = Moderate, H = High). The privacy baseline also selects PS-6.

For baseline selection and tailoring, see the NIST SP 800-53B Control Baselines and Tailoring Guide.

Before access: PS-2, PS-3, PS-6 and PS-9

• PS-2 Position Risk Designation: assign a risk designation to all positions, set screening criteria for each, and review the designations at a frequency you define. The designation drives everything else: screening depth, access agreements and how fast access must be removed.
• PS-3 Personnel Screening: screen individuals before authorising system access and rescreen according to conditions and frequency you define. PS-3(1) to PS-3(4) are for classified information, formal indoctrination, special protective measures and citizenship requirements; most non-federal organisations do not select them.
• PS-6 Access Agreements: develop and document access agreements, review them at a defined frequency, and verify that individuals sign before access is granted and re-sign when agreements change or at a defined frequency. The SP 800-53A examine list names non-disclosure agreements, acceptable use agreements, rules of behaviour and conflict-of-interest agreements.
• PS-9 Position Descriptions: incorporate security and privacy roles and responsibilities into position descriptions.

NHI Mgmt Group recommends three or four position risk tiers, with privileged administrators, people who can create or read production secrets, and people who can approve payments in the highest tier. Rescreening triggers we suggest for that tier: move into a higher tier, and a defined periodic interval set by legal and HR. Screening must stay inside local employment and data protection law. For a starting agreement, see the Acceptable Use Policy Template.

Leavers: PS-4 and its enhancements

On termination, PS-4 requires the organisation to:

1. disable system access within a time period you define;
2. terminate or revoke any authenticators and credentials associated with the individual;
3. conduct exit interviews that cover the topics you define;
4. retrieve all security-related organisational property; and
5. retain access to organisational information and systems the person controlled.

PS-4(1) adds notifying leavers of legally binding post-employment requirements and having them sign an acknowledgement. PS-4(2), selected at High, uses automated mechanisms you define to take actions you define, such as notifying staff or disabling access.

Where identity fits: item (b) is wider than the leaver's own account. Credentials "associated with the individual" include API keys and personal access tokens they issued, shared or service account passwords they knew, SSH keys on servers, OAuth grants made in their name, and the owner field of any service account or AI agent they ran. Item (e) is why those must be transferred to a new owner before the account is deleted. See the Employee Offboarding Security Guide and the NHI Offboarding and Decommissioning Guide.

If an automated disable fires in error, re-enable from the identity provider with an approved ticket rather than turning off the automation; record each reversal as a PS-4 exception.

Movers, suppliers and sanctions: PS-5, PS-7, PS-8

• PS-5 Personnel Transfer: review and confirm the ongoing need for current logical and physical access when people are reassigned; start the transfer actions you define within a time you define; modify access to match the new role; and notify the people or roles you define within a time you define. See the Joiner-Mover-Leaver Guide.
• PS-7 External Personnel Security: set personnel security requirements and roles for external providers, require them to follow your policies, document the requirements, require notification of transfers or terminations of their staff who hold your credentials, badges or privileges within a time you define, and monitor compliance. See the Contractor Identity Lifecycle Guide.
• PS-8 Personnel Sanctions: run a formal sanctions process for people who break security and privacy policies, and notify the people you define within a time you define when one starts, naming the individual and the reason.

PS-7 is the weakest link in most programmes, because a contractor leaving their employer is not an event in your HR system. Put the notification clause and its time limit in the contract, and back it with a periodic attestation of the provider's active staff list.

How to evidence PS controls

The OSCAL catalogue carries the SP 800-53A examine, interview and test objects for every PS control. For PS-4 the examine list includes records of termination actions, the list of system accounts and records of revoked authenticators and credentials, and the test object is the mechanism that disables access and revokes authenticators.

For sampling and assessment depth, see the NIST SP 800-53A Guide.

Implementing the PS family: a phased approach

This sequence is NHI Mgmt Group's recommendation for a Moderate system.

1. Write the parameters. Fill every PS parameter in the system security plan: review frequencies, rescreening conditions, disable window, exit interview topics, transfer actions and notification times.
2. Designate positions. Apply risk tiers to every position, including contractor roles, and link each tier to screening criteria and agreements.
3. Connect HR to identity. Make HR start, move and leave events the trigger for provisioning changes, first in report-only mode for a month to compare against manual actions, then enforced.
4. Extend leaver revocation to credentials. Add tokens, keys, OAuth grants and owned non-human identities to the leaver runbook, with reassignment of ownership before deletion.
5. Fix the supplier clause. Add PS-7 notification times to contracts at renewal and start quarterly staff list attestations.
6. Collect evidence monthly. Reconcile leavers and movers against account changes every month so evidence is current at assessment.

Decision guidance

• Low versus High: the base controls are identical across baselines; High adds automated termination actions. A Low system can meet PS-4 with a manual checklist if the disable window is met and recorded.
• Small versus large organisations: a small organisation can run PS from a single HR and IT checklist. Larger ones need event-driven automation, because manual hand-offs do not scale to hundreds of monthly movers.
• Federal versus non-federal: PS-3(1) to PS-3(4) and PS-6(2) reflect federal clearance regimes. Others tailor them out with a rationale.

Detection and measurement

• Median and 95th percentile time from HR termination to access disabled, against the PS-4 parameter.
• Leavers with active tokens, keys or owned service accounts 24 hours after termination.
• Movers whose previous-role entitlements remain after 30 days.
• External staff with active accounts not on the provider's latest attested list.
• Active users without a current signed access agreement.

Send account disable, credential revocation and sign-in events to monitoring under AU-2 and alert on sign-ins by accounts whose HR status is terminated.

Framework mapping

Mappings are ours and "intersect with", not equivalence. Check them against NIST's published informative references before using them in an audit. See the Control Mapping Guide.

Common failure patterns

• Account disabled, credentials alive: the directory account is off, but personal access tokens, API keys and shared passwords the person knew still work, so PS-4(b) is not met.
• Movers keep everything: PS-5 is treated as provisioning only, so access accumulates with each move.
• Contractor leavers invisible: no PS-7 notification clause, so accounts outlive the engagement.
• Agreements signed once: PS-6 re-signing never happens after policy changes.
• Owner field orphaned: service accounts and agents owned by a leaver have no new owner, contrary to PS-4(e).

Practitioner checklist

• Fill every PS organisation-defined parameter in the system security plan.
• Assign a risk designation to every position, including contractor roles.
• Confirm screening completes before first access.
• Trigger disable and revocation from HR termination events.
• Include tokens, keys, OAuth grants and owned non-human identities in leaver revocation.
• Remove previous-role access on every transfer within the defined time.
• Put staff-change notification times in every supplier contract.
• Reconcile leavers and movers against account changes monthly.

Standards and references

• NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• NIST: OSCAL content, SP 800-53 Release 5.2.0 catalogue and baseline profiles
• NIST: SP 800-53A Rev. 5, Assessing Security and Privacy Controls
• NIST: SP 800-53B, Control Baselines for Information Systems and Organizations
• NIST: SP 800-171 Rev. 3
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: NIST SP 800-53 Guide · Insider Threat Programme Guide · Leaver Retained Access Incident Playbook · Personnel Security Policy Template