PS-7: External Personnel Security

personnel security requirements are established, including security roles and responsibilities for external providers;

external providers are required to comply with personnel security policies and procedures established by the organization;

personnel security requirements are documented;

external providers are required to notify personnel or roles of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within time period ;

provider compliance with personnel security requirements is monitored.

Personnel security policy

procedures addressing external personnel security

list of personnel security requirements

acquisition documents

service-level agreements

compliance monitoring process

system security plan

other relevant documents or records

Organizational personnel with personnel security responsibilities

external providers

system/network administrators

organizational personnel with account management responsibilities

organizational personnel with information security responsibilities

Organizational processes for managing and monitoring external personnel security

mechanisms supporting and/or implementing the monitoring of provider compliance