PS-6 PS · Personnel Security

Access Agreements

✓ LOW ✓ MODERATE ✓ HIGH
2 Enhancements 1 Overlay 10 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

    1. 1.Sign appropriate access agreements prior to being granted access; and
    2. 2.Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [frequency].
Discussion (NIST Supplemental Guidance)

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with organizational systems to which access is authorized. Organizations can use electronic signatures to acknowledge access agreements unless specifically prohibited by organizational policy.

Enhancements NIST SOURCE

PS-6(1) Information Requiring Special Protection WITHDRAWN

Withdrawn. Incorporated into PS-3.

PS-6(2) Classified Information Requiring Special Protection LOW MODERATE HIGH

Verify that access to classified information requiring special protection is granted only to individuals who:

  1. (a) Have a valid access authorization that is demonstrated by assigned official government duties;
  2. (b) Satisfy associated personnel security criteria; and
  3. (c) Have read, understood, and signed a nondisclosure agreement.
Discussion

Classified information that requires special protection includes collateral information, Special Access Program (SAP) information, and Sensitive Compartmented Information (SCI). Personnel security criteria reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Open full page for PS-6(2) →
PS-6(3) Post-employment Requirements LOW MODERATE HIGH
  1. (a) Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information; and
  2. (b) Require individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
Discussion

Organizations consult with the Office of the General Counsel regarding matters of post-employment requirements on terminated individuals.

Open full page for PS-6(3) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PS-6 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the frequency at which to review and update access agreements is defined;
  2. the frequency at which to re-sign access agreements to maintain access to organizational information is defined;
  3. access agreements are developed and documented for organizational systems;
  4. the access agreements are reviewed and updated <PS-06_ODP[01] frequency>;
  5. individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;
  6. individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or <PS-06_ODP[02] frequency>.

Examine

[SELECT FROM: Personnel security policy; personnel security procedures; procedures addressing access agreements for organizational information and systems; access control policy; access control procedures; access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements); documentation of access agreement reviews, updates, and re-signing; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with personnel security responsibilities; organizational personnel who have signed/resigned access agreements; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for reviewing, updating, and re-signing access agreements; mechanisms supporting the reviewing, updating, and re-signing of access agreements].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PS-6. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • Personnel security policy
  • access control policy
  • documentation of access agreement reviews, updates, and re-signing
  • system security plan
  • privacy plan

Testing

  • Organizational processes for reviewing, updating, and re-signing access agreements
  • mechanisms supporting the reviewing, updating, and re-signing of access agreements

Other Records

  • personnel security procedures
  • procedures addressing access agreements for organizational information and systems
  • access control procedures
  • access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
  • other relevant documents or records