Rescreens individuals according to [Assignment: organization-defined list of conditions requiring rescreening and, where re-screening is so indicated, the frequency of such rescreening]. PS-4 The organization, upon termination of individual Personnel Termination employment: Terminates information system access; Conducts exit interviews; Retrieves all security-related organizational information system-related property; and Retains access to organizational information and information systems formerly controlled by terminated individual. PS-5 The organization reviews logical and physical access Personnel Transfer authorizations to information systems/facilities when personnel are reassigned or transferred to other positions within the organization and initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: time period following the formal transfer action]. PS-6 The organization: Access Agreements Ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and Reviews/updates the access agreements [Assignment: organization-defined frequency]. PS-7 The organization: Personnel Establishes personnel security requirements Security including security and responsibilities for providers; Documents personnel security requirements; and Monitors provider compliance. PS-8 The organization employs a formal sanctions process Personnel Sanctions for personnel failing to comply with established information security policies and procedures. Risk Assessment RA-1 The organization develops, disseminates, and Risk Assessment Policy reviews/updates [Assignment: organization-defined and Procedures frequency]: A formal, documented risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls. RA-2 The organization: Security Categorization Categorizes information and the information system in accordance with applicable federal laws,
Rescreens individuals according to [Assignment: organization-defined list of conditions requiring rescreening and, where re-screening is so indicated, the frequency of such rescreening]. PS-4 Personnel Termination The organization, upon termination of individual employment: Terminates information system access; Conducts exit interviews; Retrieves all security-related organizational information system-related property; and Retains access to organizational information and information systems formerly controlled by terminated individual. PS-5 Personnel Transfer The organization reviews logical and physical access authorizations to information systems/facilities when personnel are reassigned or transferred to other positions within the organization and initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: time period following the formal transfer action]. PS-6 Access Agreements The organization: Ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access; and Reviews/updates the access agreements [Assignment: organization-defined frequency]. PS-7 Personnel Security The organization: Establishes personnel security requirements including security and responsibilities for providers; Documents personnel security requirements; and Monitors provider compliance. PS-8 Personnel Sanctions The organization employs a formal sanctions process for personnel failing to comply with established information security policies and procedures. Risk Assessment RA-1 Risk Assessment Policy and Procedures The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls. RA-2 Security Categorization The organization: Categorizes information and the information system in accordance with applicable federal laws,