{"data":{"id":"PS-03","name":"Personnel Screening","family":"PS","family_name":"Personnel Security","withdrawn":false,"description":"a. Screen individuals prior to authorizing access to the system; and\nb. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].","supplemental_guidance":"Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.","enhancements":[{"id":"PS-03(01)","name":"Classified Information","statement":"Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.","baselines":[]},{"id":"PS-03(02)","name":"Formal Indoctrination","statement":"Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.","baselines":[]},{"id":"PS-03(03)","name":"Information Requiring Special Protective Measures","statement":"Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection:\na. Have valid access authorizations that are demonstrated by assigned official government duties; and\nb. Satisfy [Assignment: organization-defined additional personnel screening criteria].","baselines":[]},{"id":"PS-03(04)","name":"Citizenship Requirements","statement":"Verify that individuals accessing a system processing, storing, or transmitting [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"PS-03","name":"Personnel Screening","description":"a. Screen individuals prior to authorizing access to the system; and\nb. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].","discussion":"Personnel screening and rescreening activities reflect applicable laws, executive orders, directives, regulations, policies, standards, guidelines, and specific criteria established for the risk designations of assigned positions. Examples of personnel screening include background investigations and agency checks. Organizations may define different rescreening conditions and frequencies for personnel accessing systems based on types of information processed, stored, or transmitted by the systems.","related_controls":["AC-02","IA-04","MA-05","PE-02","PM-12","PS-02","PS-06","PS-07","SA-21"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.6.1"],"iso_27002_2022":["6.1"],"cobit_2019":["APO07"],"pci_dss_v4":["12.7"],"nist_csf_2":["GV.RR-04"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":["A.4.6"],"iec_62443":[],"asd_e8":[],"nis2":["Art. 21(2)(i)"],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["ORP.2"],"anssi":["Hygiene.7","SecNumCloud.8.1"],"osfi_b13":["B-13.1.1"],"finma_circular":["IV.B.a(48)","IV.F(100)"],"gdpr":["Art.28(3)(b)","Art.32(4)"],"dora":["Art.5(4)"],"bio2":["6.1"],"rbi_csf":["Annex1.8"],"fisc":["FISC.O8"],"lgpd_bcb":["LGPD.Art.47"],"hkma_tme1":[],"mlps_2":["8.1.8.1"],"dnb_good_practice":["DNB.8.1","DNB.8.4"],"cra":[],"swift_cscf":["SWIFT.5.3A"],"nca_ecc":["1-9"],"qatar_nia":["HR"],"sama_csf":["1.7"],"uae_ia":["T5"],"bog_cisd":["CISD-XV"],"bom_ctrm":["3.8"],"cbe_csf":["CD-1","GOV-2"],"cbn_csf":["Part1.2","Part9"],"popia":["s19"],"sa_js2":["JS2-8.6"],"bot_cyber":["Ch7.2"],"cpmi_pfmi":["CG.GOV"],"ecb_croe":["CROE.2.1.2","CROE.2.3.2"],"ffiec_is":["II.C.7","II.C.7(a)"],"hipaa_sr":["§164.308(a)(3)(i)","§164.308(a)(3)(ii)(A)","§164.308(a)(3)(ii)(B)"],"iosco_cyber":["GOV-4"],"nydfs_500":["500.10"],"sebi_cscrf":["GV.RR"],"cmmc_2":["PS"],"nerc_cip":["CIP-004-7"],"nrc_73_54":["RG5.71-C-PS"],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["WORKFORCE"],"api_1164":["Sec 13"],"awia":["AWWA Sec 8"],"iaea_nss":["Sec 9"],"pci_pts":["H"],"fips_140":[],"cbest":["CBEST.8"],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.6.4"],"fda_21_cfr_11":["§11.10(i)","§11.100(b)"],"fda_cyber":[],"hitrust_csf":["02.a"],"iso_27799":["7.1","9.3"],"lloyds_ms":[],"naic_ds":["4-personnel","4B"],"nhs_dspt":[],"pra_ss1_23":["P2.4"],"solvency_ii":["Art.42"],"owasp_masvs_v2":[],"csa_ccm_v4":["HRS-01"],"csa_aicm":["HRS-01"],"ccss_v9":["1.04.4"],"mica":[],"basel_sco60":["SCO60.55","SCO60.62"],"bssc":["GSP-04"],"sec_custody_digital":["SEC-CD-16"],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-014","SP-026"]}}