# PS-05 Personnel Transfer

NIST SP 800-53 control. Family: PS Personnel Security. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization; b. Initiate [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action]; c. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and d. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Guidance: Personnel transfer applies when reassignments or transfers of individuals are permanent or of such extended duration as to make the actions warranted. Organizations define actions appropriate for the types of reassignments or transfers, whether permanent or extended. Actions that may be required for personnel transfers or reassignments to other positions within organizations include returning old and issuing new keys, identification cards, and building passes; closing system accounts and establishing new accounts; changing system access authorizations (i.e., privileges); and providing for access to official records to which individuals had access at previous work locations and in previous system accounts.

## Patterns that use it (3)
- Critical (1): SP-044 SaaS Identity Lifecycle Management
- Standard (2): SP-014 Awareness and Training Pattern; SP-037 Privileged User Management

## Clauses by framework (48 frameworks)
- iso_27001_2022: A.5.11, A.6.5
- iso_27002_2022: 5.11, 6.5
- nist_csf_2: GV.RR-04. OSA's own, not in NIST's crosswalk: GV.RR-04
- cis_controls_v8: CIS 6.2
- soc2_tsc: CC1.5
- iso_42001_2023: A.3.2
- nis2: Art. 21(2)(i)
- bsi_grundschutz: ORP.2
- anssi: Hygiene.7, Hygiene.14, Hygiene.32, SecNumCloud.8.4
- osfi_b13: B-13.1.1, B-13.3.2
- finma_circular: IV.B.d(59), IV.B.d(60)
- gdpr: Art.29, Art.32(1)(b)
- dora: Art.9(4)(c)
- bio2: 5.11, 6.5
- rbi_csf: Annex1.8, ITGRCA.19
- fisc: FISC.O8
- lgpd_bcb: LGPD.Art.47
- hkma_tme1: TME1.8.1
- mlps_2: 8.1.8.1
- dnb_good_practice: DNB.8.5
- cbb_tm: TM-6
- nca_ecc: 1-9
- qatar_nia: HR
- sama_csf: 1.7
- uae_ia: T5
- bog_cisd: CISD-XV
- bom_ctrm: 3.8
- cbe_csf: GOV-2
- cbn_csf: Part9
- sa_js2: JS2-8.6
- bot_cyber: Ch7.2
- ecb_croe: CROE.2.3.2
- ffiec_is: II.C.7
- hipaa_sr: §164.308(a)(3)(i), §164.308(a)(3)(ii)(C)
- iosco_cyber: GOV-4
- nydfs_500: 500.7
- cmmc_2: PS
- nerc_cip: CIP-004-7
- nrc_73_54: RG5.71-C-PS
- fca_sysc_13: SYSC 13.6.4
- hitrust_csf: 02.c
- iso_27799: 7.3, 8.3
- lloyds_ms: MS8.3
- naic_ds: 4-access, 4-personnel
- nhs_dspt: NDG-4.2
- csa_ccm_v4: HRS-06, IAM-07
- csa_aicm: HRS-06, IAM-07
- ccss_v9: 1.04.2
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PS-05
- Clauses only: /api/v1/controls/PS-05?fields=mappings
- Page for people: /controls/ps-05/