Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

NIST SP 800-172 Enhanced CUI Protection Center

03.09 — Personnel Security

Study this CUI requirement family as a connected set of implementation decisions, evidence expectations, and assessment procedures.

2Active requirements
2Withdrawn records
4Parameters
6Assessment objectives

CUI requirement family

Personnel Security

Use this family as a planning boundary, but assess every applicable requirement against the real CUI system boundary, inherited services, organization-defined parameters, and operational evidence.

2 active2 withdrawnRevision 3
PS

Family catalog

Requirements and assessment procedures.

Withdrawn records remain available and link to the requirements where their intent was incorporated or addressed.

03.09.01EWithdrawn

Withdrawn requirement

Withdrawn NIST SP 800-172 Rev. 3 requirement 03.09.01E; use the recorded replacement relationships.

03.09.02EWithdrawn

Withdrawn requirement

Withdrawn NIST SP 800-172 Rev. 3 requirement 03.09.02E; use the recorded replacement relationships.

03.09.03EActive

Access Agreements

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored ou

03.09.04EActive

Citizenship Requirements

Organizations may determine that individuals who need access to CUI associated with a high value asset or critical program require U.S. citizenship status. This requirement enhances SP 800-171 requirement 03.09.01.