Control statement
- a.Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization;
- b.Initiate [Organization-defined: transfer or reassignment actions] within [Organization-defined: time period following the formal transfer action];
- c.Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and
- d.Notify [Organization-defined: personnel or roles] within [Organization-defined: time period].
Discussion
Personnel transfer applies when reassignments or transfers of individuals are permanent or of such extended duration as to make the actions warranted. Organizations define actions appropriate for the types of reassignments or transfers, whether permanent or extended. Actions that may be required for personnel transfers or reassignments to other positions within organizations include returning old and issuing new keys, identification cards, and building passes; closing system accounts and establishing new accounts; changing system access authorizations (i.e., privileges); and providing for access to official records to which individuals had access at previous work locations and in previous system accounts.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Personnel Transfer as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to personnel risk, screening, agreements, transfer, termination, and access consequences.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- screening and suitability records
- access agreements
- transfer and termination checklists
- role change and offboarding evidence
Common failure patterns
- access persists after transfer or separation
- contractor lifecycle handled outside normal controls
- sensitive-role screening not risk based
- termination actions cannot be shown to occur promptly
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PS-05a.the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization;
- PS-05b.[Organization-defined: transfer or reassignment actions] are initiated within [Organization-defined: time period following the formal transfer action];
- PS-05c.access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer;
- PS-05d.[Organization-defined: personnel or roles] are notified within [Organization-defined: time period].
Examine
- Personnel security policy
- procedures addressing personnel transfer
- records of personnel transfer actions
- list of system and facility access authorizations
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- organizational personnel with account management responsibilities
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Organizational processes for personnel transfer
- mechanisms supporting and/or implementing personnel transfer notifications
- mechanisms for disabling system access/revoking authenticators
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.