Personnel Security — CISSP Study Guide

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

The employment lifecycle is the model for every personnel control
Hiring: designate the position's risk, then screen to it, then sign agreements
Transfer and termination: keep access matched to need, revoke promptly on exit
Insider-threat controls: separation of duties, least privilege, rotation, vacation
Third parties and policy compliance: vendors, consultants, contractors
Exam-pattern recognition: how personnel-security questions are framed

Lifecycle stage	Control	Core action	Most-tested point
Define the role	PS-2 Position Risk Designation	Assign a risk level to the position; set screening criteria from it	Screening depth follows position risk, not a flat standard
Hire	PS-3 Personnel Screening	Screen (background investigation) before authorizing access; rescreen per defined conditions	Screen before access is granted, deeper for higher-risk positions
Grant access	PS-6 Access Agreements	Sign NDA, acceptable use, rules of behavior, conflict-of-interest	Agreements are signed prior to access, not after
Move (internal)	PS-5 Personnel Transfer	Re-evaluate and modify access to match the new role's need	Remove no-longer-needed access; transfers cause privilege creep
Leave	PS-4 Personnel Termination	Disable access, revoke credentials, exit interview, retrieve property	Promptly; for-cause = disable access before notifying the person
Third party	PS-7 External Personnel Security	Bind contractors to your policy; require notice of their staff changes	Contractor offboarding is the vendor's contractual duty to report
Enforce / deter	AC-5 SoD, AC-6 least privilege, rotation, vacation	Split duties, grant minimum, rotate jobs, force vacations	SoD prevents fraud without collusion; admin of access ≠ admin of audit

Cheat sheet

Personnel security manages trust across the whole employment lifecycle
Screening depth follows the position's risk designation, not a flat standard
Screen the candidate before authorizing access, never after
Access agreements are signed before access is granted
The hiring order is fixed: designate risk, screen, sign agreements, then grant
On termination, run the PS-4 checklist immediately: disable, revoke, exit interview, retrieve
The exit interview reminds the departing employee of continuing NDA obligations
For a for-cause termination, disable access before notifying the person
Treat a transfer as re-onboarding to stop privilege creep
Separation of duties stops fraud that would otherwise need no collusion
Whoever administers access control must not also administer the audit logs
Mandatory vacation and job rotation detect fraud by trusted insiders
Contractors and consultants are bound to your personnel security through the contract
Personnel control of a contractor is distinct from supply-chain risk of the supplier
Personnel sanctions must run through a formal, documented process
Background-check scope is bounded by law and privacy, not just by role risk

Unlock with Premium — includes all practice exams and the complete study guide.