Information Technology (IT)

Personnel Security (PS) Standard 

December 15, 2023 

U.S. Department of Education (ED) 

Office of the Chief Information Officer (OCIO)

Information Assurance Services (IAS)

Questions about the policies outlined in this document should be directed to Information

Assurance Services (IAS) at IAS_Governance@ed.gov.
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 i 

APPROVAL

____________________________________________________ 

Steven Hernandez

Director, IAS/Chief Information Security Officer (CISO)
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 ii

Revision History

The table below identifies all changes that have been incorporated into this document. 

Version Date Summary of Changes

1.0 1/18/2022

Initial draft of new standard which combines

National Institute of Standards and Technology 

(NIST) Special Publication (SP) 800-53, Revision 5 

controls, including ED specific control parameter

values, with existing policy standards.

1.1 1/31/2022

Update to incorporate feedback from IAS; address

new security measures required by Executive Order

(EO) 14028, including Office of Management and

Budget (OMB) regulations and memoranda and

updated National Institute of Standards and 

Technology (NIST) guidance issued to comply with

the EO.

1.2 1/31/2023

Annual review; update broken links and add footnote

to High Value Asset (HVA) control reference in

Section 2. Remove PS-1 from privacy baseline. 

5.3 12/15/2023

Aligned document major version number to align 

with NIST SP 800-53 revision number. Clean up 

formatting and numbering throughout and update 

broken links. Section 2, Standards was updated to 

include the description of incorporating 

organizationally defined parameters (ODP) for 

controls that may be necessary from external control 

overlays (e.g., High Value Assets [HVA]). Inserted 

references to NIST SP 800-53B tailoring guidance. 

Updated Section 4, Acronyms as appropriate. 

Updated language in controls: PS-01, PS-02, PS-03, 

PS-04(02), PS-05 and PS-08. Added control: PS06(03). Added “leading zeros” to control identifiers 

in alignment with patch release of NIST SP 800-53 

(Release 5.1.1) to applicable controls, enhancements, 

and overlays. 
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 iii

Table of Contents

1 INTRODUCTION................................................................................................................... 1

1.1 Purpose ............................................................................................................................. 1

1.2 Scope ................................................................................................................................ 1

2 STANDARDS ......................................................................................................................... 2

2.1 PS-01 Policy and Procedures (L, M, H) ........................................................................... 2

2.2 PS-02 Position Risk Designation (L, M, H) ..................................................................... 3

2.3 PS-03 Personnel Screening (L, M, H) .............................................................................. 4

2.4 PS-04 Personnel Termination (L, M, H) .......................................................................... 4

2.5 PS-05 Personnel Transfer (L, M, H) ................................................................................ 5

2.6 PS-06 Access Agreements (P, L, M, H)........................................................................... 5

2.7 PS-07 External Personnel Security (L, M, H) .................................................................. 5

2.8 PS-08 Personnel Sanctions (L, M, H) .............................................................................. 6

2.9 PS-09 Position Descriptions (L, M, H) ............................................................................ 6

3 RISK ACCEPTANCE/POLICY EXCEPTIONS .................................................................... 7

4 ACRONYMS........................................................................................................................... 8

APPENDIX A: BASELINE CONTROL PARAMETER SUMMARY........................................ 10
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 1 

1 INTRODUCTION

This governance document establishes U.S. Department of Education (ED or Department) 

information technology (IT) personnel security controls standards necessary to improve the

efficiency of operation or security of Department information systems and comply with Federal

laws, regulations, Executive Orders (EO), Emergency Orders, Binding Operational Directives

(BOD), and Department Administrative Communications System Directives (ACSD) and 

Handbooks. In doing so, these standards supersede any prior governance documentation 

establishing such standards. 

1.1 Purpose

The Federal Information Security Modernization Act (FISMA)1 and implementing regulation 

Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic 

Resource2

, requires each federal agency to develop, document, and implement an agency-wide

program to provide information security for the information and information systems that support 

the operations and assets of the agency, including those provided or managed by another agency, 

contractor, or other source, and services that are either fully or partially provided, including 

agency-hosted, outsourced, and cloud-based solutions. Federal Information Processing Standards 

(FIPS) Publication (PUB) 200, Minimum Security Requirements for Federal Information and 

Information Systems3, mandates the use of National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53, Security and Privacy Controls for Information Systems and 

Organizations4, as amended, as baseline information system controls. 

1.2 Scope

These standards apply to all information and information systems that support the operations and

assets of the Department, including those provided or managed by another agency, contractor, or

other source, as well as services that are either fully or partially provided, including Departmenthosted, outsourced, and cloud-based solutions. Principal Offices, employees, contractors, external 

service providers and system users are required to comply with these personnel security standards. 

1 Public Law 113-283-Dec. 18, 2014, https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf 2 Office of Management and Budget (OMB) Circular A-130, https://www.whitehouse.gov/wpcontent/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf

3 FIPS 200, https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.200.pdf 4 NIST SP 800-53, https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 2 

2 STANDARDS

The Department standards for IT personnel security controls are organized to follow the order in

which controls are presented in the current version of NIST SP 800-53. To define a control baseline

for Department information systems, a FIPS PUB 199 categorization level (e.g., Low [L], 

Moderate [M] and High [H]) is assigned to each requirement. This designator indicates a 

requirement applies to information systems categorized at that FIPS PUB 199 impact-level.

Designators are also used to indicate when NIST SP 800-53 Privacy (P) baseline controls are

required. To manage risk to within the Department’s risk tolerance and appetite, control overlays 

are provided when the Department requires implementation of control(s) that are not required by 

the FIPS PUB 199 impact-level or privacy baseline. 

In addition to the controls required by this standard, High Value Assets (HVAs) must implement

and comply with the current version of the HVA Control Overlay5 issued and maintained by the 

U.S. Department of Homeland Security (DHS), Cybersecurity & Infrastructure Security Agency 

(CISA). Systems that process federal tax return information (FTRI) must implement and comply 

with the Internal Revenue Service (IRS) Publication 10756

, Tax Information Security Guidelines 

for Federal, State and Local Agencies: Safeguards for Protecting Federal Tax Returns and Return 

Information. Systems that are Federal Risk and Authorization Management Program (FedRAMP) 

authorized must implement and comply with the FedRAMP identified baselines7

. 

Throughout the standard, there are controls captured that have not been scoped to any specific 

security or privacy baseline. This is intentional as all controls for identified external overlays and 

baselines (e.g., FedRAMP, IRS, HVA), that may apply to systems within the Department, have 

been incorporated into the standard. This ensures the organization defined parameters (ODPs) for 

controls within the Department have been clearly defined in a consistent manner. 

This standard directly supports the Department’s integration of the NIST Cyber Security

Framework (CSF) and NIST Privacy Framework (PF) by using business drivers to guide 

cybersecurity activities and considering cybersecurity risks as part of the Department’s risk

management processes. Refer to APPENDIX A: BASELINE CONTROL PARAMETER SUMMARY

for a summary of controls by baseline and corresponding NIST CSF and NIST PF categories and 

subcategories. 

2.1 PS-01 Policy and Procedures (L, M, H)

The Department shall develop, document, and disseminate to all ED employees, contractors, and

users authorized to access to ED information systems, or systems operated or maintained on behalf 

of ED, or ED information as defined in ACSD-OCIO-0048

, Cybersecurity Policy a Department5 https://www.cisa.gov/publication/high-value-asset-control-overlay 6 IRS Publication 1075 https://www.irs.gov/pub/irs-pdf/p1075.pdf 7 FedRAMP baselines https://www.fedramp.gov/baselines/ 8 Also known as OCIO: 3-112
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 3 

level IT Personnel Security policy (e.g., ACSD-OFO-0319, Physical Security Program; ACSDOFO-01710, Federal Employee Personnel Security Screening; ACSD-OFO-01311, Contractor 

Employee Personnel Security Screenings; ACSD-OFO-01112 Clearance of Personnel for 

Separation or Transfer; and this document) that:

a. addresses purpose, scope, roles, responsibilities, management commitment, coordination

among organizational entities, and compliance; and 

b. is consistent with applicable laws, executive orders, directives, regulations, policies,

standards, and guidelines. 

c. authorizes the Department Chief Information Security Officer (CISO) and Department

Chief Information Officer (CIO) to issue subordinate standards, procedures, and memos,

with the same authority and enforcement as ACSD-OCIO-004, Cybersecurity Policy. 

The Department CISO in conjunction with Physical Security Officer are designated to manage the

development, documentation, and dissemination of the Department-level IT personnel security

policy. 

This policy shall be reviewed and updated annually (i.e., each fiscal year) and following the 

identification of evolving threats, issuance of new or significantly changed existing Federal laws,

executive orders, directives, regulations, and ED policies, identification of emerging technology 

and information technology service delivery models and determination that adjustments are

deemed necessary to improve its effectiveness based upon feedback from Principal Office

personnel. 

Principal Office (PO) Information System Owners (ISO) and Information System Security

Officers (ISSOs) are required to manage the development, documentation, and dissemination of

system specific procedures to facilitate the implementation of the Department’s IT Personnel 

Security policy and the associated controls. The ISO and ISSO shall review IT Personnel Security

procedures annually (i.e., each fiscal year) and following the identification of evolving threats,

issuance of new or significantly changed existing Federal laws, executive orders, directives,

regulations, and ED policies, identification of emerging technology and information technology 

service delivery models and determination that adjustments are deemed necessary to improve its

effectiveness based upon feedback from Principal Office personnel. 

2.2 PS-02 Position Risk Designation (L, M, H)

a. Assign a risk designation to all organizational positions;

b. Establish screening criteria for individuals filling those positions; and 

9 Also known as OM: 4-114 10 Also known as OFO-O: 5-102 11 Also known as OFO-O: 5-101 1212 Also known as OM: 3-104
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 4 

c. Review and update position risk designations: 

1. Every five (5) years for federal employees; and 

2. During contract solicitation for contractors in accordance with ACSD-OFO-01313, 

Contractor Employee Personnel Security Screenings. 

2.3 PS-03 Personnel Screening (L, M, H)

a. Screen individuals prior to authorizing access to the system; and

b. Rescreen individuals in accordance with requirements specified in ACSD-OFO-01714

Federal Employee Personnel Security Screening and ACSD-OFO-013 Contractor 

Employee Personnel Security Screenings.

2.3.1 PS-03(03) Personnel Screening | Information with Special Protection Measures

a. Screen individuals prior to authorizing access to the system; and

b. Rescreen individuals in accordance with defined conditions based on the data access 

requirements for screening and frequency of rescreening. 

2.4 PS-04 Personnel Termination (L, M, H)

Upon termination of individual employment: 

a. Disable system access as soon as possible but no later than one business day after notifying 

the Help Desk;

b. Terminate or revoke any authenticators and credentials associated with the individual; 

c. Conduct exit interviews that include a discussion of topics to include but not limited to: 

1. Security constraints;

2. Proper accountability;

3. Nondisclosure agreements; and 

4. Limitations on future employment. 

d. Retrieve all security-related organizational system-related property; and 

e. Retain access to organizational information and systems formerly controlled by terminated

individual. 

2.4.1 PS-04(02) Personnel Termination | Automated Actions (H)

Use ED approved automated mechanisms to: 

13 Also known as OFO-O: 5-101 14 Also known as OFO-O: 5-102
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 5 

a. Notify personnel with separation responsibilities as defined in the ED ACSD-OFO-01115

Clearance of Personnel for Separation or Transfer of individual termination actions; and

b. Disable access to system resources.

2.5 PS-05 Personnel Transfer (L, M, H)

a. Review and confirm ongoing operational need for current logical and physical access

authorizations to systems and facilities when individuals are reassigned or transferred to

other positions within the organization; 

b. Initiate ED transfer or reassignment actions within five (5) business days following the 

formal transfer action;

c. Modify access authorization as needed to correspond with any changes in operational need

due to reassignment or transfer; and 

d. Notify ED personnel and/or roles as defined in the ACSD-OFO-011 Clearance of 

Personnel for Separation or Transfer within twenty-four (24) hours. 

2.6 PS-06 Access Agreements (P, L, M, H)

a. Develop and document access agreements for organizational systems;

b. Review and update the access agreements at least annually (i.e., each fiscal year); and

c. Verify that individuals requiring access to organizational information and systems:

1. Sign appropriate access agreements prior to being granted access; and 

2. Re-sign access agreements to maintain access to organizational systems when

access agreements have been updated or at least annually (i.e., each fiscal year).

2.6.1 PS-06(03) Access Agreements | Post-Employment Requirements

a. Notify individuals of applicable, legally binding post-employment requirements for 

protection of organizational information; and

b. Require individuals to sign an acknowledgment of these requirements, if applicable, as part 

of granting initial access to covered information. 

2.7 PS-07 External Personnel Security (L, M, H)

a. Establish personnel security requirements, including security roles and responsibilities for 

external providers; 

b. Require external providers to comply with personnel security policies and procedures 

established by the organization; 

15 Also known as OM: 3-104
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 6 

c. Document personnel security requirements;

d. Require external providers to notify the Contracting Officer Representative (COR), key 

personnel, and personnel with privileged access, of any personnel transfers or terminations

of external personnel who possess organizational credentials and/or badges, or who have 

system privileges within twenty-four (24) hours to forty-eight (48) hours; and 

e. Monitor provider compliance with personnel security requirements.

2.8 PS-08 Personnel Sanctions (L, M, H)

a. Employ a formal sanctions process for individuals failing to comply with established

information security and privacy policies and procedures; and 

b. Notify all appropriate personnel and offices, to include but not limited to Personnel

Security, Office of Finance and Operations (OFO) Office of Human Resources (OHR), 

OCIO, COR and/or supervisors or employee representatives, as appropriate within twentyfour (24) hours to forty-eight (48) hours when a formal employee sanctions process is

initiated, identifying the individual sanctioned and the reason for the sanction. 

2.9 PS-09 Position Descriptions (L, M, H)

Incorporate security and privacy roles and responsibilities into organizational position

descriptions. 
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 7 

3 RISK ACCEPTANCE/POLICY EXCEPTIONS 

Deviations from the Department policies, Instructions, Standards, Procedures or Memos must be

approved and documented through the Department’s Risk Acceptance process. Deviations that

introduce additional risks to the enterprise must be submitted through the Department Risk

Acceptance Form (RAF) and must be approved by the ED CISO (as delegated). Requests must 

justify the reason for the deviation(s)/exception(s) as well as the compensating security controls

implemented to secure the device or information, if applicable. Policy deviations that do not 

introduce additional risks do not need to be submitted through the Department RAF but will need

to be approved by the Department CISO (as delegated).
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 8 

4 ACRONYMS

Acronym Definition

BOD Binding Operational Directive

CIO Chief Information Officer

CISA Cybersecurity & Infrastructure Security Agency

CISO Chief Information Security Officer

COR Contracting Officer Representative

CSF Cybersecurity Framework

DE Detect

DE.CM Security Continuous Monitoring

DE.DP Detection Processes

Department U.S. Department of Education

DHS U.S. Department of Homeland Security

ED U.S. Department of Education

EO Executive Order

FedRAMP Federal Risk and Authorization Management Program

FIPS Federal Information Process Standard

FISMA Federal Information Security Modernization Act

FTRI Federal Tax Return Information

GV.AT-P Awareness and Training

GV.MT-P Monitoring and Review

GV.PO-P Governance Policies, Processes, and Procedures

GV-P Govern-P 

H High

HVA High Value Asset

IAS Information Assurance Services

ID Identify

ID.AM Asset Management

ID.GV Governance

ID.SC Supply Chain Risk Management

ID-P Identify-P 

IRS Internal Revenue Service

ISO Information System Owner

ISSO Information System Security Officer

IT Information Technology

L Low

M Moderate

NIST National Institute of Standards and Technology

OCIO Office of the Chief Information Officer

ODP Organizationally Defined Parameters

OFO Office of Finance and Operations

OHR Office of Human Resources

OMB Office of Management and Budget

P Privacy

PF Privacy Framework
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 9 

Acronym Definition

PO Principal Office

PR Protect

PR.AC Identity Management, Authentication and Access Control

PR.AC-P Identity Management, Authentication, and Access Control

PR.AT Awareness and Training

PR.DS Data Security

PR.DS-P Data Security

PR.IP Information Protection Processes and Procedures

PR.PO-P Data Protection Policies, Processes, and Procedures

PR-P Protect-P 

PS Personnel Security Family

PUB Publication

RAF Risk Acceptance Form

SP Special Publication
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 10 

APPENDIX A: BASELINE CONTROL PARAMETER 

SUMMARY

The applicability for each baseline control parameter is shown below. 

Control

Identifier

Control/Control

Enhancement) Name

Privacy

Baseline

Security

Control

Baseline

Low

Security

Control

Baseline

Moderate

Security

Control

Baseline

High

CSF and

Privacy

Category

CSF and

Privacy

Subcategory

PS-01 Policy and Procedures X X X PR.IP,

DE.DP,

GV.PO-P,

GV.MT-P,

PR.PO-P 

PR.IP-11,

DE.DP-2,

GV.PO-P1,

GV.PO-P3,

GV.PO-P5,

GV.MT-P2,

GV.MT-P6,

PR.PO-P9

PS-02 Position Risk Designation X X X PR.IP,

PR.PO-P 

PR.IP-11,

PR.PO-P9

PS-03 Personnel Screening X X X PR.AC,

PR.IP,

PR.PO-P,

PR.AC-P 

PR.AC-6,

PR.IP-11,

PR.PO-P9,

PR.AC-P6

PS-03(01) Classified Information PR.AC, 

PR.IP, 

PR.PO-P, 

PR.AC-P 

PR.AC-6, 

PR.IP-11, 

PR.PO-P9, 

PR.AC-P6

PS-03(02) Formal Indoctrination PR.AC, 

PR.IP, 

PR.PO-P, 

PR.AC-P 

PR.AC-6, 

PR.IP-11, 

PR.PO-P9, 

PR.AC-P6

PS-03(03) Information with Special 

Projection Measures

PR.AC, 

PR.IP, 

PR.PO-P, 

PR.AC-P 

PR.AC-6, 

PR.IP-11, 

PR.PO-P9, 

PR.AC-P6

PS-03(04) Citizenship Requirements PR.AC, 

PR.IP, 

PR.PO-P, 

PR.AC-P 

PR.AC-6, 

PR.IP-11, 

PR.PO-P9, 

PR.AC-P6

PS-04 Personnel Termination X X X PR.IP,

PR.PO-P 

PR.IP-11,

PR.PO-P9

PS-04(01) Post-Employment 

Requirements

PR.IP, 

PR.PO-P 

PR.IP-11, 

PR.PO-P9

PS-04(02) Personnel Termination | 

Automated Actions

X PR.IP, 

PR.PO-P 

PR.IP-11, 

PR.PO-P9

PS-05 Personnel Transfer X X X PR.IP, 

PR.PO-P 

PR.IP-11, 

PR.PO-P9

PS-06 Access Agreements X X X X PR.DS, 

PR.IP, 

PR.PO-P, 

PR.DS-P 

PR.DS-5, 

PR.IP-11, 

PR.PO-P9, 

PR.DS-P5

PS-06(02) Classified Information 

Requiring Special Projection

PR.DS, 

PR.IP, 

PR.DS-5, 

PR.IP-11, 
Information Technology (IT) Personnel Security (PS) Standard 

Version 5.3 11 

Control

Identifier

Control/Control

Enhancement) Name

Privacy

Baseline

Security

Control

Baseline

Low

Security

Control

Baseline

Moderate

Security

Control

Baseline

High

CSF and

Privacy

Category

CSF and

Privacy

Subcategory

PR.PO-P, 

PR.DS-P 

PR.PO-P9, 

PR.DS-P5

PS-06(03) Post-Employment

Requirements

PR.DS, 

PR.IP, 

PR.PO-P, 

PR.DS-P 

PR.DS-5, 

PR.IP-11, 

PR.PO-P9, 

PR.DS-P5

PS-07 External Personnel Security X X X ID.AM, 

ID.GV, 

ID.SC, 

PR.AT, 

PR.IP, 

DE.CM, 

ID.DE-P, 

GV.PO-P, 

GV.AT-P, 

PR.PO-P 

ID.AM-6, 

ID.GV-2, 

ID.SC-4, 

PR.AT-3, 

PR.IP-11, 

DE.CM-6, 

ID.DE-P5, 

GV.PO-P3, 

GV.AT-P4, 

PR.PO-P9

PS-08 Personnel Sanctions X X X PR.IP, 

PR.PO-P 

PR.IP-11, 

PR.PO-P9

PS-09 Position Descriptions X X X ID.GV, 

PR.IP, 

GV.PO-P, 

PR.PO-P 

ID.GV-2, 

PR.IP-11, 

GV.PO-P3, 

PR.PO-P9