NIST 800-53 PS-1 Personnel Security Policy: What to Write

PS-1, Policy and Procedures, is the first control of the Personnel Security family. It asks you to develop, document and share a personnel security policy and procedures with the roles you define, to name an official to manage them, and to review and update both on a schedule and after defined events. The scheduling and recipient details are parameters you set.

800-53 binds federal systems and others by contract. For a company, this is the policy an auditor asks for before looking at any evidence for screening, termination or transfers.

What it means in practice

The statement says the policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities and compliance. It must also be consistent with applicable laws and standards. Procedures describe how the policy and the associated controls are carried out.

The record gives useful guidance. Policy can be part of the general security and privacy policy or can be several policies. Procedures can exist for programs, for business processes and for systems, and can be written for the person or role that does the task. They can live in system plans or in separate documents.

It names events that should trigger an update: assessment or audit findings, security incidents or breaches, and changes in applicable laws or standards. And it ends with a blunt line that is worth repeating. Simply restating controls does not constitute an organizational policy or procedure.

That last point catches many teams. A policy that says we screen personnel before access restates a control. A policy that says who screens, which roles need which check, what happens when a check fails and who signs off is a policy.

The rest of the PS family gives you the topics the personnel policy should touch, such as position risk designation (PS-2), screening, termination, transfer and sanctions. Check the exact list against the controls you adopt.

Evidence to collect

• The personnel security policy with approval and date
• Procedures for each topic, including owners and steps
• The named official responsible for them
• Distribution records, such as acknowledgments
• Review history and the triggers that caused updates
• Evidence the procedures are followed, such as a sample of screening files

Common gaps

• The policy repeats the control text with no local detail
• No procedures exist, only a policy
• The official named has left
• Updates never follow incidents or audit findings
• HR and security keep separate documents that disagree

How to implement it

• Draft the policy with HR, legal and security together.
• Write procedures for onboarding checks, role changes and departures, with owners.
• Name the manager of the documents and put review on the calendar.
• Add the three update triggers from the record to your change process.
• Collect acknowledgments and sample the procedures yearly.

Quick check

Sources

• NIST SP 800-53 Rev 5, PS-1 Policy and Procedures
• NIST OSCAL catalog for SP 800-53 Rev 5