PS-2, Position Risk Designation, asks you to assign a risk designation to all organizational positions, set screening criteria for people filling them, and review and update the designations on a schedule you define. The record says the designations follow Office of Personnel Management policy for federal positions. 800-53 binds federal systems and others by contract. Companies can use the same idea to decide which roles get deeper background checks.
What it means in practice
The Position Designation System, per the record, assesses duties and responsibilities to find how much damage misconduct by the person in that position could cause to the efficiency or integrity of the service. It also determines whether the position has potential for material adverse effect on national security.
For a company the practical version is a role table. Rate each position by the damage a bad actor in it could do: access to production, customer data, money movement, signing keys. Then attach screening rules to each rating.
The statement has three parts and an auditor will look for all three: designations, criteria and review.
Evidence to collect
- A table of positions with a risk level for each
- Screening criteria per level, such as background check type
- Records of screening done for a sample of hires
- Review dates and approvers
Common gaps
- Only new hires are rated, existing roles are not
- Everyone in engineering gets the same rating regardless of access
- Contractors and temps are left out
- Designations are never reviewed when a role changes scope
How to implement it
- List every position, including contractors.
- Rate by potential harm, using access to systems and data as the guide.
- Define screening for each rating with HR and legal, since screening law varies by place.
- Review ratings yearly and when a role changes.
Quick check
Does PS-2 require background checks?
It requires screening criteria for each risk designation. What the criteria contain is for you to define, within the law where you operate.
