People rarely lose access when they move to a new team. They gain it. PS-5 Personnel Transfer exists to stop that creep. NIST 800-53 binds US federal systems, and reaches other organizations through contracts. For everyone else it is a reference, and the problem it describes is common in every company.
What it means in practice
When someone is reassigned or transferred, the statement asks you to do four things:
- Review and confirm the ongoing operational need for current logical and physical access.
- Initiate transfer or reassignment actions within a time period you define.
- Modify access authorizations to match the change in operational need.
- Notify defined personnel or roles within a time period you define.
The guidance says the control applies when a move is permanent or lasts long enough to warrant action. Typical actions include returning old keys and badges, closing accounts and opening new ones, and changing privileges. Think of it as a smaller offboarding for the old role plus an onboarding for the new one.
Evidence to collect
- The transfer procedure, with the time limit you chose.
- HR records of role changes in the audit period.
- For a sample of those people, the access list before and after the move, and the ticket that removed what no longer fit.
- Notifications sent to the system owners affected.
- Physical access changes, where they apply.
Common gaps
- The new manager requests new access, but nobody requests removal of the old.
- Role changes are not captured as events anywhere, so no review is triggered.
- Group memberships carry over for years.
- Temporary project access never expires.
How to implement it
Make a role change an HR event that opens a ticket. The ticket asks the old manager which access to remove and the new manager what to add. Use role based groups where you can, so moving someone is a group change rather than dozens of individual grants.
Back this up with a periodic access review, which catches whatever the ticket missed. Keep the before and after lists with the ticket. That pair is the evidence.
Quick check
Does a two week project assignment count as a transfer?
Probably not. The guidance applies to moves that are permanent or long enough to warrant action. Still, time box any temporary access so it expires on its own.
