Before anyone touches your systems, they should have agreed in writing to the rules. That is PS-6 Access Agreements. NIST 800-53 binds US federal systems and, through contracts, some other organizations. For the rest of us it is a reference that maps neatly onto an ordinary onboarding packet.
What it means in practice
The statement asks you to develop and document access agreements, review and update them on a schedule you define, and verify two things. People sign an appropriate agreement before they get access. And they sign again when the agreement is updated or at a frequency you define.
The guidance lists what counts: nondisclosure agreements, acceptable use agreements, rules of behavior and conflict of interest agreements. A signed agreement includes an acknowledgment that the person has read, understands and agrees to follow the constraints. Electronic signatures are fine unless your policy forbids them.
The record lists three enhancements: PS-6.1 Information Requiring Special Protection, PS-6.2 Classified Information Requiring Special Protection, and PS-6.3 Post employment Requirements. Most private companies only need the base control.
Evidence to collect
- The current templates, each with a version and review date.
- A signed copy for a sample of employees and contractors.
- Signature dates compared with the date of first system access.
- The log of the last round of new signatures after a template change.
- The review record showing someone looked at the templates on schedule.
Common gaps
- Agreements are signed on day one, but accounts were created the week before.
- The template changed and nobody asked for new signatures.
- Contractors sign a contract but not the acceptable use rules.
- Signed copies live in email and cannot be found.
How to implement it
Put the signature into onboarding as a blocking step. Use an e-signature tool that stores a timestamped record. Version your templates, and when you change one, trigger a campaign to collect new signatures with a deadline. Policy acknowledgment features in most compliance tools make that tracking easier.
Quick check
Is a clause in the employment contract enough?
It can be, if it covers the topics and the person acknowledges the constraints for the specific systems. Many teams keep a separate acceptable use agreement because it is easier to update and collect again.
