Your people controls mean little if the contractor with production access follows none of them. PS-7 External Personnel Security extends personnel requirements to outside providers. NIST 800-53 binds US federal systems, and others through contract terms. For everyone else it is a reference, and the contractor question shows up in almost every security questionnaire.
What it means in practice
The statement in the record has five parts:
- Establish personnel security requirements, including security roles and responsibilities for external providers.
- Require external providers to comply with your personnel security policies and procedures.
- Document those requirements.
- Require providers to notify you of personnel transfers or terminations of anyone who holds your credentials or badges or has privileges on your systems, within a time period you define.
- Monitor provider compliance.
The guidance defines an external provider broadly. It includes service bureaus, contractors, and other organizations that provide development, IT services, testing or assessment services, outsourced applications, and network or security management. It says organizations should write the personnel requirements into acquisition documents. Some providers have staff working at your facilities with your credentials, and they are the reason for the notification rule. You find out when a contractor's engineer leaves so you can end their access.
Evidence to collect
- The list of external providers with access to your systems or data, and the named people at each.
- Contract clauses or a security addendum that state the personnel requirements and the notification duty.
- Proof that provider staff completed the screening, training and agreements you require.
- Notices received from providers about leavers, and the matching access removal.
- Records of how you monitor compliance, such as an annual attestation or a review of the access list against the provider's roster.
Common gaps
- The vendor list lives in procurement, and the list of vendor accounts lives in IT. They do not match.
- The contract has no notification clause, so you learn of a departure when someone notices.
- Provider staff share one login.
- Monitoring is a questionnaire answered once at signing.
How to implement it
Start with an inventory of every outside person who holds a credential. Give each one a named account tied to a person, with an owner on your side. Put a short personnel security addendum in every services contract: screening, agreements signed, training, and notice of leavers within a stated number of hours.
Then review. Twice a year, send each provider the list of their people with access and ask them to confirm it. Remove anyone they do not confirm. The vendor risk review demo shows a way to organize that work.
Click through it at your own pace, or open it full screen.
Quick check
A contractor leaves the agency but the agency says nothing. Who is at fault?
Both, in practice. The control requires providers to notify you, but you also have to monitor. A periodic roster confirmation catches the silent departures.
Do we need to screen provider staff ourselves?
The control asks you to set the requirements and require compliance. Often the provider screens its own staff, and you collect confirmation.
