PS-9 Position Descriptions is the shortest control in the family. It asks you to incorporate security and privacy roles and responsibilities into organizational position descriptions. NIST 800-53 binds US federal systems and others by contract, and for everyone else it is a clear reference point.
What it means in practice
The guidance explains the reason. Writing security and privacy roles into each position makes the duties clear and links them to the role based training each role needs. If a job description says nothing, the person may not know they own an access review, a vulnerability queue or a customer data request.
This does not mean every job needs a long security section. A short, accurate statement per role is enough.
Evidence to collect
- Job descriptions or role profiles for security relevant roles, with the responsibilities written in.
- A responsibility matrix showing who owns each security and privacy task.
- The mapping from role to required training.
Common gaps
- Only the security lead has security duties in writing.
- Engineers and support staff handle customer data with no stated responsibility.
- Job descriptions were written years ago and never revisited.
How to implement it
List your security tasks and assign each to a role. Add two or three lines to each affected role profile. Review them when you review the role. Link each role to its training so PS-9 and your training records agree.
Quick check
Do all positions need security language?
The control says to incorporate roles into position descriptions. Scope it by risk. Roles with system or data access need it most.
