PS.L2-3.9.1
Screen Individuals
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee PS.L2-3.9.1 in the reference catalog with its NIST cross-references
Official requirement
Screen individuals prior to authorizing access to organizational systems containing CUI.
Assessment objectives
a. individuals are screened prior to authorizing access to organizational systems containing CUI.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Screen people before authorizing their access to systems containing controlled information.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of security at your organization. You complete standard criminal background and credit checks of all individuals you hire before they can access CUI [a]. Your screening program follows appropriate laws, policies, regulations, and criteria for the level of access required for each position.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Personnel security policy; procedures addressing personnel screening; records of screened personnel; system security plan; other relevant documents or records
Common mistakes
Completing screening only after system access has already been granted.