PS.L2-3.9.2

Personnel Actions

Source and approval

CMMC Assessment Guide — Level 2 · Revision 2.13

Publisher approved · Complete cited source edition 2026-10-31

See PS.L2-3.9.2 in the reference catalog with its NIST cross-references

Official requirement

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Assessment objectives

a. a policy and/or process for terminating system access and any credentials coincident with personnel actions is established;

b. system access and credentials are terminated consistent with personnel actions such as termination or transfer; and

c. the system is protected during and after personnel transfer actions.

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Protect systems during and after personnel transfers or terminations.

Implementation example

Example from the source assessment guide (not a mandatory implementation): You are in charge of IT operations. Per organizational policies, when workers leave the company, you remove them from any physical CUI access lists. If you are not their supervisor, you contact their supervisor or human resources immediately and ask them to: • turn in the former employees’ computers for proper handling; • inform help desk or system administrators to have the former employees’ system access revoked; • retrieve the former employees’ identification and access cards; and • have the former employees attend an exit interview where you or human resources remind them of their obligations to not discuss CUI [b]. Example 2 An employee transfers from one working group in your company to another. Human resources team notifies IT of the transfer date, and the employee’ s new manager follows procedure by submitting a ticket to the IT help desk to provide information on the access rights the employee will require in their new role. IT implements the rights for the new position and revokes the access for the prior position on the official date of the transfer [c].

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): Personnel security policy; procedures addressing personnel transfer and termination; records of personnel transfer and termination actions; list of system accounts; records of terminated or revoked authenticators and credentials; records of exit interviews; other relevant documents or records

Common mistakes

Changing a personnel record without adjusting accounts, permissions, equipment, and access.

Apply this in your workspace →