Personnel Security (PS): the 2 CMMC Level 2 requirements a subcontractor self-assesses
The Personnel Security family of NIST SP 800-171 Rev 2, as CMMC Level 2 numbers it: each requirement with the value it carries in the score, our statement of the clause, and the evidence an assessor asks for.
Where frameworks a subcontractor holds may supply evidence here
- ISO/IEC 27001:2022reuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
- SOC 2reuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
- NIST CSF 2.0reuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
- FedRAMP Moderatereuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
- CIS Controls v8reuse candidates 1 high, 0 medium; 1 of 2 need CMMC-specific evidence
- NIST SP 800-53 Rev 5reuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
- NIST SP 800-171 Rev 3reuse candidates 2 high, 0 medium; 0 of 2 need CMMC-specific evidence
The requirements
2CMMC L2 PS.L2-3.9.1Screen Individuals 3 points in the scoreScreen individuals before authorizing their access to systems containing CUI.
What an assessor asks to see: Screening criteria and procedure; Screening records for individuals granted access; Evidence screening precedes access authorization
Where subcontractors usually fall short: Access granted before screening completes; Contractors and vendors exempt from screening; Screening performed but not recorded
CMMC L2 PS.L2-3.9.2Personnel Actions 5 points in the scoreProtect systems containing CUI during and after personnel actions such as termination or transfer, including timely revocation of access.
What an assessor asks to see: Termination and transfer procedure covering access revocation and asset return; Records showing revocation timing against departure date; Evidence credentials and property are recovered
Where subcontractors usually fall short: Revocation delayed well beyond departure; Transfers leave accumulated access from the previous role; Physical access and assets not recovered