compliance controls are associated with this Policy definition 'Require notification of third-party personnel transfer or termination' (afd5d60a-48d2-8073-1ec2-6687e22f2ddd)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
PS-7 |
FedRAMP_High_R4_PS-7 |
FedRAMP High PS-7 |
Personnel Security |
Third-Party Personnel Security |
Shared |
n/a |
The organization:
a. Establishes personnel security requirements including security roles and responsibilities for third-party providers;
b. Requires third-party providers to comply with personnel security policies and procedures established by the organization;
c. Documents personnel security requirements;
d. Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and
e. Monitors provider compliance.
Supplemental Guidance: Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management. Organizations explicitly include personnel security requirements in acquisition-related documents. Third-party providers may have personnel working at organizational facilities with credentials, badges, or information system privileges issued by organizations. Notifications of third-party personnel changes ensure appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include, for example, functions, roles, and nature of credentials/privileges associated with individuals transferred or terminated.
Related controls: PS-2, PS-3, PS-4, PS-5, PS-6, SA-9, SA-21.
Control Enhancements: None.
References: NIST Special Publication 800-35. |
link |
5 |
| FedRAMP_Moderate_R4 |
PS-7 |
FedRAMP_Moderate_R4_PS-7 |
FedRAMP Moderate PS-7 |
Personnel Security |
Third-Party Personnel Security |
Shared |
n/a |
The organization:
a. Establishes personnel security requirements including security roles and responsibilities for third-party providers;
b. Requires third-party providers to comply with personnel security policies and procedures established by the organization;
c. Documents personnel security requirements;
d. Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and
e. Monitors provider compliance.
Supplemental Guidance: Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management. Organizations explicitly include personnel security requirements in acquisition-related documents. Third-party providers may have personnel working at organizational facilities with credentials, badges, or information system privileges issued by organizations. Notifications of third-party personnel changes ensure appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include, for example, functions, roles, and nature of credentials/privileges associated with individuals transferred or terminated.
Related controls: PS-2, PS-3, PS-4, PS-5, PS-6, SA-9, SA-21.
Control Enhancements: None.
References: NIST Special Publication 800-35. |
link |
5 |
| hipaa |
0111.02d2Organizational.2-02.d |
hipaa-0111.02d2Organizational.2-02.d |
0111.02d2Organizational.2-02.d |
01 Information Protection Program |
0111.02d2Organizational.2-02.d 02.03 During Employment |
Shared |
n/a |
Non-employees are provided the organization's data privacy and security policy requirements prior to accessing system resources and data. |
|
9 |
| hipaa |
1407.05k2Organizational.1-05.k |
hipaa-1407.05k2Organizational.1-05.k |
1407.05k2Organizational.1-05.k |
14 Third Party Assurance |
1407.05k2Organizational.1-05.k 05.02 External Parties |
Shared |
n/a |
The specific limitations of access, arrangements for compliance auditing, penalties, and the requirement for notification of third-party personnel transfers and terminations are identified in the agreement with the third-party. |
|
5 |
| hipaa |
1431.05k1Organizational.7-05.k |
hipaa-1431.05k1Organizational.7-05.k |
1431.05k1Organizational.7-05.k |
14 Third Party Assurance |
1431.05k1Organizational.7-05.k 05.02 External Parties |
Shared |
n/a |
The organization establishes personnel security requirements, including security roles and responsibilities, for third-party providers that are coordinated and aligned with internal security roles and responsibilities. |
|
5 |
| hipaa |
1455.05kCSPOrganizational.4-05.k |
hipaa-1455.05kCSPOrganizational.4-05.k |
1455.05kCSPOrganizational.4-05.k |
14 Third Party Assurance |
1455.05kCSPOrganizational.4-05.k 05.02 External Parties |
Shared |
n/a |
Third-party service providers demonstrate compliance with information security and confidentiality, access control, service definitions, and service-level agreements included in third-party contracts. Third-party reports, records, and services undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements. |
|
9 |
| ISO27001-2013 |
A.6.1.1 |
ISO27001-2013_A.6.1.1 |
ISO 27001:2013 A.6.1.1 |
Organization of Information Security |
Information security roles and responsibilities |
Shared |
n/a |
All information security responsibilities shall be clearly defined and allocated. |
link |
73 |
| ISO27001-2013 |
A.7.2.1 |
ISO27001-2013_A.7.2.1 |
ISO 27001:2013 A.7.2.1 |
Human Resources Security |
Management responsibilities |
Shared |
n/a |
Management shall require all employees and contractors to apply information security in accordance with the established policies and procedures of the organization. |
link |
26 |
| NIST_SP_800-53_R4 |
PS-7 |
NIST_SP_800-53_R4_PS-7 |
NIST SP 800-53 Rev. 4 PS-7 |
Personnel Security |
Third-Party Personnel Security |
Shared |
n/a |
The organization:
a. Establishes personnel security requirements including security roles and responsibilities for third-party providers;
b. Requires third-party providers to comply with personnel security policies and procedures established by the organization;
c. Documents personnel security requirements;
d. Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [Assignment: organization-defined time period]; and
e. Monitors provider compliance.
Supplemental Guidance: Third-party providers include, for example, service bureaus, contractors, and other organizations providing information system development, information technology services, outsourced applications, and network and security management. Organizations explicitly include personnel security requirements in acquisition-related documents. Third-party providers may have personnel working at organizational facilities with credentials, badges, or information system privileges issued by organizations. Notifications of third-party personnel changes ensure appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include, for example, functions, roles, and nature of credentials/privileges associated with individuals transferred or terminated.
Related controls: PS-2, PS-3, PS-4, PS-5, PS-6, SA-9, SA-21.
Control Enhancements: None.
References: NIST Special Publication 800-35. |
link |
5 |
| NIST_SP_800-53_R5 |
PS-7 |
NIST_SP_800-53_R5_PS-7 |
NIST SP 800-53 Rev. 5 PS-7 |
Personnel Security |
External Personnel Security |
Shared |
n/a |
a. Establish personnel security requirements, including security roles and responsibilities for external providers;
b. Require external providers to comply with personnel security policies and procedures established by the organization;
c. Document personnel security requirements;
d. Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [Assignment: organization-defined time period]; and
e. Monitor provider compliance with personnel security requirements. |
link |
5 |