Catalog of Control Systems Security: Recommendations for Standards Developers

2.3.2.4 References
NIST SP 800-53r3 PS-2
API 1164r2 3.1
NERC CIPS CIP 003-3, B.R5.1, B.5.1.1
NRC RG 5.71 App. B.1.21
2.3.3 Personnel Screening
2.3.3.1 Requirement
The organization screens individuals requiring access to the control system before access is
authorized.
2.3.3.2 Supplemental Guidance
The organization maintains consistency between the screening process and organizational policy,
regulations, guidance, and the criteria established for the risk designation of the assigned position.
Basic screening requirements include:
1. Past 5 years of employment
2. Past 5 years of education, with verification of the highest degree received
3. Past 3 years of residency
4. References
5. Past 5 years of law enforcement records.
2.3.3.3 Requirement Enhancements
The organization rescreens individuals with access to organizational control systems based on a
defined list of conditions requiring rescreening and the frequency of such rescreening.
2.3.3.4 References
NIST SP 800-53r3 PS-3
API 1164r2 Annex A
NERC CIPS CIP 004-3, B.R5.1, B.R5.1.2
NRC RG 5.71 App. B.1.21
2.3.4 Personnel Termination
2.3.4.1 Requirement
When an employee is terminated, the organization revokes logical and physical access to control
systems and facilities and ensures all organization-owned property is returned and that
organization-owned documents and data files relating to the control system that are in the employee’s
possession are transferred to the new authorized owner within the organization. Complete execution of
this control occurs within 24 hours for employees or contractors terminated for cause.
2.3.4.2 Supplemental Guidance
Organization-owned property includes system administration manuals, keys, identification cards,
building passes, computers, cell phones, and personal data assistants. Organization-owned documents
include field device configuration and operational information, control system network documentation.
10