Check people before they get access, and close access when they leave. 2 requirements, 3.9.1 to 3.9.2, 1 of them worth 5 points.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
Screen people, for example with a background check, before giving them access to systems with DoD shipment information.
Usually applies to: Everyone you give access to systems with DoD shipment information, including seasonal and temporary staff.
Official wording: “Screen individuals prior to authorizing access to organizational systems containing CUI.”
When someone leaves or changes jobs, their access ends or changes right away: accounts disabled, keys and badges returned, company phone wiped.
Usually applies to: Every account, key, badge, door code and company phone, and company apps and data on personal phones, when someone leaves or changes jobs, including at the end of the season.
Official wording: “Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
