Screen Individuals

The requirement fixes when screening happens, not what it is.

The requirement prescribes no particular background check. Define the screening for each role that touches CUI, the controlled unclassified information your contract requires you to protect. Ground it in the position's risk, and apply it before the person can reach systems containing CUI. A criminal background check plus employment verification is a defensible baseline for general CUI access.

Your existing hiring process is most of the control.

Write down what already happens before an offer: background check, reference checks, verification of eligibility to work. Then add the one connection this requirement cares about: CUI system access is not authorized until the screening is complete. HR runs the screening. The control lives in the handoff to IT.

Sequence is the evidence.

Objective [a] turns on the words prior to. For each person with CUI access, keep records showing the screening finished before the account was authorized. Make account creation wait on an explicit all-clear from HR, and the evidence generates itself.

Handle existing employees by policy, not by re-running their hiring.

Apply the documented screening to everyone authorized after the policy exists. For staff who already hold access, record what screening they received at hire and state in the policy that it satisfies your standard. Re-screening a twenty year employee is a choice you can make, not one the requirement forces.

Export controlled CUI raises the screening floor.

Some CUI carries export control markings such as ITAR, the regulation covering defense articles and technical data. Export control law restricts access by nationality. For that CUI, screening also verifies the person is a U.S. person or holds the required authorization. Fold that verification into the same pre-access gate.