Personnel Actions

Official Source Material

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

Determine if:

[a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established;
[b] system access and credentials are terminated consistent with personnel actions such as termination or transfer; and
[c] the system is protected during and after personnel transfer actions.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Write the offboarding procedure first. It is objective [a] verbatim.

A one page procedure naming who tells whom, what gets disabled, what gets collected, and by when satisfies [a] and drives everything else. PS.L2-3.9.2 is a five point requirement under 32 CFR 170.24. Under 32 CFR 170.21, a five point requirement can never sit on a POA&M, the plan of action that buys time for unfinished requirements. A missing procedure is therefore expensive.

Disable access the day employment ends, and earlier when the termination is for cause.

Disable the account in your identity provider, the service that checks user sign-ins. Revoke active sessions so open logins die with the account. Collect devices and badges, and change any shared credentials the person knew. The assessment guide allows accounts to be disabled before the individual is notified when the termination is for cause. Coordinate the disable time with HR instead of acting after the fact.

Transfers are the half of this requirement that fails quietly.

Objective [c] covers the employee who stays but changes roles. Remove the old role's access on the transfer date instead of stacking new access on top. CUI is the controlled unclassified information your contract requires you to protect. A move into a role without CUI contact means CUI access ends, including physical access to spaces where CUI lives.

The control is the HR to IT signal, so build the trigger and the backstop.

Access that outlives employment is what happens when IT learns of a departure late. Make the HR action open an IT ticket, by automation or by checklist. Compare active accounts against the current roster on a schedule, so anything the trigger missed gets caught.

The exit conversation is part of protecting CUI.

Remind the departing person that nondisclosure obligations cover CUI after employment, and record that the reminder happened. When no exit interview is possible, as with job abandonment, run the access and property steps anyway and document why the interview did not occur.

What falls short

HR paperwork completed while the account stays active until someone remembers to call IT. Objective [b] asks that access termination is consistent with the personnel action, and an open ended lag is not.
Disabling the named account while shared passwords the person knew stay unchanged. Credentials include everything the person could still use, so [b] is only partly met.

Edge cases

A short temporary reassignment does not demand the full treatment. The assessment guide applies this requirement to personnel actions that are permanent or of extended duration, so document the threshold your process uses.
Extended leave is not a termination, but a long absence with live access is a risk you can close the same way. Disable the account for the duration and restore it on return.