How many SPRS points can the Personnel Security family cost?

Up to 8 of the 313 points a score can lose: 1 worth 5 points and 1 worth 3.

Which Personnel Security requirements can go on a CMMC POA&M?

None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. Every one of them is worth more than 1 point.

NIST 800-171 3.9 Personnel Security

Personnel Security has two requirements: screen people before they get access to systems with CUI, and protect those systems when people leave or change jobs.

2 requirementsup to 8 SPRS points0 can go on a CMMC POA&MPublished 2026-11-11

The 2 Personnel Security requirements

3.9.1 Personnel ScreeningPS.L2-3.9.1Screen individuals prior to authorizing access to organizational systems containing CUI.3 points
3.9.2 Personnel ActionsPS.L2-3.9.2Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.5 points

Personnel Security: points and the CMMC POA&M

Q-01
How many SPRS points can the Personnel Security family cost?
Up to 8 of the 313 points a score can lose: 1 worth 5 points and 1 worth 3.
Q-02
Which Personnel Security requirements can go on a CMMC POA&M?
None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. Every one of them is worth more than 1 point.

Related pages

Calculator: SPRS score calculator: mark the Personnel Security requirements and see what they cost.
Sample package: Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.
Previous family: 3.8 Media Protection
Next family: 3.10 Physical Protection
All requirements: All 110 NIST SP 800-171 requirements, by family.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization: Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline: NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.