---
title: "NIST 800-171 3.9 Personnel Security"
description: "The 2 NIST SP 800-171 Personnel Security requirements (3.9, CMMC PS): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/personnel-security
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/personnel-security
records: 4
digest: sha3:20fff2f811def0aa715ae1390252c3367a7a5b13e48882df7e0423882937a1a9
---

# NIST 800-171 3.9 Personnel Security

NIST 800-171 / Personnel Security

Personnel Security has two requirements: screen people before they get access to systems with CUI, and protect those systems when people leave or change jobs.

2 requirements · up to 8 SPRS points · 0 can go on a CMMC POA&M

## The 2 Personnel Security requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.9.1 Personnel Screening](https://policycortex.com/nist-800-171/personnel-security/3.9.1) | PS.L2-3.9.1 | 3 points | Screen individuals prior to authorizing access to organizational systems containing CUI. |
| [3.9.2 Personnel Actions](https://policycortex.com/nist-800-171/personnel-security/3.9.2) | PS.L2-3.9.2 | 5 points | Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. |

## Personnel Security: points and the CMMC POA&M

**Q: How many SPRS points can the Personnel Security family cost?**
A: Up to 8 of the 313 points a score can lose: 1 worth 5 points and 1 worth 3.

**Q: Which Personnel Security requirements can go on a CMMC POA&M?**
A: None of them. 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point. Every one of them is worth more than 1 point.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Personnel Security requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-PS)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.8 Media Protection](https://policycortex.com/nist-800-171/media-protection)
- **Next family**: [3.10 Physical Protection](https://policycortex.com/nist-800-171/physical-protection)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | ac84fbcc1f68 | 3997846e2c86 |
| REC 0001 | REQUIREMENTS | 04b9987e8fe6 | ac84fbcc1f68 |
| REC 0002 | POINTS AND POA&M | 02e7baa8a56e | 04b9987e8fe6 |
| REC 0003 | RELATED | 20fff2f811de | 02e7baa8a56e |

Head sha3:20fff2f811def0aa715ae1390252c3367a7a5b13e48882df7e0423882937a1a9. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.