NIST 800-171 Controls · Personnel Security
PS.2.002 — Protect CUI During Personnel Actions
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
What PS.2.002 means in plain English
When someone quits, gets fired, or moves to a different role, you need a plan to immediately cut off their access to CUI. That means disabling their computer login, collecting their keys and badges, and making sure they cannot still get into email or cloud drives from their phone at home. Do not wait until Monday — do it the same day. Also, when someone transfers to a new role, review whether they still need the same file access or if it should change.
The assessment question
“Do you have a documented offboarding process that ensures system access is revoked and CUI is protected on the same day an employee departs or changes roles, including collecting physical access devices and disabling all accounts?”
How to implement PS.2.002
- Create a one-page offboarding checklist: disable Active Directory or Microsoft 365 account, revoke VPN access, collect badge and keys, wipe or collect company devices, and remove from any shared folders or groups — all within the same business day.
- In Microsoft 365 Admin Center, learn how to block sign-in immediately: go to Users > Active users > select the user > Block sign-in. Practice this so you can do it in under two minutes.
- For role transfers, schedule an access review with the employee's new manager within one week to adjust folder and system access to match the new role using the principle of least privilege.
- Maintain a termination log (spreadsheet or HR system) recording the date, who was offboarded, each checklist item completed, and who performed the steps.
- Review the termination log quarterly to ensure no gaps exist and all departed employees have been fully removed from all systems.
Evidence your assessor will ask for
- Written offboarding/termination procedure with same-day access revocation requirement
- Completed offboarding checklists for recent departures showing all steps performed
- Microsoft 365 or AD logs showing accounts were disabled on or before the departure date
- Evidence of collected devices and physical access items (signed receipt or inventory log)
- Transfer access review documentation showing permissions adjusted for role changes
Does AI prompt monitoring help with this control? Honestly, no.
PS.2.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Personnel Security controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.