PS.2.002 — Protect CUI During Personnel Actions

What PS.2.002 means in plain English

When someone quits, gets fired, or moves to a different role, you need a plan to immediately cut off their access to CUI. That means disabling their computer login, collecting their keys and badges, and making sure they cannot still get into email or cloud drives from their phone at home. Do not wait until Monday — do it the same day. Also, when someone transfers to a new role, review whether they still need the same file access or if it should change.

The assessment question

“Do you have a documented offboarding process that ensures system access is revoked and CUI is protected on the same day an employee departs or changes roles, including collecting physical access devices and disabling all accounts?”

How to implement PS.2.002

1. Create a one-page offboarding checklist: disable Active Directory or Microsoft 365 account, revoke VPN access, collect badge and keys, wipe or collect company devices, and remove from any shared folders or groups — all within the same business day.
2. In Microsoft 365 Admin Center, learn how to block sign-in immediately: go to Users > Active users > select the user > Block sign-in. Practice this so you can do it in under two minutes.
3. For role transfers, schedule an access review with the employee's new manager within one week to adjust folder and system access to match the new role using the principle of least privilege.
4. Maintain a termination log (spreadsheet or HR system) recording the date, who was offboarded, each checklist item completed, and who performed the steps.
5. Review the termination log quarterly to ensure no gaps exist and all departed employees have been fully removed from all systems.

Evidence your assessor will ask for

• Written offboarding/termination procedure with same-day access revocation requirement
• Completed offboarding checklists for recent departures showing all steps performed
• Microsoft 365 or AD logs showing accounts were disabled on or before the departure date
• Evidence of collected devices and physical access items (signed receipt or inventory log)
• Transfer access review documentation showing permissions adjusted for role changes

More Personnel Security controls