The control PS.L2-3.9.1: Screen Individuals requires that individuals be screened before authorizing access to organizational systems and CUI. Since employees are assigned to work immediately upon hire, before screenings are complete, this practice is NOT MET. Completing screenings within the first week does not satisfy the requirement.
Exact extracts:
“Screen individuals prior to authorizing access to organizational systems containing CUI.”
“Assessment Objectives … Determine if: [a] individuals requiring access to CUI are screened before access is granted.”
“It is not sufficient for screening to occur after access has been authorized.”
Why the other options are incorrect:
A: Remediation may be possible, but scoring must be NOT MET.
B: A single practice being NOT MET does not automatically cause assessment failure (depends on aggregate score).
C: HR responsibility does not excuse failure to complete screening before granting access.
[References:, CMMC Assessment Guide – Level 2, PS.L2-3.9.1 “Screen Individuals.”, NIST SP 800-171 Rev. 2, 3.9.1., , , ]
Submit