Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ps-2

position risk designation  

assessment objective:

Determine if the organization:

ps-2(a)

assigns a risk designation to all organizational positions;

ps-2(b)  

establishes screening criteria for individuals filling those positions;

ps-2(c)  

ps-2(c)[1]  

defines the frequency to review and update position risk designations; and

ps-2(c)[2]

reviews and updates position risk designations with the organization-defined frequency.

potential assessment methods and objects:

Examine: [select from: Personnel security policy; procedures addressing position categorization; appropriate codes of federal regulations; list of risk designations for organizational positions; security plan; records of position risk designation reviews and updates; other relevant documents or records].

Interview: [select from: Organizational personnel with personnel security responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for assigning, reviewing, and updating position risk designations; organizational processes for establishing screening criteria].