What this requirement asks
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
This is a CMMC Level 2 requirement in the Personnel Security family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.9.2[a] — a policy and/or process for terminating system access and any credentials coincident with personnel actions is established
- 3.9.2[b] — system access and credentials are terminated consistent with personnel actions such as termination or transfer
- 3.9.2[c] — the system is protected during and after personnel transfer actions
What an assessor examines
Examine:
- Personnel security policy
- procedures addressing personnel transfer and termination
- records of personnel transfer and termination actions
- list of system accounts
- records of terminated or revoked authenticators and credentials
- records of exit interviews
- other relevant documents or records
Interview:
- Personnel with personnel security responsibilities
- personnel with account management responsibilities
- system or network administrators
- personnel with information security responsibilities
Test:
- Organizational processes for personnel transfer and termination
- mechanisms supporting or implementing personnel transfer and termination notifications
- mechanisms for disabling system access and revoking authenticators
Evidence that defends it
Show offboarding checklist and account disable logs
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.