HRS-04.3: Citizenship Requirements

There is no evidence of a capability to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/ or contractual requirements for citizenship.

C|P-CMM1 is N/A, since a structured process is required to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/ or contractual requirements for citizenship.

C|P-CMM2 is N/A, since a well-defined process is required to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/ or contractual requirements for citizenship.

Human Resources Security (HRS) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Ensures industry-recognized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization. o Ensures that every user accessing a system that processes, stores, or transmits sensitive/regulated data is cleared and regularly trained in proper data handling practices. o Identifies and implements industry-recognized HR practices related to cybersecurity and data privacy training and awareness to help ensure secure practices are implemented in personnel operations to help manage risk to both technology assets and data. o Manages personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions.

• The Human Resources (HR) department:
• Administrative processes require Non-Disclosure Agreements (NDAs) or similar confidentiality agreements that reflect the needs to protect data and operational details, for both employees and third-parties.
• HR ensures citizenship requirements are addressed per applicable statutory, regulatory and contractual requirements.

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/ or contractual requirements for citizenship.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to verify that individuals accessing a system processing, storing, or transmitting sensitive information meet applicable statutory, regulatory and/ or contractual requirements for citizenship.