HRS-04.4: Citizenship Identification

There is no evidence of a capability to identify foreign nationals, including by their specific citizenship.

C|P-CMM1 is N/A, since a structured process is required to identify foreign nationals, including by their specific citizenship.

C|P-CMM2 is N/A, since a well-defined process is required to identify foreign nationals, including by their specific citizenship.

Human Resources Security (HRS) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Ensures industry-recognized HR practices are implemented for hiring, managing, training, investigating and terminating employees, contractors and other personnel that work on behalf of the organization. o Ensures that every user accessing a system that processes, stores, or transmits sensitive/regulated data is cleared and regularly trained in proper data handling practices. o Identifies and implements industry-recognized HR practices related to cybersecurity and data privacy training and awareness to help ensure secure practices are implemented in personnel operations to help manage risk to both technology assets and data. o Manages personnel security risk by assigning a risk designation to all positions and establishing screening criteria for individuals filling those positions.

• The Human Resources (HR) department:
• Administrative processes require Non-Disclosure Agreements (NDAs) or similar confidentiality agreements that reflect the needs to protect data and operational details, for both employees and third-parties.

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to identify foreign nationals, including by their specific citizenship.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to identify foreign nationals, including by their specific citizenship.