Position Risk Designation PS-2

Personnel Security · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PS-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Personnel Security family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PS-2 (Position Risk Designation) is about deciding how sensitive each role is before you decide how much you need to trust the person in it. You assign a risk designation to every position, set screening criteria that match, and review those designations on a schedule. It is a Personnel Security control required at the Low baseline, and it sets up PS-3 (Personnel Screening).

What good looks like

Assign a risk designation — low, moderate, or high — to every position that touches the system.
Base each designation on the role's real access and responsibility: a root-level administrator outranks a read-only auditor.
Set screening criteria that match each risk level, so more sensitive roles get a deeper check.
Review and update the designations on a schedule and when a role's duties change.

Framework mapping

How to move it toward Implemented

Build a short position risk register: one row per role that touches this server, listing what access the role has and a risk designation of low, moderate, or high.
Base each designation on real access — a person in the sudo group (root-equivalent) is higher risk than a read-only auditor. Use getent group sudo to see who holds that access today.
Write the screening criteria that go with each level (for example, a background check for moderate and high roles) so access decisions stay consistent.
Set a review date to re-check the designations when duties change, then attach the register as hardening evidence on the asset, naming PS-2 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.