Personnel Termination PS-4
Personnel Security · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds PS-4 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Personnel Security family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
PS-4 (Personnel Termination) requires that when someone leaves or is let go, the organization revokes their access on a defined timeline, retrieves credentials and equipment, disables accounts, and runs exit steps. It keeps former staff from retaining access. It is a human resources (HR) and organizational process control, not a host setting.
What good looks like
- Revoke the person's system access within a defined time when they are terminated.
- Disable their accounts and retrieve credentials, tokens, keys, and equipment.
- Complete exit steps — for example, a termination checklist — and notify the right people.
- Coordinate HR, the system owner, and security so no access path is missed.
Framework mapping
- NIST CSF 2.0 — PR.AA-01 — Identities and credentials are managed, including timely revocation when personnel leave
- CIS Controls v8 — Control 6 — Access Control Management — revoke access rights when no longer required
How to move it toward Implemented
- This is correctly marked not applicable at the host level: termination is an HR and organizational process, and a single lab virtual machine (VM) has no mechanism for it — the SSH (Secure Shell)
AllowUsersand key-only settings are access control, not an offboarding process. - Tailor it as an inherited common control: record in the System Security Plan (SSP) that PS-4 is satisfied by the organization's HR offboarding program rather than by anything on PROD-WEB-01.
- It WOULD apply once real staff administer this system: offboarding would need to remove the departing admin from
AllowUsers, delete their~/.ssh/authorized_keys, and disable the account (usermod --expiredate 1orchage --expiredate) on a set timeline — with the org's HR process as the trigger and system-of-record.