Personnel Transfer PS-5

Source: NIST SP 800-53 Rev.5, Personnel Security family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PS-5 (Personnel Transfer) is about cleaning up access when someone moves to a new role rather than leaves. You review whether their current access still fits the new job, change or remove what no longer applies, do it within a set timeframe, and tell the right people. It prevents privilege creep (access that piles up as people move around) and is required at the Low baseline. Termination is handled separately by PS-4.

What good looks like

• When someone is reassigned or transferred, review whether their current access still fits the new role.
• Modify or remove the access the new role no longer needs — don't let it carry over by default.
• Act within a set timeframe so the gap between the move and the cleanup stays small.
• Notify the system owner and security staff that the transfer happened.

Framework mapping

How to move it toward Implemented

• Write a short transfer checklist with a deadline (for example, revoke unneeded access within five business days of a transfer).
• On a transfer, review what the person can do today — run id username and groups username to list their group memberships and sudo rights — and compare it to what the new role actually needs.
• Modify or remove the access the new role does not need. For example, drop a transferred user from admin rights with gpasswd -d username sudo, and remove stale group memberships the same way.
• Record the review and the changes in a dated file and notify the system owner, then attach it as hardening evidence on the asset, naming PS-5 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.