Access Agreements PS-6

Personnel Security · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds PS-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Personnel Security family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

PS-6 (Access Agreements) is about making the rules explicit and getting them signed before access is granted. You develop the agreements — acceptable use, rules of behavior, and where needed a nondisclosure agreement — require a signature up front, and have people re-sign when the terms change. It is a Personnel Security control required at the Low baseline.

What good looks like

Develop and document the access agreements — acceptable use, rules of behavior, and a nondisclosure agreement where the data calls for one.
Require a signature before access is granted.
Review and update the agreements on a set frequency.
Have people re-sign when the agreement changes or on that frequency.

Framework mapping

How to move it toward Implemented

Write the access agreements people must accept — an acceptable use policy, rules of behavior, and (where needed) a nondisclosure agreement that spells out what they may and may not do on this server.
Require a signature before access is granted, and record it — keep a simple signed-agreements log (person, agreement version, date) alongside the account request.
Set a review-and-re-sign cadence (for example, review the agreements yearly and have people re-sign when the terms change) so consent stays current.
Save the signed agreements and the tracking log, then attach them as hardening evidence on the asset, naming PS-6 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.