[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fps-7":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ps-7","PS-7","External Personnel Security",12,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must set personnel security requirements, including roles and responsibilities, for external providers, require providers to comply with its personnel security policies, document the requirements, require providers to notify it of transfers or terminations of their staff with credentials or access, and monitor compliance.\n\n**In practice.** This means contracts with consultants, outsourcers and managed service providers that specify screening, confidentiality, training and prompt notification when their staff leave. Access for external staff should have end dates and named sponsors. Auditors expect contract clauses, notification records and evidence of monitoring.\n\n**Common gaps.** Organisations often rely on providers to tell them when staff leave, and they frequently do not. External personnel accounts without expiry are a common finding.","a. Establish personnel security requirements, including security roles and responsibilities for external providers;\n  b. Require external providers to comply with personnel security policies and procedures established by the organization;\n  c. Document personnel security requirements;\n  d. Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and\u002For badges, or who have system privileges within [Assignment: organization-defined time period] ; and\n  e. Monitor provider compliance with personnel security requirements.\nDiscussion: External provider refers to organizations other than the organization operating or acquiring the system. External providers include service bureaus, contractors, and other organizations that provide system development, information technology services, testing or assessment services, outsourced applications, and network\u002Fsecurity management. Organizations explicitly include personnel security requirements in acquisition-related documents. External providers may have personnel working at organizational facilities with credentials, badges, or system privileges issued by organizations. Notifications of external personnel changes ensure the appropriate termination of privileges and credentials. Organizations define the transfers and terminations deemed reportable by security-related characteristics that include functions, roles, and the nature of credentials or privileges associated with transferred or terminated individuals.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"insider-threat-hidden-recorder-found-in-openai-executive-conference-room","Insider Threat: Hidden Recorder Found in OpenAI Executive Conference Room","2026-10-14T04:20:18.348+00:00",{"slug":25,"title":26,"published_at":27},"openai-engineer-plants-hidden-recording-device-in-executive-conference-room","OpenAI Engineer Plants Hidden Recording Device in Executive Conference Room","2026-10-14T00:21:06.926+00:00",{"slug":29,"title":30,"published_at":31},"insider-threat-openai-employee-plants-audio-device-in-conference-room","Insider Threat: OpenAI Employee Plants Audio Device in Conference Room","2026-10-14T00:20:50.023+00:00",{"slug":33,"title":34,"published_at":35},"insider-threat-openai-engineer-allegedly-plants-covert-recording-device-using-ai-tools","Insider Threat: OpenAI Engineer Allegedly Plants Covert Recording Device Using AI Tools","2026-10-14T00:20:34.271+00:00",{"slug":37,"title":38,"published_at":39},"insider-threat-active-duty-soldier-sentenced-for-multi-company-data-breach-spree","Insider Threat: Active-Duty Soldier Sentenced for Multi-Company Data Breach Spree","2026-09-25T22:20:49.355+00:00",{"slug":41,"title":42,"published_at":43},"insider-threat-soldier-exploits-telecom-access-to-steal-100m-customer-records","Insider Threat: Soldier Exploits Telecom Access to Steal 100M Customer Records","2026-09-25T22:20:19.846+00:00",{"slug":45,"title":46,"published_at":47},"insider-contractor-steals-data-extorts-employer-for-7500","Insider Contractor Steals Data, Extorts Employer for $7,500","2026-08-13T22:20:19.684+00:00",{"slug":49,"title":50,"published_at":51},"cbp-employees-abused-government-databases-for-personal-surveillance","CBP Employees Abused Government Databases for Personal Surveillance","2026-08-13T10:20:54.553+00:00",{"slug":53,"title":54,"published_at":55},"insider-threat-cybersecurity-professionals-convicted-for-aiding-ransomware-gang","Insider Threat: Cybersecurity Professionals Convicted for Aiding Ransomware Gang","2026-07-10T14:21:23.642+00:00",{"slug":57,"title":58,"published_at":59},"insider-threat-ransomware-negotiator-weaponized-client-data-for-blackcat","Insider Threat: Ransomware Negotiator Weaponized Client Data for BlackCat","2026-07-10T14:20:35.713+00:00",{"slug":61,"title":62,"published_at":63},"insider-threat-ransomware-negotiators-turned-blackcat-affiliates-sentenced","Insider Threat: Ransomware Negotiators Turned BlackCat Affiliates Sentenced","2026-07-10T10:21:22.005+00:00",{"slug":65,"title":66,"published_at":67},"foreign-intelligence-services-target-security-clearance-holders-on-social-media","Foreign Intelligence Services Target Security Clearance Holders on Social Media","2026-06-03T21:06:11.238+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":75,"name":76,"problem":77,"stories":78},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",4,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":85,"name":86,"problem":87,"stories":83},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":89,"name":90,"problem":91,"stories":92},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",2,{"slug":94,"name":95,"problem":96,"stories":92},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[98,104,109,114,120,125,128,132],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","6","Control 6","Access Control Management",10,{"family":105,"item":106,"code":107,"title":107,"together":108},"itil","overview","ITIL",9,{"family":5,"item":110,"code":111,"title":112,"together":113},"ac-2","AC-2","Account Management",8,{"family":115,"item":116,"code":117,"title":118,"together":119},"gdpr","32","Article 32","Security of processing",7,{"family":5,"item":121,"code":122,"title":123,"together":124},"ac-6","AC-6","Least Privilege",6,{"family":99,"item":126,"code":127,"title":112,"together":73},"5","Control 5",{"family":99,"item":129,"code":130,"title":131,"together":78},"13","Control 13","Network Monitoring and Defense",{"family":99,"item":133,"code":134,"title":135,"together":78},"14","Control 14","Security Awareness and Skills Training"]