PS.L2-3.9.2  

Reference: CMMC 2.0

Family: PS

Level Introduced: 2

Title: Personnel Actions

Practice:
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

CMMC Clarification:
Make sure employees no longer have access to CUI when they change jobs or leave the company. Confirm that when an employee leaves:
• all company IT equipment (e.g., laptops, cell phones, storage devices) is returned;
• all of their identification/access cards and/or keys are returned; and
• an exit interview is conducted to remind the employee of their obligations to not discuss CUI, even after employment.
The organization will do the following:
• erase all equipment before reuse;
• remove access to all accounts granting access to CUI;
• disable or close employee accounts; and
• limit access to physical spaces with CUI.

Example
You are in charge of IT operations at your company. When someone leaves the company, you remove them from any physical CUI access lists. You contact them immediately, and ask them to:
• turn in their computers for proper handling which includes IT disabling all accounts;
• return all their identification and access cards; and
• attend an exit interview where you remind them of their obligations to not discuss CUI.

Source: CMMC v2.0