// ITSP.10.171 · FAMILY 09 · 2 REQUIREMENTS

Personnel security

Last verified: 2026-10-05

// REQUIREMENTS

Identifier	Requirement	Level 1
03.09.01	Personnel screening
03.09.02	Personnel termination and transfer

// INTENT

Screen people before they get access to protected data, and pull access cleanly when they leave or move roles.

// WHAT A FIRST ASSESSMENT FINDS

Hiring paperwork in a filing cabinet HR can't find, and the last engineer to leave still has a live account.

// THE WORK

Screening to the contract's requirements before enclave access, a named Company Security Officer where the contract requires one, and an offboarding process with a checklist that HR and IT both sign.

// HOW WE CAN INTERPRET IT

HR gets pulled in here. At hiring, what was the process? Record check at the level the contract requires, which in Canada is usually a criminal record and judicial matters check, with clearances on top through the Contract Security Program, and a named Company Security Officer who meets the requirements. Nobody touches project files until the checks come back. The auditor samples, picking 3 names from the access list and asking for their paperwork. Then the exit, which is the bigger failure. The last person to leave the project, show me their account. Why is it still active? Disable it, freeze the mailbox, forward the mail, don't log in as them, and preserve everything in case it turns litigious. HR notifies IT inside a set number of hours, the badge is collected, card access is pulled, the laptop comes back and gets wiped. Letting someone keep a device is where personal and work mixing hurts most, because the remote wipe takes the family photos with it.

// TEMPLATES FOR THIS FAMILY

References

Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)April 2025, updated October 2025
Canadian Centre for Cyber Securitycyber.gc.caRetrieved Oct 5, 2026
NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsRevision 3
NISTcsrc.nist.govRetrieved Oct 5, 2026

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.