Approve the person before access. Follow every route when duties change.
Work through both requirements and all four assessment objectives. Confirm appropriate screening before CUI system access is authorized, then coordinate access and credential changes through transfers and terminations. Include contractors, providers, physical access and offline equipment within your scope.
Sources reviewed October 28, 2026. These instructions have not been tested in a Microsoft tenant. This guide does not establish compliance or replace an official assessment. Suggested checks and manual worksheet states are working aids.
Define the gate. Have authorized personnel roles define screening appropriate to the role and obligations. Do not infer a required background check, legal interval or hiring decision from a template.
Confirm before authorizing. Require restricted confirmation that screening is complete before approving CUI system access. Record the actual screening, authorization and enablement sequence.
Know the access routes. Use account, app, asset and facilities records. Include alternate identities, local access, remote sessions, VPN, direct app accounts, badges and keys.
Coordinate the change. Agree effective timing, confidential notification, responsible owners and backup coverage. Remove old-role access and approve new access separately for transfers.
Verify what happened. Record actual route-specific results and continuing safeguards. A requested sign-out, ticket closure or returned badge does not prove all access ended.
Use fictional worker records and authorized test identities for exercises. Do not screen a real applicant, make an employment decision, disable a real worker, wipe equipment or change production access as an exercise. Keep screening reports, identity documents, CUI, passwords, detailed personnel records and evidence in approved restricted storage. This website does not receive completed materials or answers.
Screen people before authorizing CUI system access
Make screening a documented gate before access, including employees, contractors and other individuals in scope. The authorized personnel role decides whether the required screening is complete. An account request, signed offer or manager assurance does not by itself show that this happened.
Official requirement and assessment objectives
Screen individuals prior to authorizing access to organizational systems containing CUI.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.9.1
Objective
Official text
3.9.1
Determine if individuals are screened prior to authorizing access to organizational systems containing CUI.
What to do
Define the screening decision and responsible roles
Identify the systems containing CUI and the individuals who need access. Have authorized HR, security and other appropriate advisers define suitable screening for the role and applicable obligations. Record who performs the screening, who confirms completion and who authorizes access. Do not infer a particular background check, legal rule or recurring interval from this requirement.
Require documented confirmation before access approval
Use a controlled request that links a restricted person or worker reference, role, required screening, authorized confirmation and dated access decision. Keep enough timing to show screening preceded authorization and access enablement. If confirmation is missing, hold the CUI access request and escalate. Do not use an exception label to bypass the screening gate.
Give administrators only the needed approval
Keep background reports, identity documents, health information and detailed findings in approved restricted personnel records. Ordinary access trackers should contain a restricted reference and the authorized completion/decision confirmation, rather than the report. Set access and retention through the approved personnel records process. This website and these materials do not evaluate applicants or automate employment decisions.
Check the actual sequence safely
Sample approved records with the responsible personnel role. Compare screening confirmation, authorization and actual enablement timestamps, including time zones where needed. Use fictional worker records and an approved test identity for a separate rehearsal. Investigate any real early access through the approved access/incident process; do not backdate records.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the screening and access controls worked.
3.9.1
Trace sampled individuals from the applicable screening requirement and authorized completion confirmation to later CUI system access authorization and enablement. Include contractor/provider access within scope.
Records to keep: Approved screening process, responsible roles, minimal restricted completion reference and actual dated authorization/enablement sequence. Detailed screening reports remain in restricted personnel storage.
Records to keep
Role and system scope, approved screening criteria, responsible personnel and access approval roles.
Restricted screening confirmation and date, later access authorization and enablement references, missing confirmations and assigned corrections.
If a check fails
Hold unapproved access. If access was already granted without confirmed screening, promptly involve the authorized personnel, security and system owners, restrict access safely and assess exposure under the approved procedure. Preserve the actual sequence and required records. Restore access only after the screening and access decisions are properly completed.
Working with a small budget
A restricted manual confirmation and controlled access request can support this gate with existing tools. Screening services and qualified advice may cost money. Microsoft accounts, Office templates and identity automation do not conduct appropriate screening or replace the authorized decision.
Protect systems through transfers and terminations
Coordinate personnel decisions with the people who control each access route. A transfer may remove old duties while granting new ones; a termination may require rapid coordinated removal. Protect CUI during the transition and afterward, including devices, physical access and services outside Microsoft Entra.
Official requirement and assessment objectives
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.9.2
Objective
Official text
3.9.2[a]
a policy and/or process for terminating system access and any credentials coincident with personnel actions is established.
3.9.2[b]
system access and credentials are terminated consistent with personnel actions such as termination or transfer.
3.9.2[c]
the system is protected during and after personnel transfer actions.
What to do
Establish an authorized notification and timing process
Define who authorizes the personnel action, who privately notifies administrators and facilities, the effective date/time and time zone, and who covers absences or urgent actions. Align termination of system access and credentials with the action. Define transfer removals, any justified overlap, new approvals and post-change verification. Avoid a universal number of hours unrelated to the actual action and risk.
Map and assign every access route
Use account, application, asset and physical-access records to identify AD DS, Entra, local Windows accounts, privileged and alternate accounts, VPN and remote access, application-direct identities, sessions, tokens, delegated access, badges, keys and equipment. Review any shared secret the person knew through the approved credential process. Transfer ownership of business records without exposing credentials or destroying required evidence.
Execute the approved changes and protect the transition
Record actual removal times and outcomes for each assigned route. Remove old-role permissions for transfers and separately authorize new access; check separation of duties and controlled overlap. For departures, coordinate appropriate blocking/revocation, active session handling, device return and physical access. Preserve retention, recovery and incident/evidence holds before deleting accounts, wiping devices or removing licenses.
Verify removal and remaining protection
Review actual account and permission states, application owner confirmation, session outcomes and returned assets. Use authorized test identities and harmless records for denied-access checks. Entra blocking or session revocation alone does not end every app token, Windows/AVD session, VPN connection or offline device access. Assign containment and follow-up where access cannot yet be verified; recheck the old role after transfers.
Check each objective
Record what you observed, the evidence reference and anything still unknown. A written plan, completed template or proposed action does not establish that the screening and access controls worked.
3.9.2[a]
Walk through the approved process for notification, effective timing, roles and backup coverage for terminating access and credentials coincident with transfers or terminations.
Records to keep: Approved personnel action procedure, route checklist, authority, timing/escalation decisions and assigned system, application and facilities owners.
3.9.2[b]
Trace sampled actions to actual access and credential removal consistent with the personnel action, checking separate identity, application, session, remote and physical routes as applicable.
Records to keep: Restricted event reference, authorized effective time, actual route-specific removal outcomes and times, verification and unresolved-action records.
3.9.2[c]
Check sampled transfers for protection during the change and afterward, including old-role removal, separately authorized new access, controlled overlap, equipment and remaining data.
Records to keep: Before/after access references, new-role approval, transition safeguards, actual post-transfer review, records/equipment ownership and corrections.
Records to keep
Approved notification, responsibilities, timing and escalation process, including urgent actions and backup coverage.
Restricted transfer/termination record with actual route-specific changes and verification, asset and record handover, unresolved access and follow-up.
If a check fails
If a route remains open, contact its responsible owner, contain access using the approved response plan and investigate possible exposure. Preserve required records. For an incorrect removal, confirm the authorized personnel decision before a controlled restoration of necessary access. Do not re-enable all old permissions to repair one failure.
Working with a small budget
Use existing account inventories, ticketing, Office records and facilities procedures first. Optional Entra Lifecycle Workflows, access reviews and device-management services have separate licensing and coverage. Manual tasks still need an accountable owner, timely execution and verified results.
First identify each identity authority, actual cloud, Windows join, application and remote-access route. These technical examples have not been tested in a Microsoft tenant. Obtain authorization, use a narrow test scope and agree recovery and evidence preservation before live changes. Microsoft account status does not establish screening completion or suitability of a service for CUI.
AD DS only and hybrid Windows
For AD DS only, assign an authorized directory administrator to the account and group changes in the approved personnel action. Include privileged/alternate accounts, local Windows identities, file/application rights, VPN and physical access. Check actual directory state and the relevant systems.
For hybrid identities, coordinate on-premises AD DS and Entra actions, synchronization ownership and observed completion. Follow Microsoft's linked revocation guidance for the actual risk and authentication method. Do not wait on an assumed synchronization schedule where the approved action requires coordinated protection.
Review active Windows sessions and offline equipment separately. Cached domain logon can permit local sign-in when a domain controller is unavailable. Disabling a domain identity does not retrieve a laptop, erase local files or establish that its local sessions ended.
Record actual changes, system-specific checks and outstanding routes. Preserve required records and recovery access. An accidental removal needs an authorized, limited restoration after confirming the personnel decision.
Microsoft Entra joined Windows
Microsoft documents Entra ID → Users → All users → select user → Account status → Edit, then clearing Account enabled and saving, with Revoke sessions on the user overview. Use the appropriate administrative role and the approved personnel decision. Blocking new authentication and revoking refresh tokens leave application-issued sessions and existing access-token behavior to evaluate. Verify the affected services and manage the Windows device, local accounts and stored data separately.
Commercial Microsoft 365 and Azure
Microsoft 365 documents Users → Active users → select user for password reset, sign-out and blocking. The documentation describes delays and service behavior; do not promise immediate universal revocation. Review direct app logins, guest identities, delegated access and credentials the worker controlled. Preserve required mail and business records before account deletion or license removal. Verify actual denial through approved checks rather than closing the action from a requested operation.
GCC GCC High and Azure Government
Record the actual tenant, identity authority and service instances. GCC, GCC High and Azure Government are distinct arrangements. National clouds have separate identity endpoints and may have different feature availability. Check cloud-specific documentation, administrative roles, licensing and support for each proposed workflow or device action. Do not copy a commercial connection or assume feature parity. Keep provider access removal and your own facilities/device responsibilities explicit.
Azure Virtual Desktop and other remote access
Identify AVD application-group assignments, session-host identity, active and disconnected sessions, local host permissions and related application access. Remove access that no longer fits the approved role, including old assignments after a transfer.
Coordinate authorized session sign-out/removal and verification on the actual host/session. Microsoft documents separate Disconnect-AzWvdUserSession and Remove-AzWvdUserSession operations. A disconnected session is not evidence of sign-out. Session removal can interrupt work; preserve required records and coordinate authorized handling.
Check VPN, other remote desktops, direct application authentication and physical access with their owners. An Entra change or AVD assignment change does not establish that these routes are closed. Verify the remaining session state and approved denial checks, and assign containment where a result is unknown.
Safe verification and failure recovery
Rehearse with a fictional personnel event, approved test identity and harmless records. Confirm screening precedes access authorization, old-role permissions disappear after a transfer and new access has its own approval. For removal, record actual directory/app/session states and safe denied-access results, including delays or offline limitations. Keep secrets and personnel reports out of screenshots and ordinary trackers. Never use a real worker as the test case.
If a route stays open, engage its owner and the approved incident process as appropriate. Keep containment, next checks and accountable owners visible. Wipe, deletion and license removal require separate preservation and authorization decisions; remote device actions cannot be assumed effective on an offline device. Restore mistakenly removed access only after a verified decision and with the minimum approved rights.
Included tools and costs to check
Start with the free Office materials, existing restricted personnel storage, supported account administration and a controlled manual checklist. Appropriate screening may require a paid service or qualified advice. Optional Entra Lifecycle Workflows automate supported tasks with eligible Entra ID Governance or Entra Suite licensing. Device management, access reviews and other automation have separate prerequisites. These tools do not make employment decisions, define screening criteria or close uncovered application and physical routes.
These situations are fictional. Discuss them with the authorized personnel, security, system, application and facilities roles. Use the Word exercise pack for facilitator notes. Record what participants actually did and what was only proposed. These example answers are not test results.
Supports 3.9.1
A new starter is needed before screening is confirmed
Fictional Harbor Workshop asks for a CUI project account for fictional worker River Vale. The manager says the work is urgent. The access request has a start date and signed offer reference, but no confirmation from the authorized screening role. No real person, screening or access action is represented.
Discuss
Who can confirm the required screening and who can authorize CUI access?
Which evidence and timestamps show that screening preceded access authorization?
What should happen while confirmation is missing, and what details stay out of the ordinary tracker?
What a useful response includes
Hold CUI system access pending the authorized screening confirmation and access decision. An urgent start or manager assurance does not complete the gate.
Use the approved personnel process to confirm the role-specific screening and record a minimal restricted reference with dates. Keep the underlying report in restricted personnel storage.
Assign an owner to resolve the missing confirmation. Record proposed steps separately from actual approval and enablement; do not backdate the sequence.
Lesson: Screening is a gate before access authorization. A start date, account request or filled tracker cannot substitute for the authorized confirmation.
Record: Record the fictional request, missing confirmation, decision to hold access, responsible role and proposed follow-up. Do not enter real HR data or invent a performed screening result.
Supports 3.9.2
A transferred worker keeps the previous project permissions
Fictional worker Arden Brook moves from one fictional CUI project to another. The new group request is ready, but the old AD group, direct application account and building-room access have no removal owner. A proposed overlap has no end time or approval. No actual transfer or permission change has occurred.
Discuss
Which old and new access routes must be reviewed together?
Who approves and limits any business need for overlap?
How will the system be protected during the change and verified afterward?
What a useful response includes
Use the authorized transfer notice and effective time to assign removal of old-role AD, application and physical access. Separately approve the new role and check separation of duties.
Resolve any proposed overlap through the approved process with a reason, responsible owner, safeguards and end/review time. Do not leave old access by default.
Plan actual before/after permission review, application-owner confirmation and a safe old-role denial check with an approved test identity. Keep unperformed checks and unresolved removals open.
Lesson: A transfer includes removing access that no longer fits and protecting the transition. Adding a new group alone leaves the old-role question unanswered.
Record: Record the fictional transfer time, route owners, missing removals, overlap decision and proposed post-transfer verification. Distinguish discussion from actual access results.
Supports 3.9.2
A departure still has an offline laptop and disconnected session
For a fictional departure at fictional Cedar Engineering, the draft checklist says Entra sign-out requested. The fictional laptop is offline, an AVD session is disconnected, and VPN, a directly authenticated vendor app and the building badge are unchecked. No real account, device or incident is involved.
Discuss
Why is a sign-out request insufficient to close this action?
Which owners must handle AD or local Windows access, AVD, VPN, direct apps, physical access and the device?
What requires preservation or approval before deletion, license removal, session removal or device wiping?
What a useful response includes
Coordinate authorized blocking and revocation with the personnel action and verify actual service-specific results. Do not claim that every existing token or application session ended from one Entra action.
Assign AVD session removal/sign-out and verification separately from disconnect. Address VPN, direct app, AD/local and badge access through their owners. Arrange controlled device return and protection of offline local data.
Preserve required business records and holds before destructive actions. Keep incomplete routes open with containment, an owner and a next check; invoke the approved incident process if actual evidence later warrants it.
Lesson: Revocation is a coordinated set of actions. Cloud sign-out does not retrieve an offline device, end every session or close physical access.
Record: Record route-specific unknowns, responsible owners, preservation decisions, containment and proposed verification. Do not turn the scenario into an asserted incident or a successful technical test.
Five free Word and Excel materials
Download a copy and adapt it in your approved environment. Blank inputs and fictional examples are separate. Use restricted references; keep CUI, credentials, screening reports, detailed personnel/system records and evidence in approved storage. The templates do not calculate a compliance score.
Excel
Screening and access authorization register
Record role scope, restricted screening confirmation, approval and the sequence before access. Keep screening reports in restricted HR records.
Ready for record review means a row is prepared for someone to examine. It is not screening completion, verified access removal, personnel approval or a compliance finding. Keep remaining limitations and next actions explicit.
Turn an incomplete personnel action into assigned work
In a fictional transfer review, the new project group was approved but the old direct application account has no verified removal. The team keeps 3.9.2 as Evidence to check in the Level 2 gap-and-action worksheet, links the restricted personnel action record and assigns the application owner to verify removal. It records protection during the transition and the actual later result rather than treating the new group approval as complete transfer protection.
Sources reviewed October 28, 2026. Official text is separate from practical suggestions. Technical instructions have not been tested in a tenant. Product documentation supports feature limits and administrative paths, not proof that your deployment works. Authorized personnel roles define appropriate screening and records handling for actual obligations; this guide sets no legal screening interval, makes no employment decision and does not approve a service for CUI.
Personnel screening precedes access. Termination and transfer protection includes access, credentials and accountable personnel actions. This guide sets no universal screening interval.
Cloud blocking, refresh-token revocation, hybrid identity and application sessions require separate consideration. Existing access and application tokens have limits; offline data remains a separate risk.
Cached Windows logon can allow local sign-in when a domain controller is unavailable. Domain account changes do not establish control of an offline device or its local data.
A session removal operation targets a specified host and session. Coordinate data preservation, authorization and user impact; verify the actual result.
Optional joiner, mover and leaver task automation requires eligible Entra ID Governance or Entra Suite licensing and supported tasks. It does not make employment or screening decisions.
Email cmmc@purposefulsecurity.com with a general description. Keep CUI, credentials, screening reports, detailed personnel/system records, evidence and completed materials in your approved environment. Do not email them to us.