# NIST 800-171 3.9.1 Screen individuals prior to authorizing access to organizational systems containing CUI.

- Source: https://support.icompaas.com/support/solutions/articles/62000229319-nist-800-171-3-9-1-screen-individuals-prior-to-authorizing-access-to-organizational-systems-containin
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Personnel security screening (vetting) activities involve the evaluation/assessment of individual’s conduct, integrity, judgment, loyalty, reliability, and stability (i.e., the trustworthiness of the individual) prior to authorizing access to organizational systems containing CUI. The screening activities reflect applicable federal laws, Executive Orders, directives, policies, regulations, and specific criteria established for the level of access required for assigned positions.

  

**Priority**: High   

  

**Category**:  Personnel Security 

  

**Services Associated with AWS:**   

N/A 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate Human Resources (HR) practices to screen individuals
-   Administrative: supporting documentation to demonstrate how Identity & Access Management (IAM) practices are implemented
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of AD settings, or other IAM interface 

  

Possible Technology Considerations : 

NA

  

**What needs to be answered :**  

  

Are individuals requiring access screened before access is granted? 

-   Personnel Security Screening for Access to CUI Systems  
    Description: This check ensures that organizations have established personnel security screening processes to evaluate and assess the trustworthiness of individuals before granting them access to organizational systems containing Controlled Unclassified Information (CUI). Personnel security screening activities aim to assess an individual's conduct, integrity, judgment, loyalty, reliability, and stability to determine their eligibility for accessing CUI systems. 

  

**More Details:**   

Employees with access to CUI must undergo background screening prior to approval to work on CUI.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.