Question 1

What is the Personnel Security family in CMMC?

Accepted Answer

Personnel Security governs how personnel are screened and how access is handled when they change roles or leave. It appears only at Level 2 of CMMC, with 2 practices under NIST SP 800-171 Rev 2. FAR 52.204-21, the Level 1 standard, includes no Personnel Security practices.

Question 2

How is Personnel Security scored under CMMC?

Accepted Answer

Personnel Security is a Level 2 family, scored on the SPRS methodology from the DoD Assessment Methodology v1.2.1. Each of its 2 practices carries a point weight of 1, 3, or 5, and an unmet practice deducts its weight from the score. It does not appear at Level 1, so no compliance percentage applies to it.

Question 3

Which Personnel Security practices cannot be placed on a POA&M?

Accepted Answer

In Personnel Security, any practice worth more than 1 point cannot be deferred to a POA&M, per 32 CFR 170.21(a)(2)(ii). Only 1-point gaps are POA&M-eligible, and they must be closed within 180 days of the Conditional Status Date.

Question 4

Does Personnel Security have any partial-credit practices?

Accepted Answer

No. Partial credit applies to only two practices in the entire methodology, IA.L2-3.5.3 (multifactor authentication) and SC.L2-3.13.11 (FIPS-validated cryptography), and neither is in Personnel Security. Every Personnel Security practice is scored Met or Not met.