7 KPIs for Your CUI Access Screening Dashboard (PS.L2-3.9.1)

The most useful CUI access screening dashboard KPIs measure whether personnel were screened before receiving CUI-system access, whether screening evidence is complete, and how quickly the organization corrects failures. For NIST SP 800-171 Rev. 2 and CMMC 2.0 Level 2 practice PS.L2-3.9.1, track pre-authorization screening coverage, unauthorized access grants, screening turnaround time, evidence completeness, exceptions, overdue re-screening where your policy requires it, and access-removal speed.

Why do CUI access screening dashboard KPIs matter for PS.L2-3.9.1?

PS.L2-3.9.1 requires the organization to screen individuals before authorizing access to organizational systems containing Controlled Unclassified Information. An assessor will not be satisfied by a written personnel-screening policy alone. Your compliance evidence must show that the policy operates consistently: the right screening occurred, it was appropriate to the person’s role, it was completed before access, and exceptions were controlled rather than ignored.

For a mid-market compliance officer, the central reporting challenge is reconciling records that are usually held in different places. Human resources may own employment status and background-screening records; an external vendor may hold adjudication outcomes; IT owns identity and access management; and a system owner may maintain the list of applications that process, store, or transmit CUI. A dashboard converts those separate records into a recurring control test.

The metrics should focus on authorization events, not just the number of completed background checks. A high volume of completed checks does not demonstrate compliance if an individual received access to a CUI enclave, file repository, engineering platform, or managed endpoint before the screening decision was recorded. These CUI access screening metrics also help distinguish an isolated workflow error from a systemic breakdown requiring management action.

Which 7 CUI access screening dashboard KPIs should you track?

Set targets in your approved policy and apply them consistently by role. The targets below are practical starting points, but they should be adjusted for contractual requirements, position risk, union or jurisdictional restrictions, and the screening types your organization has defined for each role.

For KPI 1, use the earliest access date, not the date of the most recent access review. A user who was screened six months after access was granted may now have a valid record, but the original authorization sequence still represents a PS.L2-3.9.1 failure. Preserve that finding in monthly history rather than allowing later remediation to overwrite it.

KPI 4 should validate evidence attributes without exposing sensitive screening details in the dashboard. The dashboard generally needs a status such as Approved, Pending, Not Required, or Exception Approved, plus a protected evidence reference. Background-check reports, adverse-action records, and other sensitive personnel documents should remain access-restricted in HR or legal systems.

How often should screening compliance be reported, and in what format?

Use a monthly operational report, a quarterly management review, and event-driven alerts for failures. Monthly reporting gives system owners enough time to reconcile data and remediate individual records. Quarterly reporting gives leadership trend information, recurring causes, resource needs, and evidence that corrective actions were effective.

• Daily or near-real-time alert: Notify HR, the IAM team, the CUI system owner, and the compliance owner when a user receives a CUI entitlement without a matching approved screening status.
• Monthly control report: Show all seven KPIs, current exceptions, overdue remediation, new access grants, terminated users, and a list of unresolved mismatches.
• Quarterly leadership report: Show three-quarter trends, target attainment, exception aging, root causes, and decisions required from leadership.
• Assessment evidence package: Retain dashboard exports, source-system extracts, reconciliation results, exception approvals, tickets, and meeting minutes according to your records-retention policy.

A compliance officer should establish a reporting cutoff date and document it. For example, the June report may include all active CUI users and access changes through June 30, with reconciliation completed by the fifth business day of July. This avoids arguments over whether a late HR update belonged in the current or next reporting period.

How can you build a reliable CUI access screening dashboard?

Start with a controlled CUI application inventory that identifies the applications, identity groups, privileged roles, virtual desktops, VPN profiles, and repositories that permit access to CUI. Without a defensible scope list, a dashboard may report 100% compliance while omitting a CUI collaboration site or an engineering application administered outside central IAM.

A practical mid-market stack can use Microsoft Entra ID audit logs, Microsoft Sentinel or Splunk for collection, ServiceNow for access requests and exceptions, and an HRIS export for worker status. If you use Okta, pull group membership and application-assignment events from the System Log. Join records using an immutable worker ID where possible; email address alone is unreliable when names change, contractors use alternate domains, or identities are re-created.

The core reconciliation logic is simple: identify active CUI users, locate each user’s earliest grant date, locate the required screening approval date, and flag records where approval is missing or later than authorization.

SELECT
  a.worker_id,
  a.cui_system,
  MIN(a.access_granted_at) AS first_access_granted_at,
  s.screening_status,
  s.approved_at,
  CASE
    WHEN s.screening_status = 'Approved'
      AND s.approved_at <= MIN(a.access_granted_at)
      THEN 'Compliant'
    WHEN s.screening_status = 'Exception Approved'
      AND s.exception_expires_at >= CURRENT_DATE
      THEN 'Approved Exception'
    ELSE 'Investigate'
  END AS ps_3_9_1_status
FROM cui_access_grants a
LEFT JOIN screening_register s
  ON a.worker_id = s.worker_id
WHERE a.access_status = 'Active'
GROUP BY a.worker_id, a.cui_system, s.screening_status,
         s.approved_at, s.exception_expires_at;

Build validation checks around that query. Confirm that disabled accounts are excluded, that contractors and temporary staff are included when they access CUI, that the correct screening profile is tied to each role, and that manual emergency-access processes create an auditable exception record. Do not silently classify missing HR data as “not required”; classify it as a data-quality exception until an owner resolves it.

How should you present screening results to leadership?

Leadership needs a decision-oriented view, not a spreadsheet of individual personnel records. Lead with a one-page summary: current pre-authorization coverage, count of unauthorized grants, count of overdue exceptions, trend direction, and the business owner for every red metric. Use percentages alongside counts; a 2% failure rate may sound small, but two unauthorized CUI users can represent a material compliance issue.

Frame the discussion around exposure and accountability. For example: “Coverage was 99.2% this month because two contractor accounts were assigned to the CUI SharePoint group before the vendor screening feed completed. Both accounts were disabled within four hours, the system owner confirmed no file activity, and IAM is implementing a ServiceNow approval dependency by August 15.” This tells leadership what happened, how it was contained, and what must be funded or enforced.

Include a short trend chart or table for the last three to six months, but avoid presenting improving averages as a substitute for eliminating current failures. PS.L2-3.9.1 is fundamentally a pre-authorization control: even one unapproved access grant deserves documented investigation, corrective action, and management visibility.

Next step: Assign owners for the seven metrics and run your first reconciled CUI access screening report before the next monthly compliance review.