Navigate

CCI-001388

CCI-001388 Definition

For publicly accessible systems, includes a description of the authorized uses of the system.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed configures the information system to include a description of the authorized uses of the system for publicly accessible systems. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1388.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to include a description of the authorized uses of the system for publicly accessible systems. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1388.

Compelling Evidence

1.) Description of the authorized uses 2.) Applicable STIG/SRG checks 3.) Documentation that shows the system is configured to include a description of the authorized uses of the system for publicly accessible systems.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001388.

Control	Description
AC-8	The information system: a: Displays to users [organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1: Users are accessing a U.S. Government information system; 2: Information system usage may be monitored, recorded, and subject to audit; 3: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4: Use of the information system indicates consent to monitoring and recording; b: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and c: For publicly accessible systems: 1: Displays system use information [organization-defined conditions], before granting further access; 2: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3: Includes a description of the authorized uses of the system.

Control

Description

AC-8

The information system:

a: Displays to users [organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:
- 1: Users are accessing a U.S. Government information system;
- 2: Information system usage may be monitored, recorded, and subject to audit;
- 3: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and
- 4: Use of the information system indicates consent to monitoring and recording;

b: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

c: For publicly accessible systems:
- 1: Displays system use information [organization-defined conditions], before granting further access;
- 2: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
- 3: Includes a description of the authorized uses of the system.