Navigate

CCI-001388

CCI-001388 Definition

The information system, for publicly accessible systems, includes a description of the authorized uses of the system.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed configures the information system to include a description of the authorized uses of the system for publicly accessible systems. For information system components that have applicable STIGs or SRGs, the organization being inspected/assessed must comply with the STIG/SRG guidance that pertains to CCI 1388.

Validation Procedures

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to include a description of the authorized uses of the system for publicly accessible systems. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 1388.

Compelling Evidence

1.) Description of the authorized uses 2.) Applicable STIG/SRG checks 3.) Documentation that shows the system is configured to include a description of the authorized uses of the system for publicly accessible systems.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001388.

Control	Description
AC-8	The information system: AC-8a.: Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: AC-8a.1.: Users are accessing a U.S. Government information system; AC-8a.2.: Information system usage may be monitored, recorded, and subject to audit; AC-8a.3.: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and AC-8a.4.: Use of the information system indicates consent to monitoring and recording; AC-8b.: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and AC-8c.: For publicly accessible systems: AC-8c.1.: Displays system use information [Assignment: organization-defined conditions], before granting further access; AC-8c.2.: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and AC-8c.3.: Includes a description of the authorized uses of the system.

Control

Description

AC-8

The information system:

AC-8a.: Displays to users [Assignment: organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:
- AC-8a.1.: Users are accessing a U.S. Government information system;
- AC-8a.2.: Information system usage may be monitored, recorded, and subject to audit;
- AC-8a.3.: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and
- AC-8a.4.: Use of the information system indicates consent to monitoring and recording;

AC-8b.: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

AC-8c.: For publicly accessible systems:
- AC-8c.1.: Displays system use information [Assignment: organization-defined conditions], before granting further access;
- AC-8c.2.: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
- AC-8c.3.: Includes a description of the authorized uses of the system.