CCI-001639

The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.

Implementation Guidance

The organization being inspected/assessed must disseminate to all information system users, via an information sharing capability, rules that describe information system user responsibilities and expected behavior with regard to information and information system usage, acceptable use policy (AUP). Organizations should disseminate the rules by providing to users and requiring signature of acceptance.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines rules that describe information system user responsibilities via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc) to ensure it has been disseminated.

Compelling Evidence

1.) Acceptable use policy (AUP) rules which describe information system user responsibilities.

The controls below (if any) were marked by NIST as being related to CCI-001639.