Navigate

CCI-003068

CCI-003068 Definition

Review and update the rules of behavior in accordance with organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed reviews and updates the rules of behavior annually. The organization must maintain an audit trail of reviews and updates. DoD has defined the frequency as annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates the rules of behavior annually. DoD has defined the frequency as annually.

Compelling Evidence

1.) Update records for Rules of Behavior that indicate dates of reviews, updates, and personnel who approve publication.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003068.

Control	Description
PL-4	The organization: a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; c: Reviews and updates the rules of behavior [organization-defined frequency]; and d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.

Control

Description

PL-4

The organization:

a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

c: Reviews and updates the rules of behavior [organization-defined frequency]; and

d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.