CCI-003070

Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to require individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated. The signed acknowledgment portion of this control may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.

Compelling Evidence

1.) Signed acceptable use policy (AUP) acknowledgements. 2.) Signed acceptable use policy (AUP) acknowledgements if the policy is revised or updated after gaining initial access.

The controls below (if any) were marked by NIST as being related to CCI-003070.