Navigate

PL-4

PL-4: Rules of Behavior

The organization:

a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

c: Reviews and updates the rules of behavior [organization-defined frequency]; and

d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.

Supplemental

This control enhancement applies to organizational users. Organizations consider rules of behavior based on individual user roles and responsibilities, differentiating, for example, between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users including, for example, individuals who simply receive data/information from federal information systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for both organizational and non-organizational users can also be established in AC-8, System Use Notification. PL-4 b. (the signed acknowledgment portion of this control) may be satisfied by the security awareness training and role-based security training programs conducted by organizations if such training includes rules of behavior. Organizations can use electronic signatures for acknowledging rules of behavior.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Low), Privacy (Mod)

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to PL-4.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-8	The information system: a: Displays to users [organization-defined system use notification message or banner] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: 1: Users are accessing a U.S. Government information system; 2: Information system usage may be monitored, recorded, and subject to audit; 3: Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and 4: Use of the information system indicates consent to monitoring and recording; b: Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and c: For publicly accessible systems: 1: Displays system use information [organization-defined conditions], before granting further access; 2: Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and 3: Includes a description of the authorized uses of the system.
AC-9	The information system notifies the user, upon successful logon (access) to the system, of the date and time of the last logon (access).
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AC-18	The organization: a: Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b: Authorizes wireless access to the information system prior to allowing such connections.
AC-19	The organization: a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and b: Authorizes the connection of mobile devices to organizational information systems.
AC-20	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a: Access the information system from external information systems; and b: Process, store, or transmit organization-controlled information using external information systems.
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
CM-11	The organization: a: Establishes [organization-defined policies] governing the installation of software by users; b: Enforces software installation policies through [organization-defined methods]; and c: Monitors policy compliance at [organization-defined frequency].
IA-2	The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
IA-4	The organization manages information system identifiers by: a: Receiving authorization from [organization-defined personnel or roles] to assign an individual, group, role, or device identifier; b: Selecting an identifier that identifies an individual, group, role, or device; c: Assigning the identifier to the intended individual, group, role, or device; d: Preventing reuse of identifiers for [organization-defined time period]; and e: Disabling the identifier after [organization-defined time period of inactivity].
IA-5	The organization manages information system authenticators by: a: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator; b: Establishing initial authenticator content for authenticators defined by the organization; c: Ensuring that authenticators have sufficient strength of mechanism for their intended use; d: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators; e: Changing default content of authenticators prior to information system installation; f: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators; g: Changing/refreshing authenticators [organization-defined time period by authenticator type]; h: Protecting authenticator content from unauthorized disclosure and modification; i: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and j: Changing authenticators for group/role accounts when membership to those accounts changes.
MP-7	The organization [] the use of [organization-defined types of information system media] on [organization-defined information systems or system components] using [organization-defined security safeguards].
PS-6	The organization: a: Develops and documents access agreements for organizational information systems; b: Reviews and updates the access agreements [organization-defined frequency]; and c: Ensures that individuals requiring access to organizational information and information systems: 1: Sign appropriate access agreements prior to being granted access; and 2: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [organization-defined frequency].
PS-8	The organization: a: Employs a formal sanctions process for individuals failing to comply with established information security policies and procedures; and b: Notifies [organization-defined personnel or roles] within [organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
SA-5	The organization: a: Obtains administrator documentation for the information system, system component, or information system service that describes: 1: Secure configuration, installation, and operation of the system, component, or service; 2: Effective use and maintenance of security functions/mechanisms; and 3: Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions; b: Obtains user documentation for the information system, system component, or information system service that describes: 1: User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms; 2: Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and 3: User responsibilities in maintaining the security of the system, component, or service; c: Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and takes [organization-defined actions] in response; d: Protects documentation as required, in accordance with the risk management strategy; and e: Distributes documentation to [organization-defined personnel or roles].

Enhancements

The controls below (if any) add on to the requirements of PL-4.

Control	Description
PL-4(1)	The organization includes in the rules of behavior, explicit restrictions on the use of social media/networking sites and posting organizational information on public websites.

Related CCIs

The CCIs below are tied to PL-4.

CCI	Definition
CCI-000592	Establish the rules that describe their responsibilities and expected behavior, for information and system usage, for individuals requiring access to the system.
CCI-000593	Receive a documented acknowledgement from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.
CCI-001639	The organization makes readily available to individuals requiring access to the information system the rules that describe their responsibilities and expected behavior with regard to information and information system usage.
CCI-003068	Review and update the rules of behavior in accordance with organization-defined frequency.
CCI-003069	Defines the frequency with which to review and update the rules of behavior.
CCI-003070	Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge, on an organization-defined frequency, and/or when the rules of behavior are revised or updated.