id: "AC-08" title: "System Use Notification" family: "AC" family_name: "Access Control" sort_id: "ac-08" priority: "P1" implementation_level: "system"
Display {{ insert: param, ac-08_odp.01 }} to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
Users are accessing a U.S. Government system;
System usage may be monitored, recorded, and subject to audit;
Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
Use of the system indicates consent to monitoring and recording;
Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
For publicly accessible systems:
Display system use information {{ insert: param, ac-08_odp.02 }} , before granting further access to the publicly accessible system;
Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
Include a description of the authorized uses of the system.
Guidance
System use notifications can be implemented using messages or warning banners displayed before individuals log in to systems. System use notifications are used only for access via logon interfaces with human users. Notifications are not required when human interfaces do not exist. Based on an assessment of risk, organizations consider whether or not a secondary system use notification is needed to access applications or other system resources after the initial network logon. Organizations consider system use notification messages or banners displayed in multiple languages based on organizational needs and the demographics of system users. Organizations consult with the privacy office for input regarding privacy messaging and the Office of the General Counsel or organizational equivalent for legal review and approval of warning banner content.
Assessment Objective: {{ insert: param, ac-08_odp.01 }} is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
Assessment Objective: the system use notification states that users are accessing a U.S. Government system;
Assessment Objective: the system use notification states that system usage may be monitored, recorded, and subject to audit;
Assessment Objective: the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
Assessment Objective: the system use notification states that use of the system indicates consent to monitoring and recording;
Assessment Objective: the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system;
Assessment Objective: for publicly accessible systems, system use information {{ insert: param, ac-08_odp.02 }} is displayed before granting further access to the publicly accessible system;
Assessment Objective: for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed;
Assessment Objective: for publicly accessible systems, a description of the authorized uses of the system is included.
Access control policy
privacy and security policies, procedures addressing system use notification
documented approval of system use notification messages or banners
system audit records
user acknowledgements of notification message or banner
system design documentation
system configuration settings and associated documentation
system use notification messages
system security plan
privacy plan
privacy impact assessment
privacy assessment report
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
legal counsel
system developers
Mechanisms implementing system use notification