03.01.09: Privacy & Security Notices

Beyond CMMC Level 1

The free web app covers the 17 CMMC Level 1 practices. This requirement is part of the full NIST 800-171 set — get the desktop app to work on all 110 requirements with SPRS scoring. Previously saved data is shown read-only below, and your data always remains exportable in full.

Get the desktop app

Security Requirements for 03.01.09 Privacy & Security Notices

System use notifications can be implemented using messages or warning banners displayed before individuals log in to organizational systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Based on a risk assessment, organizations consider whether a secondary system use notification is needed to access applications or other system resources after the initial network logon. Where necessary, posters or other printed materials may be used in lieu of an automated system banner. Organizations consult with the Office of General Counsel for legal review and approval of warning banner content.

Assessment GuidanceExamine 0/9

How an assessor determines this requirement is met. Source: CMMC Assessment Guide – Level 2, Version 2.13 (NIST SP 800-171 Rev. 2).

Discussion

Every system containing or providing access to CUI has legal requirements concerning user privacy and security notices. One method of addressing this requirement is the use of a system-use notification banner that displays the legal requirements of using the system. Users may be required to click to agree to the displayed requirements of using the system each time they log on to the machine. This agreement can be used in the civil and/or criminal prosecution of an attacker that violates the terms. The legal notification should meet all applicable requirements. At a minimum, the notice should inform the user that:

information system usage may be monitored or recorded, and is subject to audit; unauthorized use of the information systems is prohibited; unauthorized use is subject to criminal and civil penalties;

use of the information system affirms consent to monitoring and recording;

the information system contains CUI with specific requirements imposed by the Department of Defense; and

use of the information system may be subject to other specified requirements associated with certain types of CUI such as Export Controlled information.

Examples

Example 1
You are setting up IT equipment including a database server that will contain CUI. You have worked with legal counsel to draft a notification. It contains both general and specific CUI security and privacy requirements [a]. The system displays the required security and privacy information before anyone logs on to your organization’s computers that contain or provide access to CUI [b].

Assessment Methods

Examine

The process of reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, procedures, plans, system designs, mechanisms) to facilitate understanding, achieve clarification, or obtain evidence.Example: An assessor reads the access control policy and inspects system configuration settings to confirm they match.

Not all of the evidence listed is required to meet this requirement — check the items your organization has collected.

Privacy and security policies, procedures addressing system use notification
Documented approval of system use notification messages or banners
System audit logs and records
System design documentation
User acknowledgements of notification message or banner
System security plan
System use notification messages
System configuration settings and associated documentation
Other relevant documents or records

Interview

The process of holding discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or identify the location of evidence.Example: An assessor asks a system administrator to describe how user accounts are approved, reviewed, and disabled.

System or network administrators
Personnel with information security responsibilities
Personnel with responsibility for providing legal advice
System developers

Test

The process of exercising assessment objects (e.g., activities, mechanisms) under specified conditions to compare actual behavior with expected behavior.Example: An assessor attempts to sign in with a disabled account to confirm that access is denied.

Mechanisms implementing system use notification

Potential Assessment Considerations

Are objectives identified for privacy and security notices, and does the implementation satisfy the required objectives [a, b]?
Discrepancies may indicate a deficient process and/or an incomplete objective for the overall requirement. Are there any special requirements associated with the specific CUI category [a]?
Are appropriate notices displayed in areas where paper-based CUI is stored and processed [b]?

Key References

NIST SP 800-171 Rev. 2 3.1.9

Overview