Overview
  1. 03.01: Access Control
  2. 03.02: Awareness and Training
  3. 03.03: Audit and Accountability
  4. 03.04: Configuration Management
  5. 03.05: Identification and Authentication
  6. 03.06: Incident Response
  7. 03.07: Maintenance
  8. 03.08: Media Protection
  9. 03.09: Personnel Security
  10. 03.10: Physical Protection
  11. 03.11: Risk Assessment
  12. 03.12: Security Assessment and Monitoring
  13. 03.13: System and Communications Protection
  14. 03.14: System and Information Integrity
  15. 03.15: Planning
  16. 03.16: System and Services Acquisition
  17. 03.17: Supply Chain Risk Management

Security Requirements for 03.15.03 Rules of Behavior

Rules of behavior represent a type of access agreement for system users. Organizations consider rules of behavior for the handling of CUI based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users.

Evidence

  1. 03.15.03.a

    Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI.

  1. 03.15.03.b

    Provide rules to individuals who require access to the system.

  1. 03.15.03.c

    Receive a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior before authorizing access to CUI and the system.

  1. 03.15.03.d

    Review and update the rules of behavior at least every 12 months, or when there are significant incidents or significant changes to risks.