- Deploy the banner through group policy or device management so it appears consistently, including on remote access portals.
- Take the wording from the CUI rules and contract clauses that apply to you rather than inventing text.
3.1.9OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.1.9 — Privacy and security notices
3.1 Access Control · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Provide privacy and security notices consistent with applicable CUI rules.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Systems handling CUI present the notices the applicable CUI rules call for — typically a logon banner stating the terms of use and monitoring before a session starts. It is a small requirement, but one that is trivially checkable and therefore trivially findable when absent.
Across revisions
Carried forward as Rev. 3's System Use Notification (03.01.09).
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The deployed banner text and the policy object that delivers it
- Screenshots from a sample of systems and the remote access entry point
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |