AC.L2-3.1.9—Privacy & Security Notices
Level 2
800-171: 3.1.9
>Control Description
Provide privacy and security notices consistent with applicable CUI rules.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern the content and display of privacy and security notices?
- •How do you ensure notices are consistent with CUI requirements?
- •What is your process for reviewing and updating security notices?
- •Who is responsible for maintaining and approving notice content?
Technical Implementation:
- •How are privacy and security notices technically displayed at logon?
- •What mechanisms present banners before system access?
- •How do you ensure notices are displayed for all access methods?
- •What tools verify that notices are properly configured?
- •How are notices implemented for different system types (web, desktop, mobile)?
Evidence & Documentation:
- •What documentation demonstrates your access control policies and procedures?
- •What access control matrices or permissions documentation can you provide?
- •What access request and approval records can you show?
- •What access review documentation demonstrates periodic reviews?
- •What audit logs demonstrate access control enforcement?
- •What screenshots or configuration exports show access control settings?
Ask AI
Configure your API key to use AI features.