PL-4—Rules of Behavior

Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;

Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;

Review and update the rules of behavior ⚙organization-defined frequency; and

Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection (one or more): ⚙organization-defined frequency; when the rules are revised or updated].