Control statement
- a.Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;
- b.Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;
- c.Review and update the rules of behavior [Organization-defined: frequency] ; and
- d.Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Organization-defined: pl-04_odp.02].
Discussion
Rules of behavior represent a type of access agreement for organizational users. Other types of access agreements include nondisclosure agreements, conflict-of-interest agreements, and acceptable use agreements (see [PS-6](#ps-6) ). Organizations consider rules of behavior based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users, including individuals who receive information from federal systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for organizational and non-organizational users can also be established in [AC-8](#ac-8) . The related controls section provides a list of controls that are relevant to organizational rules of behavior. [PL-4b](#pl-4_smt.b) , the documented acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Rules of Behavior as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to security and privacy planning, architecture, rules of behavior, and lifecycle alignment.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- system security and privacy plans
- architecture and data-flow diagrams
- rules-of-behavior acknowledgments
- plan review and approval records
Common failure patterns
- plans copied from templates without system specificity
- diagrams that do not match deployed services
- inherited controls claimed without provider evidence
- plans updated only before assessment
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PL-04a.
- PL-04a.[01]rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system;
- PL-04a.[02]rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system;
- PL-04b.before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received;
- PL-04c.rules of behavior are reviewed and updated [Organization-defined: frequency];
- PL-04d.individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [Organization-defined: pl-04_odp.02].
Examine
- Security and privacy planning policy
- procedures addressing rules of behavior for system users
- rules of behavior
- signed acknowledgements
- records for rules of behavior reviews and updates
- other relevant documents or records
Interview
- Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior
- organizational personnel with responsibility for literacy training and awareness and role-based training
- organizational personnel who are authorized users of the system and have signed and resigned rules of behavior
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior
- mechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PL-4(1) — Social Media and External Site/Application Usage Restrictions
Include in the rules of behavior, restrictions on:
- (a)Use of social media, social networking sites, and external sites/applications;
- (b)Posting organizational information on public websites; and
- (c)Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
Official discussion
Social media, social networking, and external site/application usage restrictions address rules of behavior related to the use of social media, social networking, and external sites when organizational personnel are using such sites for official duties or in the conduct of official business, when organizational information is involved in social media and social networking transactions, and when personnel access social media and networking sites from organizational systems. Organizations also address specific rules that prevent unauthorized entities from obtaining non-public organizational information from social media and networking sites either directly or through inference. Non-public information includes personally identifiable information and system account information.
Assessment objectives and methods
- PL-04(01)(a)the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;
- PL-04(01)(b)the rules of behavior include restrictions on posting organizational information on public websites;
- PL-04(01)(c)the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
Examine
- Security and privacy planning policy
- procedures addressing rules of behavior for system users
- rules of behavior
- training policy
- other relevant documents or records
Interview
- Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior
- organizational personnel with responsibility for literacy training and awareness and role-based training
- organizational personnel who are authorized users of the system and have signed rules of behavior
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for establishing rules of behavior
- mechanisms supporting and/or implementing the establishment of rules of behavior
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.