`AC-08` System Use Notification

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version

first version loaded AC Low baseline Moderate baseline High baseline

Title

System Use Notification

Control

a. Display [Assignment: system use notification] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and state that:
1. Users are accessing a U.S. Government system;
2. System usage may be monitored, recorded, and subject to audit;
3. Unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
4. Use of the system indicates consent to monitoring and recording;
b. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system; and
c. For publicly accessible systems:
1. Display system use information [Assignment: conditions] , before granting further access to the publicly accessible system;
2. Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and
3. Include a description of the authorized uses of the system.

Discussion

System use notifications can be implemented using messages or warning banners displayed before individuals log in to systems. System use notifications are used only for access via logon interfaces with human users. Notifications are not required when human interfaces do not exist. Based on an assessment of risk, organizations consider whether or not a secondary system use notification is needed to access applications or other system resources after the initial network logon. Organizations consider system use notification messages or banners displayed in multiple languages based on organizational needs and the demographics of system users. Organizations consult with the privacy office for input regarding privacy messaging and the Office of the General Counsel or organizational equivalent for legal review and approval of warning banner content.

Parameters

ac-08_odp.01: system use notification
ac-08_odp.02: conditions

Related controls

ac-14, pl-4, si-4

STIG rules that implement this control 35

Apple iOS/iPadOS 26 V1R3

AIOS-26-008400 CAT III Apple iOS/iPadOS 26 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.
AIOS-26-011700 CAT II Apple iOS/iPadOS 26 must implement the management setting: not share location data through iCloud.

Apple iOS/iPadOS 27 V1R1

AIOS-27-008100 CAT III Apple iOS/iPadOS 27 (MOS) must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.
AIOS-27-010900 CAT II Apple iOS/iPadOS 27 must implement the management setting: not share location data through iCloud.

Apple macOS 15 (Sequoia) V1R8

APPL-15-000023 CAT II The macOS system must display a policy banner at remote login.
APPL-15-000024 CAT II The macOS system must enforce SSH to display a policy banner.
APPL-15-000025 CAT II The macOS system must display the Standard Mandatory DoW Notice and Consent Banner at the login window.

Apple macOS 26 (Tahoe) V1R4

APPL-26-000023 CAT II The macOS system must display a policy banner at remote login.
APPL-26-000024 CAT II The macOS system must enforce SSH to display a policy banner.
APPL-26-000025 CAT II The macOS system must display the Standard Mandatory DoW Notice and Consent Banner at the login window.

Application Security and Development V6R5

APSC-DV-000550 CAT III The application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application.
APSC-DV-000560 CAT III The application must retain the Standard Mandatory DoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.
APSC-DV-000570 CAT III The publicly accessible application must display the Standard Mandatory DoW Notice and Consent Banner before granting access to the application.

Canonical Ubuntu 22.04 LTS V2R10

UBTU-22-255020 CAT II Ubuntu 22.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting any local or remote connection to the system.
UBTU-22-271010 CAT II Ubuntu 22.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon.
UBTU-22-271015 CAT II Ubuntu 22.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon.

Canonical Ubuntu 24.04 LTS V1R7

UBTU-24-200640 CAT II Ubuntu 24.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting access to via an SSH logon.
UBTU-24-200650 CAT II Ubuntu 24.04 LTS must enable the graphical user logon banner to display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon.
UBTU-24-200660 CAT II Ubuntu 24.04 LTS must display the Standard Mandatory DoW Notice and Consent Banner before granting local access to the system via a graphical user logon.

Cisco IOS XE Router NDM Y26M04

CISC-ND-000160 CAT II The Cisco router must be configured to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the device.

Google Android 16 COBO Y26M10

GOOG-16-007700 CAT III Google Android 16 must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

Google Android 17 COBO Y26M06

GOOG-17-006800 CAT III Google Android 17 must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

Microsoft Windows 11 V2R11

WN11-SO-000075 CAT II The required legal notice must be configured to display before console logon.

Microsoft Windows Server 2022 V2R11

WN22-SO-000130 CAT II Windows Server 2022 required legal notice must be configured to display before console logon.

Microsoft Windows Server 2025 V1R4

WN25-SH-000020 CAT II Windows Server 2025 OpenSSH must display the Standard Mandatory DoW Notice and Consent Banner before granting remote access to the system via an OpenSSH logon.
WN25-SO-000130 CAT II The Windows Server 2025 required legal notice must be configured to display before console logon.

Red Hat Enterprise Linux 10 V1R3

RHEL-10-700020 CAT II RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user login.
RHEL-10-700030 CAT II RHEL 10 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.
RHEL-10-700040 CAT II RHEL 10 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user login.

Red Hat Enterprise Linux 9 V2R10

RHEL-09-211020 CAT II RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a command line user logon.
RHEL-09-255025 CAT II RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a SSH logon.
RHEL-09-271010 CAT II RHEL 9 must enable the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
RHEL-09-271011 CAT II RHEL 9 must display the Standard Mandatory DoW Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
RHEL-09-271015 CAT II RHEL 9 must prevent a user from overriding the banner-message-enable setting for the graphical user interface.

Samsung Android 16 COBO Y26M10

KNOX-16-006700 CAT III Samsung Android must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

AC-08 System Use Notification