# Rules of Behavior

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/rules-of-behavior/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** PL-4 asks for rules that tell each person what they are responsible for and how they must behave when using the organization's information and systems, and for a signed acknowledgment before access is granted. Assessors sample new accounts and check that each has an acknowledgment dated before the account was created, and that people re-acknowledged after the rules last changed. Keep the rules short enough that people read them: link to the policies for detail. Add rules for privileged users, or keep a separate set for them.

| Organization | Rules version | Effective date | Owner |
| --- | --- | --- | --- |
| [Organization name] | [Fill in: version] | [Fill in: date] | [Chief Information Security Officer] |

## Who these rules apply to

These rules apply to everyone who needs access to [Organization name]'s information or systems, including employees, contractors and partners. You must read and sign them before you are given access, and again [Select one or more: [Assignment: organization-defined frequency]; when the rules are revised or updated. Typical: annually, and when the rules are revised or updated] (PL-4b, PL-4d). Where re-acknowledgment is periodic, it is due [Fill in: frequency for individuals to read and re-acknowledge the rules of behavior. Typical: annually].

## Your responsibilities

### Accounts and passwords

- Use only the accounts issued to you, and only for the purposes they were issued for (AC-2).
- Keep your passwords, security keys and other authenticators to yourself. Never share them or write them where others can find them (IA-5).
- Lock your screen when you leave your device, and log off at the end of the day (AC-11).

### Information

- Access only the information you need for your work (AC-6).
- Handle information according to its marking or sensitivity, and never remove it from approved systems without authorization (MP-4).
- Do not send organizational information to personal email, messaging or storage accounts.

### Privacy

- Use personally identifiable information only for the purpose it was collected for, and only when your work requires it (PT-2).
- Share personally identifiable information only with people authorized to receive it.

### Devices and software

- Use only devices the organization issued or approved to access its systems (AC-19).
- Do not install software, browser extensions or services that the organization has not approved (CM-11).
- Do not disable or bypass security software or settings.
- Report a lost or stolen device immediately.

### Remote work

- Connect remotely only through the organization's approved remote access methods, listed in its [remote access standard](https://kston83.github.io/nist-guide/templates/standards/remote-access-standard/) (AC-17).
- Do not let others use your device while you are connected to organizational systems.
- At an alternate work site, such as your home, work where others cannot see your screen or overhear your conversations, keep paper and media secured and never leave them unattended, and do not print information not approved for public release on a personal printer (PE-17).

### Social media and external sites

- Do not use social media, social networking sites or other external sites and applications for organizational business unless [Fill in: who approves such use, for example your manager and the communications team] has approved it (PL-4(1)(a)).
- Do not post organizational information on public websites unless it has been approved for public release (PL-4(1)(b)).
- Do not use your organizational email address or other organization-provided identifiers to create accounts on external sites or applications, except for approved business use (PL-4(1)(c)).
- Never use the password or other authentication secret for an organizational account on any external site or application (PL-4(1)(c)).

### Monitoring

- [Organization name] monitors the use of its systems, as the notice you see when you log on states (AC-8). Use of the systems means you agree to that monitoring.

### Reporting

- Report a suspected security or privacy incident, including a phishing message you clicked, to [Fill in: where to report, for example the service desk at a phone number or address] within [Fill in: time to report, for example one hour] of noticing it (IR-6).

### Consequences

- Breaking these rules may lead to loss of access and to action under the organization's sanctions process (PS-8).
- Failing to report a suspected incident, or delaying a report, breaks these rules and has the same consequences (IR-6, PS-8).

#### Federal systems

[OMB Memorandum M-17-12](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2017/m-17-12_0.pdf) (January 3, 2017), section VI, requires everyone with access to federal information and information systems to report a suspected or confirmed breach of personally identifiable information, in any medium, including paper, oral and electronic, as soon as possible and without unreasonable delay, and not to wait for confirmation that a breach has occurred. The same section requires agencies to establish rules of behavior that include consequences for violating them, to include in those rules the consequences for failing to comply with the memorandum's reporting requirements, and to ensure that employees and contractors have read and agreed to the rules before being granted access. As of October 2026, add these rules for a federal system:

- Report a suspected or confirmed breach of personally identifiable information, in any form, including paper and spoken disclosures, to [Fill in: where to report a breach, for example the incident response email address or toll-free number] as soon as possible and without unreasonable delay. Do not wait until you are sure a breach has occurred, and report a lost device even if you think you may find it (IR-6).
- Failing to report a suspected or confirmed breach as these rules require may lead to [Fill in: the consequences, for example loss of access and disciplinary or contractual action under the agency's policies] (PS-8).

## Acknowledgment

I have read these rules of behavior, I understand them, and I agree to follow them (PL-4b).

| Name | Title or role | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Fill in: title or role] | | [Fill in: date] |

## Maintaining these rules

> **Guidance:** The acknowledgment must be recorded before access is authorized, so the account manager checks the register before creating the account (AC-2). Most organizations collect acknowledgments in the training or HR system; export the records into this register, or point to them, for the assessor.

- The [Chief Information Security Officer] shall provide these rules to each person who requires access to the system, before access is requested. (PL-4a)
- The [Account manager] shall confirm that a signed acknowledgment is recorded before authorizing access. (PL-4b)
- The [Chief Information Security Officer] shall review and update these rules [Fill in: frequency for reviewing and updating the rules of behavior. Typical: annually]. (PL-4c)
- The [Chief Information Security Officer] shall require each person who acknowledged a previous version to read and re-acknowledge the rules as the section "Who these rules apply to" states. (PL-4d)

## Register

| Name | Title or role | Rules version | Date acknowledged | Access granted on | Recorded by |
| --- | --- | --- | --- | --- | --- |
| [Fill in: name] | [Fill in: title or role] | [Fill in: version] | [Fill in: date] | [Fill in: date] | [Fill in: name] |