Rules of Behavior

Rules of Behavior template: The rules every person with system access reads and signs before access is granted, including social media and external site restrictions, with a register of acknowledgments, as SP 800-53 PL-4 requires.

Type	Program stage	Status	Template version	NIST basis
Form or register	Foundation	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The rules every person with system access reads and signs before access is granted, including social media and external site restrictions, with a register of acknowledgments, as SP 800-53 PL-4 requires.

Controls satisfied

Control	Title
PL-4	Rules of Behavior
PL-4(1)	Social Media and External Site/Application Usage Restrictions
PE-17	Alternate Work Site

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

The register as a spreadsheet: CSV, with one column per field.

Preview (annotated)

Guidance

PL-4 asks for rules that tell each person what they are responsible for and how they must behave when using the organization’s information and systems, and for a signed acknowledgment before access is granted. Assessors sample new accounts and check that each has an acknowledgment dated before the account was created, and that people re-acknowledged after the rules last changed. Keep the rules short enough that people read them: link to the policies for detail. Add rules for privileged users, or keep a separate set for them.

Organization	Rules version	Effective date	Owner
Organization name	Fill in: version	Fill in: date	Chief Information Security Officer

Who these rules apply to

These rules apply to everyone who needs access to Organization name’s information or systems, including employees, contractors and partners. You must read and sign them before you are given access, and again Select one or more: [Assignment: organization-defined frequency]; when the rules are revised or updated Typical: annually, and when the rules are revised or updated (PL-4b, PL-4d). Where re-acknowledgment is periodic, it is due Fill in: frequency for individuals to read and re-acknowledge the rules of behavior Typical: annually.

Your responsibilities

Accounts and passwords

• Use only the accounts issued to you, and only for the purposes they were issued for (AC-2).
• Keep your passwords, security keys and other authenticators to yourself. Never share them or write them where others can find them (IA-5).
• Lock your screen when you leave your device, and log off at the end of the day (AC-11).

Information

• Access only the information you need for your work (AC-6).
• Handle information according to its marking or sensitivity, and never remove it from approved systems without authorization (MP-4).
• Do not send organizational information to personal email, messaging or storage accounts.

Privacy

• Use personally identifiable information only for the purpose it was collected for, and only when your work requires it (PT-2).
• Share personally identifiable information only with people authorized to receive it.

Devices and software

• Use only devices the organization issued or approved to access its systems (AC-19).
• Do not install software, browser extensions or services that the organization has not approved (CM-11).
• Do not disable or bypass security software or settings.
• Report a lost or stolen device immediately.

Remote work

• Connect remotely only through the organization’s approved remote access methods, listed in its remote access standard (AC-17).
• Do not let others use your device while you are connected to organizational systems.
• At an alternate work site, such as your home, work where others cannot see your screen or overhear your conversations, keep paper and media secured and never leave them unattended, and do not print information not approved for public release on a personal printer (PE-17).

Social media and external sites

• Do not use social media, social networking sites or other external sites and applications for organizational business unless Fill in: who approves such use, for example your manager and the communications team has approved it (PL-4(1)(a)).
• Do not post organizational information on public websites unless it has been approved for public release (PL-4(1)(b)).
• Do not use your organizational email address or other organization-provided identifiers to create accounts on external sites or applications, except for approved business use (PL-4(1)(c)).
• Never use the password or other authentication secret for an organizational account on any external site or application (PL-4(1)(c)).

Monitoring

• Organization name monitors the use of its systems, as the notice you see when you log on states (AC-8). Use of the systems means you agree to that monitoring.

Reporting

• Report a suspected security or privacy incident, including a phishing message you clicked, to Fill in: where to report, for example the service desk at a phone number or address within Fill in: time to report, for example one hour of noticing it (IR-6).

Consequences

• Breaking these rules may lead to loss of access and to action under the organization’s sanctions process (PS-8).
• Failing to report a suspected incident, or delaying a report, breaks these rules and has the same consequences (IR-6, PS-8).

Federal systems

OMB Memorandum M-17-12 (January 3, 2017), section VI, requires everyone with access to federal information and information systems to report a suspected or confirmed breach of personally identifiable information, in any medium, including paper, oral and electronic, as soon as possible and without unreasonable delay, and not to wait for confirmation that a breach has occurred. The same section requires agencies to establish rules of behavior that include consequences for violating them, to include in those rules the consequences for failing to comply with the memorandum’s reporting requirements, and to ensure that employees and contractors have read and agreed to the rules before being granted access. As of October 2026, add these rules for a federal system:

• Report a suspected or confirmed breach of personally identifiable information, in any form, including paper and spoken disclosures, to Fill in: where to report a breach, for example the incident response email address or toll-free number as soon as possible and without unreasonable delay. Do not wait until you are sure a breach has occurred, and report a lost device even if you think you may find it (IR-6).
• Failing to report a suspected or confirmed breach as these rules require may lead to Fill in: the consequences, for example loss of access and disciplinary or contractual action under the agency’s policies (PS-8).

Acknowledgment

I have read these rules of behavior, I understand them, and I agree to follow them (PL-4b).

Name	Title or role	Signature	Date
Fill in: name	Fill in: title or role		Fill in: date

Maintaining these rules

Guidance

The acknowledgment must be recorded before access is authorized, so the account manager checks the register before creating the account (AC-2). Most organizations collect acknowledgments in the training or HR system; export the records into this register, or point to them, for the assessor.

• The Chief Information Security Officer shall provide these rules to each person who requires access to the system, before access is requested. (PL-4a)
• The Account manager shall confirm that a signed acknowledgment is recorded before authorizing access. (PL-4b)
• The Chief Information Security Officer shall review and update these rules Fill in: frequency for reviewing and updating the rules of behavior Typical: annually. (PL-4c)
• The Chief Information Security Officer shall require each person who acknowledged a previous version to read and re-acknowledge the rules as the section “Who these rules apply to” states. (PL-4d)

Register

Name	Title or role	Rules version	Date acknowledged	Access granted on	Recorded by
Fill in: name	Fill in: title or role	Fill in: version	Fill in: date	Fill in: date	Fill in: name