- Adopt standard banner text reviewed once against your CUI and monitoring-consent obligations; do not improvise per system.
- Deploy through policy (group policy, MDM, portal settings) rather than per machine, so coverage survives rebuilds.
- Cover the paths people actually log into — workstation, VPN, VDI, web portals — not just the domain logon screen.
03.01.09OFFICIAL TITLEPENDING NIST SME REVIEW
03.01.09 — System Use Notification
03.01 Access Control · NIST SP 800-171 Rev. 3
Independent summary of the official requirement
Requires displaying an organization-defined system use notification message with privacy and security notices, consistent with applicable CUI rules, before granting access to the system (aligned to SP 800-53 AC-8).
Rev. 3 requirement text is multi-part and parameterized with organization-defined values, so this site summarizes rather than reproduces it. The summary is independent — read the official publication for the binding wording.
NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
Before logon, users see a banner: this is a company system, use is monitored, CUI handling rules apply. It is one of the cheapest requirements in the catalog — get the wording reviewed once, then push the banner to Windows logon, VPN, and remote portals through policy and leave it alone.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The approved banner text and the policy objects that deploy it
- Screenshots of the banner on sampled access paths
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this came from in Rev. 2
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A Rev. 3 — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |