AC-8 requires a notice shown to users before they gain access. They must acknowledge it and take an explicit action to continue.
800-53 binds federal systems and, through contract, some suppliers. The statement itself is written for US government systems, so a private company adapts the idea rather than copying the words.
What it means in practice
The text in the control says the banner must state that users are accessing a U.S. Government system, that use may be monitored, recorded and audited, that unauthorized use is prohibited and subject to penalties, and that use means consent. The banner stays on screen until the user acknowledges it.
For publicly accessible systems, the control asks for different content: system use information, references to monitoring consistent with privacy accommodations, and a description of authorized uses.
The guidance says banners apply to logon interfaces with human users, and that legal counsel and the privacy office should review the wording.
Evidence to collect
- A screenshot of the banner at each login point.
- The approved text with the reviewer and date.
- Configuration showing the banner is enforced on servers and workstations.
Common gaps
- A banner on the web login but none on SSH or the VPN.
- Text that was never reviewed by anyone.
- A banner that disappears without acknowledgment.
How to implement it
For a private system, write a short notice: authorized users only, activity may be monitored, misuse may lead to action. Get your counsel to approve it, and configure it at each entry point.
Quick check
Must the banner remain until acknowledged?
Yes. The control requires the notice to stay until the user acknowledges it and takes an explicit action to log on.
Sources
- NIST SP 800-53 Rev 5, AC-8: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-8
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
