NIST SP 800-53 Rev 5 binds US federal systems, and reaches other organizations through contracts and flow down clauses. For everyone else it is a reference catalog: a detailed, public description of what a control can look like. PL-4, Rules of Behavior, asks for four things. Establish and provide to individuals who need system access the rules that describe their responsibilities and expected behavior for information use, security, and privacy. Get documented acknowledgment, before authorizing access, that they read, understand, and agree. Review and update the rules on a schedule. Require re-acknowledgment when the rules change or on a defined schedule.
What it means in practice
Rules of behavior are a type of access agreement. The guidance points to PS-6 for others, such as nondisclosure and acceptable use agreements. It expects you to differentiate between privileged and general users and to consider the role of each person.
The order matters. Acknowledgment comes before access, not after.
Evidence to collect
- The current rules, with version and approver.
- A signed or electronic acknowledgment for a sample of users, dated before account creation.
- A record of the last review and update.
- Re-acknowledgment records after the latest change.
- Separate rules for privileged users, if you have them.
The record lists one enhancement, PL-4.1 Social Media and External Site and Application Usage Restrictions.
Common gaps
- Acknowledgments collected months after access started.
- One generic document for admins and ordinary users.
- Updates published with no re-acknowledgment.
- Contractors left out.
How to implement it
Put the acknowledgment step in the onboarding workflow so accounts activate only after it is signed. Keep rules short and specific. Send re-acknowledgment by tooling that records timestamps.
Quick check
Is a handbook signature enough?
Only if it covers the system rules and is dated before access. Many teams use a separate acceptance step tied to account creation.
