Rules of Behavior — General Users

Approval #

Revision History #

Review cycle: Every year, and whenever the rules change. Users re-acknowledge every year with the annual training, and after each revision.

Mandate. National Institute of Standards and Technology (NIST) SP 800-53 PL-4 and Office of Management and Budget (OMB) Circular A-130 Appendix I require written rules of behavior. The rules describe each user’s responsibilities and expected behavior when using information and systems. Each user must acknowledge the rules before getting access. After that, each user must re-acknowledge them at least annually and when the rules are revised or changed.

1. Applicability #

These rules apply to every person granted access to information systems operated by or on behalf of the Organization: employees, contractors, interns, and other authorized users. Acknowledgment is a condition of access. Violations are subject to the sanctions process in the Personnel Security policy and may result in removal of access and disciplinary or legal action.

2. Rules #

As an authorized user, I must:

1. Use organizational systems and information only for authorized purposes, and consent to monitoring of that use as displayed in the system use notification.
2. Complete security and privacy awareness training before receiving access and every year thereafter.
3. Protect my authenticators: never share credentials, never reuse organizational passwords on external services, and use the organization-issued multi-factor authenticator for all access.
4. Access only the information required for my duties, and never attempt to circumvent access controls, security configurations, or monitoring.
5. Handle sensitive information, including Controlled Unclassified Information (CUI) and personally identifiable information (PII), according to its marking. Store it only in approved locations, encrypt it in transit outside the Organization, and never move it to personal accounts, devices, or unapproved services.
6. Use only organization-furnished or explicitly approved devices and software for organizational information; install no unauthorized software.
7. Lock my session when unattended and log off at the end of use.
8. Report suspected security incidents, phishing, lost or stolen equipment, and suspected PII breaches immediately to the IT Service Desk and my supervisor.
9. Connect remotely only through approved remote access services; never through unauthorized tunnels, personal virtual private networks (VPNs), or split-tunnel configurations.
10. Understand that I have no expectation of privacy in my use of organizational systems, and that misuse may result in loss of access and disciplinary action.

3. Acknowledgment #

Each user signs this acknowledgment before getting access. Each user signs it again every year when completing the annual awareness training, and again whenever the rules change. The Information System Security Officer (ISSO) compares the training records in the learning management system (LMS) with the list of account holders. The ISSO refers a user who has not re-acknowledged to the user’s supervisor.

I have read, understand, and agree to comply with these Rules of Behavior.