Rules of Behavior — Privileged Users

Approval #

Revision History #

Review cycle: Every year, and whenever the rules change. Users re-acknowledge every year with the annual training, and after each revision.

Mandate. National Institute of Standards and Technology (NIST) SP 800-53 PL-4(1) requires rules of behavior addressing the added responsibilities of users with elevated access. These rules are supplemental to, and acknowledged in addition to, the general Rules of Behavior. Each privileged user must re-acknowledge them at least annually and when the rules are revised or changed.

1. Applicability #

These rules apply to every account with administrative or otherwise elevated privileges on systems operated by or on behalf of the Organization, including domain, application, database, network, and cloud administration.

2. Rules #

As a privileged user, I must, in addition to the general rules:

1. Use privileged access only for the specific administrative tasks it was authorized for, and use my non-privileged account for all other work.
2. Authenticate to privileged functions only with the phishing-resistant, hardware-backed authenticator issued for that purpose (Office of Management and Budget (OMB) M-22-09).
3. Activate elevated roles just-in-time where the platform provides it, and permit the elevation to expire when the task is complete.
4. Never create, modify, or use unauthorized accounts, backdoors, or unapproved remote access paths; never disable or degrade security controls, logging, or monitoring without an approved change record.
5. Make production changes only through the change management process, with security impact analysis and approval recorded before deployment.
6. Never access, read, or exfiltrate user data beyond what the authorized task requires; report any inadvertent access to sensitive data as an incident.
7. Protect privileged session artifacts (keys, tokens, session records) as sensitive information; never store credentials in scripts, code repositories, or unencrypted files.
8. Accept heightened monitoring of privileged sessions and cooperate with audit and investigation requests.
9. Complete role-based privileged-user training before elevation and Every year thereafter.
10. Report immediately any suspected compromise of a privileged account or authenticator as a High-severity incident.

3. Acknowledgment #

Each privileged user signs this acknowledgment before getting elevated access. Each privileged user signs it again every year with the annual role-based training, and again whenever the rules change. The Information System Security Officer (ISSO) compares the acknowledgments with the list of privileged accounts. The ISSO refers a user who has not re-acknowledged to the user’s supervisor.

I have read, understand, and agree to comply with these Privileged Rules of Behavior in addition to the general Rules of Behavior.

4. References #

These are the sources this document cites, with a link to each official text.

• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.