NIST Guidance on 800-171 3.1.9
What exactly does NIST 800-171 3.1.9 say?
What about the "DISCUSSION" section? Do I need a logon banner?
What about the "DISCUSSION" section? Do I need a logon banner?
Requirement
Provide privacy and security notices consistent with applicable CUI rules.
DISCUSSION
System use notifications can be implemented using messages or warning banners displayed before individuals log in to organizational systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Based on a risk assessment, organizations consider whether a secondary system use notification is needed to access applications or other system resources after the initial network logon. Where necessary, posters or other printed materials may be used in lieu of an automated system banner. Organizations consult with the Office of General Counsel for legal review and approval of warning banner content.
What about the "DISCUSSION" section? Do I need a logon banner?
What about the "DISCUSSION" section? Do I need a logon banner?
What about the "DISCUSSION" section? Do I need a logon banner?
NIST SP 800-171 R2 Page 8
A discussion section follows each CUI security requirement providing additional information to facilitate the implementation and assessment of the requirements. This information is derived primarily from the security controls discussion sections in [SP 800-53] and is provided to give organizations a better understanding of the mechanisms and procedures used to implement the controls used to protect CUI.
The discussion section is informative, not normative. It is not intended to extend the scope of a requirement or to influence the solutions organizations may use to satisfy a requirement. The use of examples is notional, not exhaustive, and not reflective of potential options available to organizations.
What does NIST say about the importance of 3.1.9?
What about the "DISCUSSION" section? Do I need a logon banner?
What does NIST say about the importance of 3.1.9?
NIST SP 800-171A documents a standard methodology for assessing NIST SP 800-171 compliance and scoring CMMC.
It assigns a weighted score value of 1-5 for each security requirement based on the potential impact to the information system. There are 51 requirements, including 3.1.9, that have a weighted score value of 1.
Requirements with a point value of 1 are said to have "limited or indirect effect on the security of the network and its data".
Copyright © 2021 800-171 3.1.9 Mug - All Rights Reserved.
This website uses cookies.
We use cookies to analyze website traffic and optimize your website experience. By accepting our use of cookies, your data will be aggregated with all other user data.