[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpl-4":3},{"item":4,"lessons":18,"controls":44,"related":50},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pl-4","PL-4","Rules of Behavior",6,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must establish rules of behaviour for individuals with system access, receive their documented acknowledgement before granting access, review and update the rules and require reacknowledgement when they change.\n\n**In practice.** Doing this well means a clear, readable acceptable use policy covering devices, data handling, email, internet, AI tools and reporting duties, acknowledged at onboarding and after significant updates. Auditors expect the current rules, acknowledgement records and review history. ISO\u002FIEC 27001 acceptable use controls are similar. Separate rules for privileged users can set higher expectations.\n\n**Common gaps.** Rules are often long legal documents nobody reads, and acknowledgements are not refreshed after changes. Guidance on newer issues such as generative AI tools is frequently missing. Contractors may also never be asked to acknowledge the rules.","a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy;\n  b. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system;\n  c. Review and update the rules of behavior [Assignment: organization-defined frequency] ; and\n  d. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection: {{ insert: param, pl-04_odp.03 }} ; when the rules are revised or updated].\nDiscussion: Rules of behavior represent a type of access agreement for organizational users. Other types of access agreements include nondisclosure agreements, conflict-of-interest agreements, and acceptable use agreements (see [PS-6](#ps-6) ). Organizations consider rules of behavior based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users, including individuals who receive information from federal systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for organizational and non-organizational users can also be established in [AC-8](#ac-8) . The related controls section provides a list of controls that are relevant to organizational rules of behavior. [PL-4b](#pl-4_smt.b) , the documented acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"gdpr-violation-unredacted-court-judgment-shared-on-social-media","GDPR Violation: Unredacted Court Judgment Shared on Social Media","2026-09-16T09:21:06.529+00:00",{"slug":25,"title":26,"published_at":27},"spanish-newspaper-fined-20000-for-failing-to-anonymize-assault-video-under-gdpr-1789546927841","Spanish Newspaper Fined €20,000 for Failing to Anonymize Assault Video Under GDPR","2026-09-16T08:22:07.651+00:00",{"slug":29,"title":30,"published_at":31},"austrian-court-rules-unredacted-personal-data-in-legal-decisions-violates-privacy-rights","Austrian Court Rules Unredacted Personal Data in Legal Decisions Violates Privacy Rights","2026-09-15T12:20:53.047+00:00",{"slug":33,"title":34,"published_at":35},"italian-sports-facility-fined-8000-for-unlawful-cctv-surveillance-of-pool-users","Italian Sports Facility Fined €8,000 for Unlawful CCTV Surveillance of Pool Users","2026-09-14T14:21:29.034+00:00",{"slug":37,"title":38,"published_at":39},"italian-dpa-fines-public-entity-for-unlawful-publication-of-sensitive-personal-data","Italian DPA Fines Public Entity for Unlawful Publication of Sensitive Personal Data","2026-09-08T14:20:23.38+00:00",{"slug":41,"title":42,"published_at":43},"catalan-council-fined-for-publishing-unredacted-personal-data-and-ignoring-dpa-requests","Catalan Council Fined for Publishing Unredacted Personal Data and Ignoring DPA Requests","2026-08-04T12:20:51.858+00:00",[45],{"slug":46,"name":47,"problem":48,"stories":49},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",1,[51,56,61,66,70,75,79,83],{"family":52,"item":53,"code":54,"title":55,"together":9},"cis","3","Control 3","Data Protection",{"family":57,"item":58,"code":59,"title":60,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":52,"item":62,"code":63,"title":64,"together":65},"14","Control 14","Security Awareness and Skills Training",4,{"family":57,"item":67,"code":68,"title":69,"together":65},"6","Article 6","Lawfulness of processing",{"family":5,"item":71,"code":72,"title":73,"together":74},"at-2","AT-2","Literacy Training and Awareness",3,{"family":76,"item":77,"code":78,"title":78,"together":74},"itil","overview","ITIL",{"family":57,"item":80,"code":81,"title":82,"together":74},"9","Article 9","Processing of special categories of personal data",{"family":57,"item":84,"code":85,"title":86,"together":87},"35","Article 35","Data protection impact assessment",2]