System Use Notification AC-8

Access Control · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds AC-8 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-8 (System Use Notification) is about showing people a warning notice — a login banner — before they are allowed onto the system. The banner states the ground rules: what system they are accessing, that activity may be monitored, recorded, and audited, that unauthorized use is prohibited and can carry penalties, and that logging on counts as consent to that monitoring and recording. It sits in the Low baseline, so even a basic system is expected to have one.

What good looks like

Show the notice before access is granted — at the login prompt, not after the person is already inside.
State the four points the control asks for: users are accessing this system, usage may be monitored, recorded, and audited, unauthorized use is prohibited and subject to penalties, and logging on means consenting to that monitoring and recording.
Keep the message on the screen until the user acknowledges it and takes an explicit action to log on — they should not be able to skip past it.
Cover every human login path — the local console and remote SSH (Secure Shell, the encrypted remote-login protocol) — so the notice cannot be dodged by picking a different door.
For a publicly accessible system, show authorized-use information before further access, and word any monitoring notice to fit the privacy expectations of a public service.

Framework mapping

How to move it toward Implemented

Write the banner text once, then place it where logins read it: /etc/issue for the local console and /etc/issue.net for network logins.
Turn it on for SSH by setting Banner /etc/issue.net in /etc/ssh/sshd_config, then reload the service so the notice shows before the password prompt (sudo systemctl reload ssh on Debian/Ubuntu, or sudo systemctl reload sshd on Red Hat systems).
Test it from another machine — run ssh user@host and confirm the banner appears before you are asked to authenticate — and save that transcript as a dated file.
Attach the banner text and that login test as hardening evidence on the asset, naming AC-8 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.