# NIST 800-171 3.1.9 Provide privacy and security notices consistent with applicable CUI rules.

- Source: https://support.icompaas.com/support/solutions/articles/62000229233-nist-800-171-3-1-9-provide-privacy-and-security-notices-consistent-with-applicable-cui-rules-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:** 

System use notifications can be implemented using messages or warning banners displayed before individuals log in to organizational systems. System use notifications are used only for access via logon interfaces with human users and are not required when such human interfaces do not exist. Based on a risk assessment, organizations consider whether a secondary system use notification is needed to access applications or other system resources after the initial network logon. Where necessary, posters or other printed materials may be used in lieu of an automated system banner. Organizations consult with the Office of General Counsel for legal review and approval of warning banner content 

  

**Priority:** High 

  

**Category: Personnel Security** 

  

**Services Associated with AWS:** 

AWS Identity and Access Management (IAM)

  

**Objective Evidence:** 

-   Administrative: documented policies, standards & procedures 
-   Administrative: documented data classification scheme 
-   Technical: screen shot of privacy / security notice(s)

  

**Possible Technology Considerations:** 

-   **Data Classification Scheme** 

  

**What needs to be answered:**

Are users notified either on computers or in an employee policy how to handle CUI? 

  

-   Ensure Consistent Display of Privacy and Security Notices  
    Description: This check verifies that privacy and security notices are displayed before individuals log in to organizational systems, in compliance with CUI rules.
-   Validate System Use Notifications for Different Access Levels  
    Description: This check ensures that, based on a risk assessment, secondary system use notifications are displayed when necessary to access applications or other system resources after the initial network logon.
-   Confirm Use of Printed Materials for System Use Notification  
    Description: Where necessary, this check confirms that posters or other printed materials are used in lieu of an automated system banner to provide privacy and security notices.
-   Ensure Legal Approval of Warning Banner Content  
    Description: This check verifies that the content of warning banners and other system use notifications have been reviewed and approved by the organization's Office of General Counsel.

  

**More details:**  Company developers undergo training regarding handling CUI containing systems.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.