CMMC · Rev 2.132AC · Access Control

AC.L2-3.1.9

Privacy & Security Notices

Requirement

Provide privacy and security notices consistent with applicable CUI rules.

Assessment objectives

An assessor checks each lettered objective separately. The letters in brackets elsewhere on this page, such as [a] or [b,c], refer to these.

Determine if:

aprivacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
bprivacy and security notices are displayed.

From the CMMC Level 2 Assessment Guide v2.13 · publisher approved 2026-10-31.

Further discussion

Every system containing or providing access to CUI has legal requirements concerning user privacy and security notices. One method of addressing this requirement is the use of a system-use notification banner that displays the legal requirements of using the system. Users may be required to click to agree to the displayed requirements of using the system each time they log on to the machine. This agreement can be used in the civil and/or criminal prosecution of an attacker that violates the terms. The legal notification should meet all applicable requirements. At a minimum, the notice should inform the user that: • information system usage may be monitored or recorded, and is subject to audit; • unauthorized use of the information systems is prohibited; • unauthorized use is subject to criminal and civil penalties; • use of the information system affirms consent to monitoring and recording; • the information system contains CUI with specific requirements imposed by the Department of Defense; and • use of the information system may be subject to other specified requirements associated with certain types of CUI such as Export Controlled information. Example You are setting up IT equipment including a database server that will contain CUI. You have worked with legal counsel to draft a notification. It contains both general and specific CUI security and privacy requirements [a]. The system displays the required security and privacy information before anyone logs on to your organization’s computers that contain or provide access to CUI [b]. Potential Assessment Considerations • Are objectives identified for privacy and security notices, and does the implementation satisfy the required objectives [a,b]? Discrepancies may indicate a deficient process and/or an incomplete objective for the overall requirement. • Are there any special requirements associated with the specific CUI category [a]? • Are appropriate notices displayed in areas where paper-based CUI is stored and processed [b]?

Practice guide notes

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Show the required privacy and security notices before system use.

Implementation example

Example from the source assessment guide (not a mandatory implementation): You are setting up IT equipment including a database server that will contain CUI. You have worked with legal counsel to draft a notification. It contains both general and specific CUI security and privacy requirements [a]. The system displays the required security and privacy information before anyone logs on to your organization’s computers that contain or provide access to CUI [b].

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): Privacy and security policies, procedures addressing system use notification; documented approval of system use notification messages or banners; system audit logs and records; system design documentation; user acknowledgements of notification message or banner; system security plan; system use notification messages; system configuration settings and associated documentation; other relevant documents or records

Common mistakes

Displaying a generic welcome message without the required organizational notice.

Crosswalk

Full crosswalk

The NIST requirements this practice is built on, what NIST made of each in the newer edition, and the SP 800-53 controls behind them, each from an official NIST or DoD table. Open any one to read it and see every CMMC practice it supports. How this crosswalk is built

NIST SP 800-171 Rev 2SP 800-171 Rev 3SP 800-53 Rev 4SP 800-53 Rev 5

NIST SP 800-171 Rev 2

SP 800-171 Rev 3

SP 800-53 Rev 4

SP 800-53 Rev 5

Rev 5 paths: D SP 800-171 Rev 2 Appendix D → SP 800-53 Rev 4 control → NIST's Rev 4 → Rev 5 comparison; S source control of the SP 800-171 Rev 3 or SP 800-172 Rev 3 requirement (NIST OSCAL); C SP 800-172 (Feb 2021) Appendix C. The Rev 3 requirement also carries other Rev 2 requirements (hover for which).

Where each link comes from (5 links from 5 official documents)

32 CFR Part 170 Office of the Federal Register / GPO

AC.L2-3.1.9 → 3.1.9“Level 2 security requirement”32 CFR 170.14(c)(1) numbering (REQ is the NIST SP 800-171 R2 requirement number) and 170.14(c)(3)

NIST SP 800-171 Rev 2 → Rev 3 change analysis NIST

3.1.9 → 03.01.09“No Significant Change”sheet "Change Analysis 800-171 R2-R3" row 10

NIST SP 800-171 Rev 2 NIST

3.1.9 → AC-8“Appendix D mapping”p.76 Table D-1

NIST SP 800-53 Rev 4 → Rev 5 comparison NIST

AC-8 → AC-8“Changes discussion”sheet "Rev4 Rev5 Compared" row 84

NIST SP 800-171 Rev 3 (OSCAL) NIST

03.01.09 → AC-8“Source control”control 03.01.09 link rel=reference (AC-08)

How to implement

Show users the privacy and security notices the CUI rules require before they use systems that handle CUI, and apply any category-specific markings or handling notices your contract calls out. For most contractors this is a sign-in banner on every device and portal, a notice in the email signature or template where CUI is exchanged, and the CUI marking/banner on documents.

1
ProcessIdentify which notices apply: check the CUI Registry category for your data (for example Controlled Technical Information, Export Controlled) and your contract's marking and dissemination requirements; write the exact banner text and document which CUI categories it covers.[a]
2
TechnicalDisplay a logon banner on Windows (interactive logon message), macOS (login window text via MDM), VPN and firewall portals, and the Microsoft 365 or Google sign-in page (company branding text) stating that the system processes CUI, is monitored, and use implies consent.[b]
3
TechnicalApply CUI banner markings on documents and emails: a sensitivity label that stamps the header/footer (for example 'CUI // SP-CTI') and a required disclaimer in outbound email templates to CUI recipients.[b]
4
ProcessKeep the list of notices, where each is displayed, and screenshots; review when contracts or CUI categories change.[a][b]

Evidence to collect

Artifacts that show the practice is implemented and operating. Tags show which assessment objectives each one supports.

Notice inventory[a]

record · reviewed annually

Table of notices (logon banner, document marking, email notice), the CUI categories they cover, and where they appear.

Logon banner screenshots[b]

screenshot · current configuration

Windows sign-in, macOS login window, VPN portal and cloud sign-in page showing the notice.

Banner configuration[b]

configuration export · current configuration

Intune/Group Policy interactive logon message settings; MDM profile; Entra company branding text.

Document marking sample[b]

record · current configuration

A sample marked CUI document and the sensitivity label configuration.

How assessors check

Examine: Notice inventory, CUI category references, banner configuration, marked document samples, sign-in page screenshots.
Interview: The person who determines CUI categories and markings; the administrator who configured banners.
Test: Sign in to a workstation, the VPN and the cloud tenant and observe the notice; open a labelled document and show the marking.

Tools and products

Named options a contractor can adopt, with an honest cost tier. The industry standard is listed even when it is expensive, alongside what is free and acceptable for a very small shop.

Intune Settings Catalog / Group Policy logon messageLogon bannerFreeGood fit for a small shop

Built-in setting; no extra cost.

Microsoft Purview sensitivity labels (content marking)Document markingPaidWorkable for a small shop

Header/footer marking is available in Business Premium and GCC plans; auto-labelling needs higher tiers.

DoD CUI Program marking guidance and CUI RegistryStandard practiceFreeGood fit for a small shop

Free authoritative sources for exact banner and portion marking text.

Document templates with CUI banners (Word/Google Docs)Document markingFreeGood fit for a small shop

Acceptable for small shops in place of automated labelling, if people are trained to use them.

Editorial mentions, not endorsements. Pricing and tiers change; confirm with the vendor and check FedRAMP or GCC High availability where CUI is involved.

Common pitfalls

A generic 'authorized use only' banner with no connection to the CUI categories you handle.
Banner on Windows but not on the VPN portal, macOS laptops or the cloud sign-in page.
Claiming 'not applicable'; the practice applies whenever CUI rules specify notices, and the DoD CUI marking guide applies to CTI.

Platform notes

Microsoft 365 (GCC / GCC High)

Entra company branding sign-in page text, Intune Settings Catalog 'Interactive logon: Message text/title', Purview sensitivity labels with header/footer content marking.

Google Workspace

Custom sign-in page is limited; use the managed device login banner (Windows/macOS/ChromeOS policy) and Drive labels plus document templates for markings.

On-premises or MSP-managed

Group Policy interactive logon message, firewall/VPN login banner, document templates with CUI banner markings.

Related practices: MP.L2-3.8.4, AT.L2-3.2.1, AT.L2-3.2.2

Editorial implementation guidance published November 2, 2026. It is not part of the official requirement and does not replace the assessment guide.

Track this in a workspace

The compliance workspace tracks each objective, its evidence and the tasks to close gaps. It is open to invited contractors while in pilot: request access below.

Source: DoD CIO · https://dodcio.defense.gov/CMMC/