PL-4(1) Rules of Behavior | Social Media and External Site/Application Usage Restrictions
Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information on public websites; and (c) Use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.
Source: NIST SP 800-53 Rev 5, PL-4(1). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.
Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Procedures addressing rules of behavior for system users · Policy repository / GRC workspace
- Rules of behavior · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Test of Organizational processes for establishing rules of behavior; mechanisms supporting and/or implementing the establishment of rules of behavior · Document repository
governing documentDocuments that govern the control
- Security and privacy planning policy · Policy repository / GRC workspace
- Training policy · HR system / LMS
First move
Common gaps auditors find
- Rules of behavior do not restrict posting organizational information on public websites or social media
- Rules of behavior do not prohibit using organization email addresses and passwords to create accounts on external sites
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet