# PL-04 Rules of Behavior

NIST SP 800-53 control. Family: PL Planning. Function: preventative. Baselines: low, moderate, high, privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Establish and provide to individuals requiring access to the system, the rules that describe their responsibilities and expected behavior for information and system usage, security, and privacy; b. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system; c. Review and update the rules of behavior [Assignment: organization-defined frequency]; and d. Require individuals who have acknowledged a previous version of the rules of behavior to read and re-acknowledge [Selection (one or more): [Assignment: organization-defined frequency]; when the rules are revised or updated].
Guidance: Rules of behavior represent a type of access agreement for organizational users. Other types of access agreements include nondisclosure agreements, conflict-of-interest agreements, and acceptable use agreements (see PS-06). Organizations consider rules of behavior based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users. Establishing rules of behavior for some types of non-organizational users, including individuals who receive information from federal systems, is often not feasible given the large number of such users and the limited nature of their interactions with the systems. Rules of behavior for organizational and non-organizational users can also be established in AC-08. The related controls section provides a list of controls that are relevant to organizational rules of behavior. PL-04b, the documented acknowledgment portion of the control, may be satisfied by the literacy training and awareness and role-based training programs conducted by organizations if such training includes rules of behavior. Documented acknowledgements for rules of behavior include electronic or physical signatures and electronic agreement check boxes or radio buttons.

## Enhancements (1)
- PL-04(01) Social Media and External Site/Application Usage Restrictions. Baselines: low, moderate, high, privacy
Each enhancement's statement: /api/v1/controls/PL-04?fields=enhancements

## Patterns that use it (7)
- Important (5): SP-014 Awareness and Training Pattern; SP-018 Information Security Management System; SP-024 iPhone Pattern; SP-035 Offensive Security Testing; SP-036 Incident Response
- Standard (2): SP-001 Client Module; SP-044 SaaS Identity Lifecycle Management

## Clauses by framework (51 frameworks)
- iso_27001_2022: 7.4, A.5.4, A.5.10, A.5.31, A.6.2. OSA's own, not in NIST's crosswalk: 7.4, A.5.31
- iso_27002_2022: 5.10, 5.31, 6.2
- cobit_2019: MEA03
- pci_dss_v4: 12.2
- nist_csf_2: GV.OC-03. OSA's own, not in NIST's crosswalk: GV.OC-03
- soc2_tsc: CC1.1
- iso_42001_2023: A.9.2, A.9.4
- bsi_grundschutz: ORP.5
- anssi: Hygiene.1, Hygiene.3, SecNumCloud.8.2
- osfi_b13: B-13.1.1
- finma_circular: IV.B.a(48), IV.B.a(49)
- gdpr: Art.29, Art.39(1)(b)
- dora: Art.5(4)
- bio2: 5.10, 5.31, 6.2
- rbi_csf: ITGRCA.24
- lgpd_bcb: BCB.Art.4, LGPD.Art.47, LGPD.Art.50
- mlps_2: 8.1.6
- dnb_good_practice: DNB.9.1
- cbuae: CR-14
- nca_ecc: 1-7
- qatar_nia: GV, HR
- uae_ia: T3, T5
- bog_cisd: CISD-COMP, CISD-I
- cbe_csf: GOV-3
- cbn_csf: Part1.3, Part7.1
- sa_js2: JS2-4
- bcbs_239: Principle 1
- cpmi_pfmi: CG.GOV
- eba_ict: 3.4.7
- ecb_croe: CROE.2.1.2, CROE.2.3.2
- ffiec_is: I.A, I.B, II.C.1, II.C.7, II.C.7(d)
- hipaa_sr: §164.308(a)(1)(ii)(C), §164.310(b), §164.316(a)
- iosco_cyber: PROT-4
- nydfs_500: 500.4
- sebi_cscrf: GV.PO
- cmmc_2: AT
- tiber_eu: TIBER.CONF, TIBER.PREP
- isae_3402: Clause 2
- fca_sysc_13: SYSC 13.5.1, SYSC 13.6.5
- fda_21_cfr_11: §11.10(j)
- fda_cyber: TR-1, TR-3
- hitrust_csf: 00.a, 02.a, 02.b, 04.a
- iso_27799: 7.2, 8.3, 9.4, 18.1
- lloyds_ms: MS8.13
- naic_ds: 4-training, 10
- nhs_dspt: NDG-1.3, NDG-2.1
- pra_ss1_23: P2.3, P3.6
- owasp_masvs_v2: MASVS-PRIVACY-3
- csa_ccm_v4: HRS-02, HRS-08, HRS-13
- csa_aicm: HRS-02, HRS-08, HRS-13
- basel_sco60: SCO60.60
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PL-04
- Clauses only: /api/v1/controls/PL-04?fields=mappings
- Page for people: /controls/pl-04/