AC.L2-3.1.9
Privacy & Security Notices
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.9 in the reference catalog with its NIST cross-references
Official requirement
Provide privacy and security notices consistent with applicable CUI rules.
Assessment objectives
a. privacy and security notices required by CUI-specified rules are identified, consistent, and associated with the specific CUI category; and
b. privacy and security notices are displayed.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Show the required privacy and security notices before system use.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are setting up IT equipment including a database server that will contain CUI. You have worked with legal counsel to draft a notification. It contains both general and specific CUI security and privacy requirements [a]. The system displays the required security and privacy information before anyone logs on to your organization’s computers that contain or provide access to CUI [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Privacy and security policies, procedures addressing system use notification; documented approval of system use notification messages or banners; system audit logs and records; system design documentation; user acknowledgements of notification message or banner; system security plan; system use notification messages; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Displaying a generic welcome message without the required organizational notice.