NIST SP 800-53 PL-4(1) Social Media and External Site/Application Usage Restrictions

Requirements NIST SOURCE

Include in the rules of behavior, restrictions on:

Discussion (NIST Supplemental Guidance)

Social media, social networking, and external site/application usage restrictions address rules of behavior related to the use of social media, social networking, and external sites when organizational personnel are using such sites for official duties or in the conduct of official business, when organizational information is involved in social media and social networking transactions, and when personnel access social media and networking sites from organizational systems. Organizations also address specific rules that prevent unauthorized entities from obtaining non-public organizational information from social media and networking sites either directly or through inference. Non-public information includes personally identifiable information and system account information.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for PL-4(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;
the rules of behavior include restrictions on posting organizational information on public websites;
the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

Examine

[SELECT FROM: Security and privacy planning policy; procedures addressing rules of behavior for system users; rules of behavior; training policy; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior; organizational personnel with responsibility for literacy training and awareness and role-based training; organizational personnel who are authorized users of the system and have signed rules of behavior; organizational personnel with information security and privacy responsibilities].

Test

[SELECT FROM: Organizational processes for establishing rules of behavior; mechanisms supporting and/or implementing the establishment of rules of behavior].

Overlays

Showing the OT/ICS overlay for the parent control PL-4 — see the PL-4(1) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Base control: Included (matches standard baseline)
Included: (1)

MODERATE

Base control: Included (matches standard baseline)
Included: (1)

HIGH

Base control: Included (matches standard baseline)
Included: (1)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for PL-4(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Security and privacy planning policy
training policy

Testing

Organizational processes for establishing rules of behavior
mechanisms supporting and/or implementing the establishment of rules of behavior

Other Records

procedures addressing rules of behavior for system users
rules of behavior
other relevant documents or records