Privacy & Security Notices

A notice at initial logon carries this requirement.

Display the notice where human users log on, at or before authentication. A notice on every application and system behind that first logon is a risk-based choice, not a requirement. The underlying discussion says a secondary notification is something you consider, not something you owe. One well-placed banner beats twenty inconsistent ones.

Write your own text. Do not copy the DoD banner.

The standard DoD banner speaks for U.S. Government information systems and never mentions CUI, the controlled unclassified information your contract requires you to protect. Yours is a private system that handles government information. Cover the essentials: use may be monitored and recorded, use constitutes consent, unauthorized use is prohibited and carries penalties, and the system may contain CUI to be handled per your policy. Have counsel review it, because the banner's function is legal notice, not decoration.

A generic CUI statement is enough.

Objective [a] ties notices to CUI-specified rules, and few categories impose special notice requirements. Stating that the system may contain CUI and pointing to your handling policy satisfies the association. You do not need to enumerate CUI categories in the banner.

The display can take several forms.

A logon banner, a desktop background carrying the notice, a Terms of Use acknowledgment enforced at sign-in through conditional access, or printed notices posted where no screen exists all satisfy [b]. Pick what each platform supports, keep a screenshot of each, and note in the system security plan which form covers which system.