CMMC System Use Notification Setup for Level 2

A missing login banner can leave an otherwise well-secured CUI environment exposed during an assessment. This notice is a small control with a large compliance footprint because it must appear wherever people authenticate within that environment.

For small business IT teams, the challenge is rarely writing one warning. The real work is finding every Windows device, VPN portal, cloud app, and remote administration path that gives a human user access.

I treat the notice as an access control standard, not a one-time desktop configuration. That documented approach gives you consistent coverage and evidence you can defend.

Key Takeaways

• CMMC Level 2 practice AC.L2-3.1.9 requires an approved privacy and security notice before users receive system access.
• The notice must cover every human authentication path into the CUI boundary, including Windows, Linux, VPN, cloud applications, virtual desktops, and mobile access.
• Banner language should address authorized use, monitoring and recording, prohibited activity, potential civil and criminal penalties, and any applicable CUI category requirements.
• A desktop banner alone is not enough; each access route needs its own configuration, testing, ownership, and documented evidence.
• Strong assessment evidence connects the approved wording and system inventory to screenshots, policy exports, test results, acknowledgment records, and documented exceptions.

CMMC system use notification requirements at Level 2

CMMC Level 2 practice AC.L2-3.1.9 is an access control practice requiring privacy and security notices aligned with applicable Controlled Unclassified Information (CUI) rules and compliance requirements. The DoD CMMC Level 2 Assessment Guide links this notice to relevant assessment objectives and security requirements. The assessor checks whether your organization identifies the required notices for each CUI category and displays them.

The notice is a pre-login or access notice. It tells a person about the legal conditions of using a system before access is granted. The Department of Defense describes system use notifications as messages displayed before individuals log in to organizational systems, often through a pre-login warning banner.

What the banner needs to communicate

Your approved wording should tell users that system activity may undergo monitoring and recording. It should prohibit unauthorized use and state that violations can lead to civil and criminal penalties. It should also explain that continuing indicates consent to monitoring and to recording.

For this environment, the notice should establish that the system handles this information under Department of Defense requirements. If a CUI category has additional handling rules, such as export-controlled information, your notice may need language reflecting those category-specific obligations.

The current NIST SP 800-171 Revision 3 states that organizations must display the notification before granting system access. I recommend placing it before credential submission whenever the platform allows it. At minimum, require acknowledgment before authentication completes or before CUI becomes reachable.

A banner that appears only after a user reaches the desktop, cloud application, or VPN-connected network is too late to prove pre-access notice.

DoDI 5200.48 shapes this requirement by establishing the applicable program and its handling expectations. However, it doesn’t give every contractor one universal paragraph for every login screen. Your legal counsel, security lead, and information program owner should approve wording for federal contract requirements and category-specific obligations.

Map every human access path before deployment

The notice applies to human logon interfaces, not unattended service accounts or machine-to-machine connections. Therefore, an inventory is the first step.

I start with the CUI data-flow map, then identify each point where a person authenticates into that boundary. This includes endpoint security controls, virtual desktops, remote access, and secure cloud architecture. I cross-check those routes against network security paths and identity routes. A data center technology environment may have different entry points than a Microsoft 365-focused contractor, but the review method stays the same.

Access point	Typical notice location	Useful evidence
Windows workstation or server	Windows interactive logon message	Policy report and test screenshot
Linux server	SSH banner and local console notice	sshd_config record and login test
VPN or zero-trust gateway	Portal splash page or acceptance screen	Portal configuration and test account result
Microsoft 365 or cloud app	Entra access notification or terms policy	Policy export and acknowledgment record
Mobile CUI access	MDM-managed app or identity prompt	Device policy and user test evidence

A notice on the Windows desktop does not cover a user who connects through a VPN from an unmanaged home device. Likewise, a VPN notice does not automatically cover direct browser access to a CUI-enabled SaaS application.

Digital transformation often adds identity paths faster than compliance documentation catches up, so update the inventory after each technology change. Cloud management, office moves, and an Office 365 migration can all create new access routes that need review.

Deploy notices across Windows, Linux, VPN, and cloud services

A consistent message matters, but each technology needs its own configuration and test plan. Device hardening baselines should include the notice settings tied to security requirements, so rebuilds and new deployments don’t remove them.

Windows Active Directory and Group Policy

For domain-joined Windows systems, deploy the notice through Active Directory policy. In Group Policy Management, configure these settings:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options

Set both:

• Interactive logon: Message title for users attempting to log on
• Interactive logon: Message text for users attempting to log on

Link the policy to the organizational units that contain CUI endpoints and servers. Test a standard user account at a physical console and through Remote Desktop Protocol. Use gpresult or a policy results report to confirm the policy applies to the intended systems.

Don’t assume a domain policy covers every device. Small businesses often retain local administrator laptops, lab systems, or standalone devices outside Active Directory. Your managed IT for small business provider should either bring those assets under managed policy or document why they’re outside the CUI boundary.

Linux, SSH, and administrative systems

For Linux systems, place a local-console notice in /etc/issue. For SSH access, create an approved banner file such as /etc/issue.net, then set the Banner directive in /etc/ssh/sshd_config to that file path. Reload the SSH service and test with a non-administrative account.

Check both password and public-key authentication. The notice should display before the user gains a shell. Also test any privileged access management platform, bastion host, or web-based console that administrators use.

An assessor won’t reward a configuration that exists only in a change ticket. Capture the system configuration and test date. Retain a screenshot showing the notice before the session is established, not merely a setting somewhere in the platform.

VPN, Microsoft Entra, SaaS, and mobile access

Remote access portals often become the missed route. Configure a splash screen with the warning and acknowledgment prompt. It must appear before the VPN, secure access service edge, or zero-trust product establishes a session.

For cloud infrastructure, use identity-layer controls where possible. Microsoft documents how Microsoft Entra supports these protections, including notifications or banner messages and acknowledgment before application access. Test guest users, member users, mobile users, and users who authenticate through alternate identity flows.

A secure cloud architecture needs coverage beyond the perimeter and its network security controls. If a user can reach SharePoint, Teams, a virtual desktop, or a CUI application directly through a browser, validate that route separately. The notice must appear before the session is established.

Use approved banner language without exposing CUI

The following example provides a starting point for internal review. It isn’t legal advice, so customize it for your organization, contracts, and category-specific requirements. Obtain legal review before publication or deployment, and keep the wording aligned with applicable security requirements.

[Organization Name] Authorized Use Notice
This system is for authorized use only and may contain or provide access to Controlled Unclassified Information (CUI). System activity is subject to monitoring and recording and may be audited. Unauthorized use is prohibited and may subject the user to civil and criminal penalties. By proceeding, you acknowledge these conditions and consent to monitoring. [Insert approved CUI category-specific or contract-specific notice, if required.]

Keep the wording direct enough for a mobile screen or Windows logon prompt. Users should have an acknowledgment option when the platform supports it, especially for VPNs and cloud services.

Do not display actual sensitive information, program names, contract numbers, system architecture details, IP addresses, or incident-response contacts in the banner. The notice should communicate authorized information system usage, not reveal sensitive infrastructure details. The NIST SP 800-171 Revision 2 publication remains useful background for the control’s CMMC lineage, even though NIST withdrew it in 2024.

Physical posters are not a blanket requirement. They can supplement a notice only where a digital notification isn’t feasible, such as a controlled workspace with a specialized interface. They don’t replace a digital message shown before access when a human login interface exists.

Build evidence that an assessor can verify

A well-written notice is only half the work. During a CMMC assessment, assessors verify that the policy applies across your CUI environment. They also verify that users see it before access.

Map each evidence item to the applicable security requirements and assessment objectives. Link every record to its access path, test result, owner, and, where needed, an approved exception. This approach improves audit readiness.

Maintain an evidence package that includes:

• The approved notice standard, notice text, owner, approval date, and legal review.
• A system inventory mapping CUI access points to Windows, Linux, VPN, cloud, VDI, and mobile authentication methods.
• Group Policy reports, Linux system configuration records, VPN or gateway settings, and cloud identity policy exports, each retained with related test evidence, owner, and review date.
• Screenshots or recorded test results showing the notice before access for each method, including the test date, result, and responsible tester.
• Acknowledgment logs or read receipts when your cloud or remote-access platform records them, with the associated account or session.
• An exception register for systems without a human logon interface or systems outside the CUI boundary, with a rationale and documented alignment to compliance requirements.

Common failures are easy to avoid once you look beyond the Windows desktop. I frequently see an apparently compliant GPO paired with an unreviewed VPN portal, direct SharePoint access, or an SSH administration path. Another gap occurs when a notice says “authorized use only” but omits user monitoring, prohibited use, penalties, and the system’s protected-data context.

Technology consulting should connect these details to your broader IT strategy for SMBs. A business technology partner can place the notice requirement into endpoint baselines, cloud onboarding, business continuity planning, security reviews, and change-management procedures.

Frequently Asked Questions

What is a CMMC system use notification?

A CMMC system use notification is a privacy and security notice shown before a person receives access to an information system. It explains authorized use, monitoring, recording, prohibited activity, and potential penalties.

Where must the notice appear?

The notice should appear before access on every human authentication path into the CUI environment. This can include Windows and Linux logons, SSH, VPN portals, Microsoft Entra, SaaS applications, virtual desktops, and mobile access.

Does a Windows Group Policy banner cover VPN and cloud access?

No. A Windows banner applies to the systems covered by that policy and does not automatically cover VPN portals, direct browser access to cloud applications, or unmanaged devices.

What evidence should an organization retain?

Maintain the approved notice standard, system and access-path inventory, policy or configuration exports, and test screenshots showing the message before access. Include test dates, responsible owners, acknowledgment records where available, and documented exceptions for systems without a human login interface.

Can a physical poster replace the digital notice?

Generally, no. A poster may supplement the control where a digital notification is not feasible, but it does not replace a notice displayed before access when a human login interface exists.

A Notice That Holds Up Under Review

A CMMC system use notification is simple only when you view one login screen at a time. Across a hybrid CUI environment, it becomes a documented control that must follow every human access route.

The strongest implementation combines approved wording, pre-access placement, and verifiable testing. That combination gives your team a clear answer when an assessor asks who sees the notice, when they see it, and how you know it works.