In Episode 8 of my NIST SP 800-53 Rev 5 Access Control explanatory series, I break down AC-8: System Use Notification (the warning banner). I walk you through what the control is really asking for—display a defined system use notification before access is granted, make sure it includes the right privacy/security notices, and keep it on the screen until the user takes explicit action to accept it and proceed. I also show what a “good” banner looks like and why that explicit “OK/I Accept” click matters for assessment. I read the core AC-8 requirements and simplify the key language you need: users are accessing a U.S. Government (or org) system, usage may be monitored/recorded/audited, unauthorized use is prohibited and may lead to penalties, and using the system indicates consent. Then I get into a real-world takeaway: internal systems vs public-facing systems are not the same—public systems often require legal and privacy review of the banner content. Finally, I explain how I test AC-8 during an SCA/self-assessment: review policy/procedures and the SSP, compare banner screenshots to documented requirements, and validate on the live system that access does not continue until the user explicitly acknowledges the notice.