AC-21 Information Sharing

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	2 (0 in a baseline)

Related controls: AC-3, AC-4, AC-16, PT-2, PT-7, RA-3, SC-15

Control statement

• a. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined information-sharing circumstances] ; and
• b. Employ [Assignment: organization-defined automated mechanisms] to assist users in making information sharing and collaboration decisions.

NIST discussion

Information sharing applies to information that may be restricted in some manner based on some formal or administrative determination. Examples of such information include, contract-sensitive information, classified information related to special access programs or compartments, privileged information, proprietary information, and personally identifiable information. Security and privacy risk assessments as well as applicable laws, regulations, and policies can provide useful inputs to these determinations. Depending on the circumstances, sharing partners may be defined at the individual, group, or organizational level. Information may be defined by content, type, security category, or special access program or compartment. Access restrictions may include non-disclosure agreements (NDA). Information flow techniques and security attributes may be used to provide automated assistance to users making sharing and collaboration decisions.

Control enhancements

AC-21(1) Automated Decision Support

Baselines: Not in a baseline

Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

Discussion and assessment objectives for AC-21(1)

Automated mechanisms are used to enforce information sharing decisions.

Determine if [Assignment: organization-defined automated mechanisms] are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

Examine: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); system design documentation; system configuration settings and associated documentation; system-generated list of users authorized to make information-sharing/collaboration decisions; system-generated list of sharing partners and access authorizations; system-generated list of access restrictions regarding information to be shared; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Automated mechanisms implementing access authorizations supporting information-sharing/user collaboration decisions.

AC-21(2) Information Search and Retrieval

Baselines: Not in a baseline

Implement information search and retrieval services that enforce [Assignment: organization-defined information-sharing restrictions].

Discussion and assessment objectives for AC-21(2)

Information search and retrieval services identify information system resources relevant to an information need.

Determine if information search and retrieval services that enforce [Assignment: organization-defined information-sharing restrictions] are implemented.

Examine: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); system design documentation; system configuration settings and associated documentation; system-generated list of access restrictions regarding information to be shared; information search and retrieval records; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with access enforcement responsibilities for system search and retrieval services; system/network administrators; organizational personnel with information security responsibilities; system developers.

Test: System search and retrieval services enforcing information-sharing restrictions.

Assessment objectives (SP 800-53A)

Objectives and methods for AC-21

Determine if:

• AC-21a. authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined information-sharing circumstances];
• AC-21b. [Assignment: organization-defined automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions.

Examine: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); system design documentation; system configuration settings and associated documentation; list of users authorized to make information-sharing/collaboration decisions; list of information-sharing circumstances requiring user discretion; non-disclosure agreements; acquisitions/contractual agreements; system security plan; privacy plan; privacy impact assessment; security and privacy risk assessments; other relevant documents or records.

Interview: Organizational personnel responsible for information-sharing/collaboration decisions; organizational personnel with responsibility for acquisitions/contractual agreements; system/network administrators; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms or manual process implementing access authorizations supporting information-sharing/user collaboration decisions.

Policy statement

• The System owner shall enable authorized users to determine whether the access authorizations of a sharing partner match the information’s access and use restrictions for Fill in: information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions Typical: sharing sensitive or contract-restricted information with partners outside the organization. (AC-21a)
• The System owner shall employ Fill in: automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions Typical: information labels and a data-sharing checklist to assist users in making information sharing and collaboration decisions. (AC-21b)

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-21 helps users decide whether they may share restricted information with a particular partner. For the circumstances you define, users need a way to check that the partner’s access authorizations match the information’s access and use restrictions, and a tool or process that helps them decide. NIST’s discussion gives contract-sensitive, proprietary and privileged information, personally identifiable information, and special access program information as examples of restricted information.

Sharing partners may be individuals, groups or whole organizations, and restrictions may include non-disclosure agreements. AC-21 supports the user’s decision; enforcing it automatically is AC-21(1), which is in no baseline.

Common implementations. Sensitivity labels on documents, email and collaboration sites that tell users the restrictions on the information and can warn or block when it is shared outside the organization. A data-sharing checklist that asks, before anything restricted goes out: is there an agreement or non-disclosure agreement, does it cover this information, is the recipient authorized, and is only what is needed being shared. A register of sharing partners, with what each is authorized to receive, that users can look up. External sharing settings in collaboration tools limited to approved partner domains. Where systems exchange information, the information exchange agreement records the information types and restrictions.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Information-sharing circumstances that need user discretion (a)	Sharing sensitive or contract-restricted information with partners outside the organization
Automated mechanisms or manual processes that assist users (b)	Information labels and a data-sharing checklist

The Access Control policy gives both duties to the system owner.

Evidence assessors ask for.

• The procedure or checklist users follow for sharing decisions
• The label definitions and their configuration, showing what each label restricts
• The list of sharing partners, with their agreements and what each is authorized to receive
• External sharing settings in the email and collaboration tools
• A sample of recent external shares of restricted information, each traced to a checklist or agreement

Inheritance. Labels and collaboration tool settings are usually common controls, set for the whole organization. The system owns the restrictions on its own information and the list of partners it shares with.

Common findings.

• Labels defined but rarely applied, or not checked when information is shared.
• Users with no way to find out what a partner is authorized to receive.
• Collaboration sites that allow sharing with anyone who has the link.
• Sharing that continues after the agreement or non-disclosure agreement has expired.

Enhancements in the Moderate baseline. None. AC-21 is not in the Low baseline, and High adds no enhancements. AC-21(1) automated decision support and AC-21(2) information search and retrieval are in no baseline.

Federal systems (as of September 2026). Before disseminating controlled unclassified information to a non-executive branch entity, authorized holders “must reasonably expect that all intended recipients are authorized to receive the CUI and have a basic understanding of how to handle it” (32 CFR 2002.16(a)(4)). Agencies should share CUI with such entities under a formal agreement whenever feasible, and the agreement must require compliance with Executive Order 13556, 32 CFR Part 2002 and the CUI Registry (2002.16(a)(5)(i)). For personally identifiable information, the Privacy Act forbids disclosing a record in a system of records without the individual’s written request or prior written consent, except under the conditions in 5 U.S.C. § 552a(b).

Artifacts

• Access Control Decision Worksheet
• Access Control Policy