AC-22 Publicly Accessible Content

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	None

Related controls: AC-3, AT-2, AT-3, AU-13

Control statement

• a. Designate individuals authorized to make information publicly accessible;
• b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;
• c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and
• d. Review the content on the publicly accessible system for nonpublic information [Assignment: organization-defined frequency] and remove such information, if discovered.

NIST discussion

In accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including information protected under the PRIVACT and proprietary information. Publicly accessible content addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Posting information on non-organizational systems (e.g., non-organizational public websites, forums, and social media) is covered by organizational policy. While organizations may have individuals who are responsible for developing and implementing policies about the information that can be made publicly accessible, publicly accessible content addresses the management of the individuals who make such information publicly accessible.

Assessment objectives (SP 800-53A)

Objectives and methods for AC-22

Determine if:

• AC-22a. designated individuals are authorized to make information publicly accessible;
• AC-22b. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;
• AC-22c. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;
• AC-22d.
  • AC-22d.[01] the content on the publicly accessible system is reviewed for non-public information [Assignment: organization-defined frequency];
  • AC-22d.[02] non-public information is removed from the publicly accessible system, if discovered.

Examine: Access control policy; procedures addressing publicly accessible content; list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to non-public information on public websites; system audit logs; security awareness training records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems; organizational personnel with information security responsibilities.

Test: Mechanisms implementing management of publicly accessible content.

Policy statement

• The System owner shall designate the individuals authorized to make information publicly accessible. (AC-22a)
• The System owner shall ensure those individuals are trained to keep nonpublic information out of publicly accessible content. (AC-22b)
• The designated individuals shall review proposed content for nonpublic information before posting it on the publicly accessible system. (AC-22c)
• The designated individuals shall review the content on the publicly accessible system for nonpublic information Fill in: the frequency at which to review the content on the publicly accessible system for non-public information Typical: quarterly. (AC-22d)
• The designated individuals shall remove nonpublic information when a review discovers it. (AC-22d)

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-22 is about the people who post content to the organization’s public-facing systems. You designate who may post, train them to keep nonpublic information out, review content before it is posted, and review what is already posted on a set schedule, removing any nonpublic information found. It covers systems the organization controls; posting on outside sites and social media is a matter for policy and the Rules of Behavior (PL-4(1)).

Common implementations. A web content management system in which only designated publishers hold the publish role, with an approval step before anything goes live. Role-based training for publishers (AT-3) on what counts as nonpublic information, including personally identifiable information and document metadata. A scheduled review of the public site, often helped by a scan for personal data patterns, internal host names and files left in public folders. Cloud storage and file shares set to public access are publicly accessible content too, so they belong in the review.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Frequency of reviews of posted content for nonpublic information (d)	Quarterly

In the Access Control policy, the system owner designates and trains the publishers, and the designated individuals do the reviews and removals.

Evidence assessors ask for.

• The list of individuals authorized to post, compared with the publish role in the content management system
• Training records for those individuals, for example from the training record log
• A sample of recently posted items, each with its review record from before posting
• Records of the last periodic reviews, with any removals made

Inheritance. The organization’s public website and its communications team are often a common control. The system owns any public interface it serves itself, and who may post to it.

Common findings.

• Publishing rights held by many staff who are not designated.
• Documents posted with metadata, tracked changes or comments that reveal internal information.
• Public storage buckets or file shares holding internal files.
• Periodic reviews not done, or done with no record.
• Old pages listing staff contact details or internal system information.

Enhancements in the Moderate baseline. None. AC-22 has no enhancements.

Federal systems (as of September 2026). The Privacy Act forbids disclosing a record in a system of records “by any means of communication to any person” without the individual’s written request or prior written consent, except under the conditions in 5 U.S.C. § 552a(b), so posting such a record publicly needs one of those conditions. For controlled unclassified information, 32 CFR 2002.18(e) states that decontrolling CUI “does not constitute authorization for public release”. Publishers therefore check both before content goes on a public system.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy