Practice AC.L2-3.1.22 Details - Revision history

David at 01:21, 16 March 2025

2025-03-16T01:21:33Z

← Older revision		Revision as of 01:21, 16 March 2025
Line 21:		Line 21:
	'''Interview'''		'''Interview'''

	[SELECT FROM: Personnel with responsibilities for managing publicly accessible information posted on organizational systems;personnel with information security responsibilities].		[SELECT FROM: Personnel with responsibilities for managing publicly accessible information posted on organizational systems; personnel with information security responsibilities].

	'''Test'''		'''Test'''

David: David moved page Practice AC.L1-3.1.22 Details to Practice AC.L2-3.1.22 Details

2025-03-10T03:50:54Z

David moved page Practice AC.L1-3.1.22 Details to Practice AC.L2-3.1.22 Details

← Older revision		Revision as of 03:50, 10 March 2025
(No difference)

David at 03:50, 10 March 2025

2025-03-10T03:50:41Z

← Older revision		Revision as of 03:50, 10 March 2025
Line 1:		Line 1:
	'''Source of Reference: The official [https://~~www~~.~~acq~~.~~osd.mil~~/cmmc/~~documentation.html~~ CMMC Level ~~1 Self-~~Assessment Guide] from the ~~Office of the Under Secretary~~ of Defense ~~Acquisition & Sustainment~~.'''		'''Source of Reference: The official [https://dodcio.defense.gov/cmmc/Resources-Documentation/ CMMC Level 2 Assessment Guide] from the Department of Defense Chief Information Officer (DoD CIO).'''

	For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION ==		== AC.L2-3.1.22 – CONTROL PUBLIC INFORMATION ==
			Level 1 Reference: AC.L1-b.1.iv
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===
	Control information posted or processed on publicly accessible information systems.		Control information posted or processed on publicly accessible information systems.
Line 16:		Line 17:
	'''Examine'''		'''Examine'''

	[SELECT FROM: Access control policy; procedures addressing publicly accessible content;system security plan;list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites;system audit logs and records;security awareness training records;other relevant documents or records].		[SELECT FROM: Access control policy; procedures addressing publicly accessible content; system security plan; list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites; system audit logs and records; security awareness training records; other relevant documents or records].

	'''Interview'''		'''Interview'''
Line 26:		Line 27:
	[SELECT FROM: Mechanisms implementing management of publicly accessible content].		[SELECT FROM: Mechanisms implementing management of publicly accessible content].
	=== DISCUSSION ===		=== DISCUSSION ===
	In accordance with laws, Executive Orders, directives, policies, regulations, or standards, the public is not authorized access to nonpublic information (e.g., information protected under the Privacy Act, FCI, and proprietary information). This requirement addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Individuals authorized to post FCI onto publicly accessible systems are designated.The content of information is reviewed prior to posting onto publicly accessible systems to ensure that nonpublic information is not included.		In accordance with laws, Executive Orders, directives, policies, regulations, or standards, the public is not authorized access to nonpublic information (e.g., information protected under the Privacy Act, FCI, and proprietary information). This requirement addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Individuals authorized to post FCI onto publicly accessible systems are designated. The content of information is reviewed prior to posting onto publicly accessible systems to ensure that nonpublic information is not included.
	=== FURTHER DISCUSSION ===		=== FURTHER DISCUSSION ===
	Do not allow FCI to become public – always safeguard the confidentiality of FCI by controlling the posting of FCI on company-controlled websites or public forums, and the exposure of FCI in public presentations or on public displays. It is important to know which users are allowed to publish information on publicly accessible systems, like your company website, and implement a review process before posting such information. If FCI is discovered on a publicly accessible system, procedures should be in place to remove that information and alert the appropriate parties.		Do not allow FCI to become public – always safeguard the confidentiality of FCI by controlling the posting of FCI on company-controlled websites or public forums, and the exposure of FCI in public presentations or on public displays. It is important to know which users are allowed to publish information on publicly accessible systems, like your company website, and implement a review process before posting such information. If FCI is discovered on a publicly accessible system, procedures should be in place to remove that information and alert the appropriate parties.

Wikiadmin at 18:53, 23 February 2022

2022-02-23T18:53:04Z

← Older revision		Revision as of 18:53, 23 February 2022
Line 8:		Line 8:
	=== ASSESSMENT OBJECTIVES ===		=== ASSESSMENT OBJECTIVES ===
	Determine if:		Determine if:
	[a] individuals authorized to post or process information on publicly accessible systems are identified;		: [a] individuals authorized to post or process information on publicly accessible systems are identified;
	[b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified;		: [b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified;
	[c] a review process is in place prior to posting of any content to publicly accessible systems;		: [c] a review process is in place prior to posting of any content to publicly accessible systems;
	[d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and		: [d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and
	[e] mechanisms are in place to remove and address improper posting of FCI.		: [e] mechanisms are in place to remove and address improper posting of FCI.
	=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===		=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
	'''Examine'''		'''Examine'''

	[SELECT FROM: Access control policy; procedures addressing publicly accessible content;system security plan;list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites;system audit logs and records;security awareness training records;other relevant documents or records].		[SELECT FROM: Access control policy; procedures addressing publicly accessible content;system security plan;list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites;system audit logs and records;security awareness training records;other relevant documents or records].

	'''Interview'''		'''Interview'''

	[SELECT FROM: Personnel with responsibilities for managing publicly accessible information posted on organizational systems;personnel with information security responsibilities].		[SELECT FROM: Personnel with responsibilities for managing publicly accessible information posted on organizational systems;personnel with information security responsibilities].

	'''Test'''		'''Test'''

	[SELECT FROM: Mechanisms implementing management of publicly accessible content].		[SELECT FROM: Mechanisms implementing management of publicly accessible content].
	=== DISCUSSION ===		=== DISCUSSION ===
Line 28:		Line 31:

	'''Example'''		'''Example'''

	Your company decides to start issuing press releases about its projects in an effort to reach more potential customers. Your company receives FCI from the government as part of its DoD contract. Because you recognize the need to manage controlled information, including FCI, you meet with the employees who write the releases and post information to establish a review process [c]. It is decided that you will review press releases for FCI before posting it on the company website [a,d]. Only certain employees will be authorized to post to the website [a].		Your company decides to start issuing press releases about its projects in an effort to reach more potential customers. Your company receives FCI from the government as part of its DoD contract. Because you recognize the need to manage controlled information, including FCI, you meet with the employees who write the releases and post information to establish a review process [c]. It is decided that you will review press releases for FCI before posting it on the company website [a,d]. Only certain employees will be authorized to post to the website [a].

Wikiadmin at 18:16, 23 February 2022

2022-02-23T18:16:42Z

← Older revision		Revision as of 18:16, 23 February 2022
Line 1:		Line 1:
			'''Source of Reference: The official [https://www.acq.osd.mil/cmmc/documentation.html CMMC Level 1 Self-Assessment Guide] from the Office of the Under Secretary of Defense Acquisition & Sustainment.'''

			For inquiries and reporting errors on this wiki, please [mailto:support@cmmctoolkit.org contact us]. Thank you.

	== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION ==		== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION ==
	=== SECURITY REQUIREMENT ===		=== SECURITY REQUIREMENT ===

Wikiadmin: Created page with "== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION == === SECURITY REQUIREMENT === Control information posted or processed on publicly accessible information systems. === ASSESSMENT OBJECTIVES === Determine if: [a] individuals authorized to post or process information on publicly accessible systems are identified; [b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified; [c] a review process is in place prior to posting of any co..."

2022-02-23T17:56:52Z

Created page with "== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION == === SECURITY REQUIREMENT === Control information posted or processed on publicly accessible information systems. === ASSESSMENT OBJECTIVES === Determine if: [a] individuals authorized to post or process information on publicly accessible systems are identified; [b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified; [c] a review process is in place prior to posting of any co..."

New page

== AC.L1-3.1.22 – CONTROL PUBLIC INFORMATION ==
=== SECURITY REQUIREMENT ===
Control information posted or processed on publicly accessible information systems.
=== ASSESSMENT OBJECTIVES ===
Determine if:
[a] individuals authorized to post or process information on publicly accessible systems are identified;
[b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified;
[c] a review process is in place prior to posting of any content to publicly accessible systems;
[d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and
[e] mechanisms are in place to remove and address improper posting of FCI.
=== POTENTIAL ASSESSMENT METHODS AND OBJECTS ===
'''Examine'''
[SELECT FROM: Access control policy; procedures addressing publicly accessible content;system security plan;list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites;system audit logs and records;security awareness training records;other relevant documents or records].

'''Interview'''
[SELECT FROM: Personnel with responsibilities for managing publicly accessible information posted on organizational systems;personnel with information security responsibilities].

'''Test'''
[SELECT FROM: Mechanisms implementing management of publicly accessible content].
=== DISCUSSION ===
In accordance with laws, Executive Orders, directives, policies, regulations, or standards, the public is not authorized access to nonpublic information (e.g., information protected under the Privacy Act, FCI, and proprietary information). This requirement addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Individuals authorized to post FCI onto publicly accessible systems are designated.The content of information is reviewed prior to posting onto publicly accessible systems to ensure that nonpublic information is not included.
=== FURTHER DISCUSSION ===
Do not allow FCI to become public – always safeguard the confidentiality of FCI by controlling the posting of FCI on company-controlled websites or public forums, and the exposure of FCI in public presentations or on public displays. It is important to know which users are allowed to publish information on publicly accessible systems, like your company website, and implement a review process before posting such information. If FCI is discovered on a publicly accessible system, procedures should be in place to remove that information and alert the appropriate parties.

'''Example'''
Your company decides to start issuing press releases about its projects in an effort to reach more potential customers. Your company receives FCI from the government as part of its DoD contract. Because you recognize the need to manage controlled information, including FCI, you meet with the employees who write the releases and post information to establish a review process [c]. It is decided that you will review press releases for FCI before posting it on the company website [a,d]. Only certain employees will be authorized to post to the website [a].

'''Potential Assessment Considerations'''
* Does information on externally facing systems (i.e., publicly accessible) have a documented approval chain for public release [c]?
=== KEY REFERENCES ===
* FAR Clause 52.204-21 b.1.iv
* NIST SP 800-171 Rev 2 3.1.22