AC-22 protects against an embarrassing and common failure: private information appearing on a public page. It has four parts. Designate who may publish, train them, review content before posting, and review what is live on a schedule, removing anything nonpublic.
800-53 binds federal systems and, by contract, some suppliers. The same discipline applies to any company with a website, a docs site or a public repository.
What it means in practice
The guidance says the control covers systems the organization controls that are open to the public, usually without login. Posting on outside sites such as forums or social media is covered by policy. The control is about managing the people who publish.
In practice it comes down to a short list of publishers, a pre publication check, and a recurring sweep.
Evidence to collect
- The list of authorized publishers and their approval.
- Training records for those people.
- A review step in the publishing workflow, such as a required approval.
- Sweep records with dates, findings and removals.
Common gaps
- Everyone in marketing can publish.
- Reviews exist for pages but not for uploaded files or repositories.
- Nobody checks for exposed internal documents after launch.
How to implement it
Restrict publishing permissions, require a second reader, and schedule a sweep that searches your public sites for internal markers and secrets.
Quick check
Does AC-22 cover posts on social media?
No. The guidance says non organizational sites are covered by organizational policy. AC-22 addresses systems you control.
Sources
- NIST SP 800-53 Rev 5, AC-22: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-22
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
