Sometimes the first sign of a breach is not in your logs. It is a paste of your data on a public site or a key in a public repository. AU-13 asks you to look outside your own walls.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference.
What the control asks
Monitor defined open source information and information sites, at a frequency you define, for evidence of unauthorized disclosure of organizational information. If a disclosure is discovered, notify defined personnel or roles and take additional defined actions.
NIST's guidance calls unauthorized disclosure a form of data leakage. It names social networking sites and code sharing platforms and repositories as open sources, and gives personal data and proprietary information as examples of what to protect.
The enhancements are AU-13.1 Use of Automated Tools, AU-13.2 Review of Monitored Sites and AU-13.3 Unauthorized Replication of Information.
What it means in practice
Search for your domains, product names, internal project names and secret patterns on code hosting sites and paste sites. Use automated alerts where you can. Define what happens after a hit: contain, rotate, notify.
Evidence to collect
- A list of sites and sources monitored and how often.
- Alert or search configuration.
- A log of reviews.
- An incident record for any disclosure found, with the actions taken.
Common gaps
- Monitoring for brand mentions but not for secrets or customer data.
- No owner for the alerts.
- No documented notification path.
How to implement it
Enable secret scanning on your own repositories, set alerts for your domains and project names on public code hosts, and write a short response runbook.
Quick check
Is secret scanning on our own repos enough?
It helps, but AU-13 looks at open sources outside your control too, where copies or forks may appear.
