AC.L2-3.1.22
Control Public Information [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.22 in the reference catalog with its NIST cross-references
Official requirement
Control CUI posted or processed on publicly accessible systems.
Assessment objectives
a. individuals authorized to post or process information on publicly accessible systems are identified;
b. procedures to ensure CUI is not posted or processed on publicly accessible systems are identified;
c. a review process is in place prior to posting of any content to publicly accessible systems;
d. content on publicly accessible systems is reviewed to ensure that it does not include CUI; and
e. mechanisms are in place to remove and address improper posting of CUI.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prevent controlled information from being posted or processed on public systems.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company decides to start issuing press releases about its projects in an effort to reach more potential customers . Your company receives CUI from the government as part of its DoD contract. Because you recognize the need to manage c ontrolled information, including CUI, you meet with the employees who write the releases and post information to establish a review process [c]. It is decided that you will review press releases for CUI before posting it on the company website [ a,d]. Only certain employees will be authorized to post to the website [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing publicly accessible content; system security plan; list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites; system audit logs and records; security awareness training records; other relevant documents or records
Common mistakes
Reviewing a website only at launch rather than controlling later publications.