AC.L1-b.1.iv
Control Public Information [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L1-b.1.iv in the reference catalog with its NIST cross-references
Official requirement
Control information posted or processed on publicly accessible information systems.
Assessment objectives
a. individuals authorized to post or process information on publicly accessible systems are identified;
b. procedures to ensure [FCI] is not posted or processed on publicly accessible systems are identified;
c. a review process is in place prior to posting of any content to publicly accessible systems;
d. content on publicly accessible systems is reviewed to ensure that it does not include [FCI]; and
e. mechanisms are in place to remove and address improper posting of [FCI].
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Check information before making it public and remove information that should not be on public systems.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company decides to start issuing press releases about its projects in an effort to reach more potential customers. Your company receives FCI from the government as part of its DoD contract. Because you recognize the need to manage controlled information, including FCI, you meet with the employees who write the releases and post information to establish a review process [c]. It is decided that you will review press releases for FCI before posting it on the company website [a, d]. Only certain employees will be authorized to post to the website [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing publicly accessible content; system security plan; list of users authorized to post publicly accessible content on organizational systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public websites; system audit logs and records; security awareness training records; other relevant documents or records
Common mistakes
Assuming an approved public website can never receive sensitive information.