Information Sharing AC-21

Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

AC-21 (Information Sharing) is about helping people make good decisions when they hand information to an outside partner — another team, a vendor, an agency, or another system. Before anything moves, the person sharing it needs to know two things: is this partner actually authorized to receive it, and does the way they will use it match the restrictions on that information? The control has two parts — give users a way to check that a partner's access authorizations match the information's access and use restrictions, and provide help (a defined automated mechanism or manual process, not just memory) to support those sharing decisions. It is an Access Control that appears in the Moderate baseline.

What good looks like

• Define the sharing circumstances up front — which kinds of information may be shared, with which partners, and under what use restrictions.
• Mark the information so its access and use restrictions travel with it — a header line, a label, or a directory naming scheme like /srv/share/partner-a/restricted/.
• Give the sharer a way to check a partner's authorization against those restrictions before the data moves — a checklist or a lookup, not memory and good intentions.
• Enforce the restrictions technically with file permissions and Access Control Lists (ACLs — per-file rules that say exactly which accounts may read a file) so only the right partner can open a shared file.
• Provide a mechanism or process to assist the decision — for example a script that flags a mismatch, such as restricted data sitting in a world-readable or unrestricted share. That is the second half of AC-21.

Framework mapping

• CIS Controls v8 — Control 15 — Service Provider Management

How to move it toward Implemented

• Write a one-page information-sharing procedure: the sharing circumstances, the approved partners, the use restrictions per information type, and who checks the match before anything is shared.
• Separate and mark shared data on the server — give each partner its own directory, set tight ownership, and add Access Control Lists so only that partner's accounts can read it (setfacl -R -m u:partnera:rX /srv/share/partnera — the capital X lets that account enter the directory and read the files inside — then confirm with getfacl).
• Lock down the sharing service itself — in Samba (the Linux server for SMB — Server Message Block, the Windows-compatible file-sharing protocol) set valid users = per share in /etc/samba/smb.conf, or in NFS (Network File System) restrict each export to named hosts in /etc/exports, and turn off world-readable defaults.
• Add an automated check — a small script run from cron (the Linux job scheduler) that scans the share paths for restricted files that are world-readable or exported to an unlisted partner, and logs any mismatch for review. That script is the ‘mechanism to assist the decision’ AC-21 asks for.
• Attach the procedure, the ACL and export config, and a sample run of the check as hardening evidence on the asset, naming AC-21 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.