Publicly Accessible Content AC-22
Access Control · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds AC-22 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
AC-22 (Publicly Accessible Content) is about controlling what your organization deliberately puts on a public-facing system — like a public web server — so that nonpublic information never rides along with it. It names who is allowed to publish, trains those people, and reviews the content both before it is posted and again on a schedule afterward. It is a Low-baseline Access Control that applies to any system you run that serves content to the public without a login.
What good looks like
- Keep a short list of named individuals authorized to publish to the public system — posting is deliberate, not ad-hoc.
- Train those individuals to recognize nonpublic information — things like PII (Personally Identifiable Information), internal hostnames, or credentials — so it never gets posted.
- Review content before it goes live to confirm no nonpublic information is included.
- Review what is already published on a schedule and remove any nonpublic information you find.
- Know exactly what the server exposes — the public web root and every file under it — so there are no surprise files sitting in the open.
Framework mapping
- CIS Controls v8 — Control 14 — Security Awareness and Skills Training
How to move it toward Implemented
- Write a one-page posting procedure: who is authorized to publish, what counts as nonpublic, the pre-post review step, and a review cadence (for example, quarterly).
- Find what the server actually serves — the document root — with
grep -R DocumentRoot /etc/apache2/ /etc/httpd/(Apache) orgrep -R "root " /etc/nginx/(Nginx). - Scan that web root for files that should never be public and remove any hits:
find /var/www/html \( -name '.env' -o -name '*.sql' -o -name '*.bak' -o -name '.git' \) -print. - Run and log a scheduled content review (the served-file list plus the scan results), saved as a dated file.
- Attach that review as hardening evidence on the asset, naming
AC-22in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.