Control Public Information

Official Source Material

SPRS score value: 1 point.
POA&M eligibility: Not eligible. 32 CFR 170.21 names it.
Level 1: Also assessed at Level 1 as AC.L1-b.1.iv.

Facts: NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020, Annex A; 32 CFR Part 170, § 170.21 and § 170.24, eCFR text current as of September 17, 2026; CMMC Assessment Guide - Level 1, Version 2.13, September 2024.

Control information posted or processed on publicly accessible information systems.

Determine if:

[a] individuals authorized to post or process information on publicly accessible systems are identified;
[b] procedures to ensure FCI is not posted or processed on publicly accessible systems are identified;
[c] a review process is in place prior to posting of any content to publicly accessible systems;
[d] content on publicly accessible systems is reviewed to ensure that it does not include FCI; and
[e] mechanisms are in place to remove and address improper posting of FCI.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

This requirement can never sit on a POA&M.

32 CFR 170.21(a)(2)(iii) excludes AC.L2-3.1.22 from Level 2 plans of action. A missing review process blocks even a Conditional CMMC Status. The good news is that this is among the cheapest requirements in the family to meet.

An hour of procedure writing covers four of the five objectives.

Name who may post to the website and official social media [a]. Write the procedure that keeps CUI and FCI out of public systems [b]. Require review before anything is posted [c], and define how improper postings get removed and reported [e]. One page in your media or acceptable use policy is a complete answer, and write it to cover CUI as well as the FCI the objectives name.

Objective [d] needs a recurring review of what is already public.

Pre-posting review alone does not answer it. Review the live site on a defined schedule, and record who reviewed and when. A dated sign-off in a spreadsheet is adequate. An annual review is a defensible floor for a static site. A change-detection alert that triggers review of modified pages is a sound supplement, not a substitute for the pre-posting step.

Company channels are in scope. Personal ones are not.

The company website and official social media accounts get the authorization and review process. Employees' personal accounts are not subject to pre-publication review, and no objective requires monitoring them. An employee posting FCI from a personal account is an incident to handle under [e] and a training matter under AT.L2-3.2.1, not a gap in this requirement.

What falls short

Policies and procedures with no recorded review of the live site. Objective [d] wants evidence the public content was actually checked, and the absence of records reads as absence of review.
Post-publication monitoring alone. Objective [c] requires review before posting, so change alerts without a pre-posting step leave [c] unmet.

Edge cases

In a very small company the same person may end up posting and reviewing. Assessors differ on whether that passes, so separate the two roles whenever a second person exists, and where one truly does not, document the compensating check.
A website hosted by a third party is still yours for this requirement. The control is procedural, not technical, so wherever your organization can publish content, the authorization and review process applies.

Over-engineering

A web content approval platform for a five-page website. Objectives [a] through [c] are a named poster, a short procedure, and a review before anything publishes.
Brand monitoring or dark web scanning services. Objective [d] is a recorded review of your own public pages on a schedule you keep.

Connects to

Plan of Action and Milestones (POA&M) A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass. Assessment
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Procedure The written steps that carry out a policy. It names who does what, in order, and it produces the records your assessment relies on. Assessment
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
Federal Contract Information (FCI) FCI is information a contract provides to you or generates for the Government that is not for public release. Holding only FCI means CMMC Level 1. What you protect
Policy A short written statement of what your organization requires. It is approved, dated, and it says what people must do, not how. Assessment
Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
AT.L2-3.2.1 Role-Based Risk Awareness Awareness and Training (AT)
Evidence What you show an assessor to prove a requirement is met. It must be final, not draft, and it must match what your plan claims. Assessment
Assessor The certified person who conducts your assessment. Assessors test objectives against evidence, and they do not advise you on how to fix gaps. Assessment