AC-22: Publicly Accessible Content

designated individuals are authorized to make information publicly accessible;

authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;

the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;

Access control policy

procedures addressing publicly accessible content

list of users authorized to post publicly accessible content on organizational systems

training materials and/or records

records of publicly accessible information reviews

records of response to non-public information on public websites

system audit logs

security awareness training records

system security plan

other relevant documents or records

Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems

organizational personnel with information security responsibilities

Mechanisms implementing management of publicly accessible content