A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems…

The CMMC practice AC.L1-3.1.22, "Control information posted or processed on publicly accessible systems," is fundamentally about preventing the unauthorized disclosure of sensitive government information. At CMMC Level 1, the focus is on protecting Federal Contract Information (FCI). A press release is posted on a publicly accessible system (e.g., a company website). Therefore, the most critical factor from a CMMC perspective is to ensure that the information being released has been reviewed and authorized to prevent the spillage of FCI, which is defined as information not intended for public release.

A. Information accuracy is a general business best practice, not the specific focus of this CMMC control, which is concerned with safeguarding FCI.

B. CEO approval is an internal corporate governance process; the CMMC control requires authorization by a designated individual/group, not necessarily the CEO.

D. This statement is the opposite of the requirement. FCI is, by definition, "not intended for public release" and must be protected, not posted.

1. U.S. Department of Defense

Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0

(December 2021). Domain: Access Control (AC)

Practice AC.L1-3.1.22

Page 11. The practice requires control over information on public systems

which directly implies safeguarding FCI.

2. NIST Special Publication 800-171

Revision 2

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

(February 2020). Section 3.1.22

Page 23. The discussion for this control states

"Organizations ensure that FCI is not included on publicly accessible systems."

3. Code of Federal Regulations

48 CFR § 52.204-21

Basic Safeguarding of Covered Contractor Information Systems

(June 2016). Section (a) Definitions. Defines Federal Contract Information (FCI) as "information

not intended for public release

that is provided by or generated for the Government under a contract..."