CMMC Level 1 · Assessment ObjectiveSEC / OBJAC.L1-b.1.iv(c)
Access Control · AC.L1-b.1.iv(c)
A review process is in place prior to posting of any content to publicly accessible systems
An assessment objective under requirement AC.L1-b.1.iv, Control Public Information, in the Access Control domain.
Objective Statement
a review process is in place prior to posting of any content to publicly accessible systems
Source · NIST SP 800-171A
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Access Control (AC)
- Objective ID
- AC.L1-b.1.iv(c)
- Parent Requirement
- AC.L1-b.1.iv · Control information posted to publicly accessible systems
Assessment Procedures
The official government assessment method for this objective, from NIST SP 800-171A. An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Access control policy
- procedures addressing account management
- system security plan
- system design documentation
- system configuration settings and associated documentation
- list of active system accounts and the name of the individual associated with each account
- notifications or records of recently transferred, separated, or terminated employees
- list of conditions for group and role membership
- list of recently disabled system accounts along with the name of the individual associated with each account
- access authorization records
- account management compliance reviews
- system monitoring records
- system audit logs and records
- list of devices and systems authorized to connect to organizational systems
- other relevant documents or records
Interview
- Personnel with account management responsibilities
- system or network administrators
- personnel with information security responsibilities
Test
- Organizational processes for managing system accounts
- mechanisms for implementing account management
Related Objectives
- AC.L1-b.1.iv(a)individuals authorized to post or process information on publicly accessible systems are identified
- AC.L1-b.1.iv(b)procedures to ensure FCI is not posted or processed on publicly accessible systems are identified
- AC.L1-b.1.iv(d)content on publicly accessible systems is reviewed to ensure that it does not include FCI
- AC.L1-b.1.iv(e)mechanisms are in place to remove and address improper posting of FCI
Source Authority
- Primary Authority
- NIST SP 800-171A
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-08
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.