Access Control · AC.L1-b.1.iv(a)
Individuals authorized to post or process information on publicly accessible systems are identified
An assessment objective under requirement AC.L1-b.1.iv, Control Public Information, in the Access Control domain.
Objective Statement
Individuals authorized to post or process information on publicly accessible systems are identified
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Access Control (AC)
- Objective ID
- AC.L1-b.1.iv(a)
- Parent Requirement
- AC.L1-b.1.iv · Control information posted to publicly accessible systems
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Access control policy
- Procedures addressing publicly accessible content
- System security plan
- List of users authorized to post publicly accessible content on organizational systems
- Training materials and/or records
- Records of publicly accessible information reviews
- Records of response to nonpublic information on public websites
- System audit logs and records
- Security awareness training records
- Other relevant documents or records
Interview
- Personnel with responsibilities for managing publicly accessible information posted on organizational systems
- Personnel with information security responsibilities
Test
- Mechanisms implementing management of publicly accessible content
Related Objectives
- AC.L1-b.1.iv(b)procedures to ensure [FCI] is not posted or processed on publicly accessible systems are identified
- AC.L1-b.1.iv(c)a review process is in place prior to posting of any content to publicly accessible systems
- AC.L1-b.1.iv(d)content on publicly accessible systems is reviewed to ensure that it does not include [FCI]
- AC.L1-b.1.iv(e)mechanisms are in place to remove and address improper posting of [FCI]
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC AC.L1-b.1.iv(a): Individuals authorized to post or process information on publicly accessible systems are identified.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/individuals-authorized-to-post-or-process-information-on-publicly/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.