What this requirement asks
Control CUI posted or processed on publicly accessible systems.
This is a CMMC Level 2 requirement in the Access Control family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (5)
- 3.1.22[a] — individuals authorized to post or process information on publicly accessible systems are identified
- 3.1.22[b] — procedures to ensure CUI is not posted or processed on publicly accessible systems are identified
- 3.1.22[c] — a review process is in place prior to posting of any content to publicly accessible systems
- 3.1.22[d] — content on publicly accessible systems is reviewed to ensure that it does not include CUI
- 3.1.22[e] — mechanisms are in place to remove and address improper posting of CUI
What an assessor examines
Examine:
- Access control policy
- procedures addressing publicly accessible content
- system security plan
- list of users authorized to post publicly accessible content on organizational systems
- training materials and/or records
- records of publicly accessible information reviews
- records of response to nonpublic information on public websites
- system audit logs and records
- security awareness training records
- other relevant documents or records
Interview:
- Personnel with responsibilities for managing publicly accessible information posted on organizational systems
- personnel with information security responsibilities
Test:
- Mechanisms implementing management of publicly accessible content
Evidence that defends it
Prove CUI not present or protections exist
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.