NIST 800-171 Controls · Access Control
AC.2.022 — Control CUI Posted to Publicly Accessible Systems
Control CUI posted or processed on publicly accessible systems.
What AC.2.022 means in plain English
If your company has a website, social media accounts, a public file server, or any other publicly accessible system, make absolutely sure no government contract information (CUI) ends up there. Never post drawings, specs, contract details, or any government-related work on your public website or public social media. This sounds obvious, but it's a real problem — companies accidentally post sensitive files to public GitHub repositories, public Dropbox links, or on public job postings.
The assessment question
“Do you have a process to verify that CUI is never posted to publicly accessible systems like your company website, public social media, public cloud storage links (like an unsecured Dropbox or Google Drive link), or public code repositories — and has someone recently reviewed your public-facing systems to confirm no CUI is visible?”
How to implement AC.2.022
- Conduct an immediate audit: search your company website, any public GitHub/GitLab repositories, public Dropbox or Google Drive shares, and social media accounts for any government contract information, drawings, part numbers, or documents marked CUI.
- Establish a review process: before posting anything publicly (website update, social media post, job listing, press release), require someone to confirm it contains no CUI. Document this as part of your content publication procedure.
- Make Microsoft 365 SharePoint sharing link policies restrict public sharing: in SharePoint admin center > Policies > Sharing, set external sharing to "Only people in your organization" or "Existing guests only." This prevents accidental "anyone with the link" public sharing of documents.
- If your company uses GitHub or any source code repository for CAD macros, CNC programs, or tooling scripts, ensure those repositories are set to Private. Never commit files containing CUI to a public repository.
- Train employees: cover this topic in your annual security awareness training. Include a real example of how this happens accidentally (e.g., "we sent a contract drawing in an email that could be forwarded to anyone").
Evidence your assessor will ask for
- Written policy prohibiting posting CUI to publicly accessible systems
- Documentation of periodic review of public-facing systems (website, social media, public cloud links)
- SharePoint external sharing policy configuration screenshot showing restricted sharing
- Evidence that any GitHub/code repositories related to CUI work are set to Private
- Employee training records covering this topic
Does AI prompt monitoring help with this control? Yes — directly.
AC.2.022 is one of the requirements a local AI prompt firewall concretely evidences. When employees send prompts to ChatGPT, Copilot, or Claude, that traffic crosses your external boundary — HoundShield inspects it on your own infrastructure (self-hosted Docker, Mode B), blocks CUI patterns before transmission, and writes every allowed/blocked event to a SHA-256 hash-chained log attributable to the user. Architecture diagram, active pattern set, and a log sample are the evidence an assessor tests this against for the AI data path.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Access Control controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.