[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-22":3},{"item":4,"lessons":18,"controls":52,"related":79},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-22","AC-22","Publicly Accessible Content",8,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must designate who may make information publicly accessible, train them to avoid publishing non-public information, review proposed content before posting and check public content periodically, removing non-public information when found.\n\n**In practice.** This applies to websites, social media, public code repositories and documentation portals. Good practice includes defined publishing roles, approval workflows and periodic scans for exposed sensitive data, such as secrets in public repositories. Auditors look for role assignments, approval records and review results. Scanning for exposed secrets should be automated and linked to rapid revocation.\n\n**Common gaps.** Developers sometimes publish code containing credentials or internal details. Public cloud storage and shared links can expose data without anyone going through a publishing process. Reviews of existing public content are also rare.","a. Designate individuals authorized to make information publicly accessible;\n  b. Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information;\n  c. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and\n  d. Review the content on the publicly accessible system for nonpublic information [Assignment: organization-defined frequency] and remove such information, if discovered.\nDiscussion: In accordance with applicable laws, executive orders, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to nonpublic information, including information protected under the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) and proprietary information. Publicly accessible content addresses systems that are controlled by the organization and accessible to the public, typically without identification or authentication. Posting information on non-organizational systems (e.g., non-organizational public websites, forums, and social media) is covered by organizational policy. While organizations may have individuals who are responsible for developing and implementing policies about the information that can be made publicly accessible, publicly accessible content addresses the management of the individuals who make such information publicly accessible.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48],{"slug":21,"title":22,"published_at":23},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":25,"title":26,"published_at":27},"court-overturns-dpa-ruling-balancing-gdpr-access-rights-against-legitimate-institutional-interests","Court Overturns DPA Ruling: Balancing GDPR Access Rights Against Legitimate Institutional Interests","2026-09-16T09:21:51.994+00:00",{"slug":29,"title":30,"published_at":31},"italian-hospital-fined-10000-for-unlawful-publication-of-candidate-data-on-public-website","Italian Hospital Fined €10,000 for Unlawful Publication of Candidate Data on Public Website","2026-09-08T16:21:53.505+00:00",{"slug":33,"title":34,"published_at":35},"italian-hospital-fined-10000-for-unlawfully-publishing-sensitive-personal-data-online","Italian Hospital Fined €10,000 for Unlawfully Publishing Sensitive Personal Data Online","2026-09-08T10:22:52.793+00:00",{"slug":37,"title":38,"published_at":39},"notary-fined-for-unlawful-disclosure-of-personal-data-without-legal-basis","Notary Fined for Unlawful Disclosure of Personal Data Without Legal Basis","2026-09-08T10:20:42.155+00:00",{"slug":41,"title":42,"published_at":43},"spanish-notary-fined-for-unlawful-disclosure-of-personal-cadastral-data","Spanish Notary Fined for Unlawful Disclosure of Personal Cadastral Data","2026-09-03T13:20:22.729+00:00",{"slug":45,"title":46,"published_at":47},"metas-ad-platform-promoted-ai-deepfake-nudification-tool-targeting-politicians","Meta's Ad Platform Promoted AI Deepfake Nudification Tool Targeting Politicians","2026-08-18T16:21:27.919+00:00",{"slug":49,"title":50,"published_at":51},"misconfigured-website-exposes-sensitive-national-security-personnel-data","Misconfigured Website Exposes Sensitive National Security Personnel Data","2026-06-26T18:20:40.073+00:00",[53,58,62,67,71,75],{"slug":54,"name":55,"problem":56,"stories":57},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",2,{"slug":59,"name":60,"problem":61,"stories":57},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":63,"name":64,"problem":65,"stories":66},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":68,"name":69,"problem":70,"stories":66},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":72,"name":73,"problem":74,"stories":66},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",{"slug":76,"name":77,"problem":78,"stories":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,86,92,97,101,106,110,114],{"family":81,"item":82,"code":83,"title":84,"together":85},"cis","3","Control 3","Data Protection",7,{"family":87,"item":88,"code":89,"title":90,"together":91},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",6,{"family":87,"item":93,"code":94,"title":95,"together":96},"6","Article 6","Lawfulness of processing",4,{"family":98,"item":99,"code":100,"title":100,"together":96},"itil","overview","ITIL",{"family":5,"item":102,"code":103,"title":104,"together":105},"ac-3","AC-3","Access Enforcement",3,{"family":81,"item":107,"code":108,"title":109,"together":105},"14","Control 14","Security Awareness and Skills Training",{"family":87,"item":111,"code":112,"title":113,"together":105},"25","Article 25","Data protection by design and by default",{"family":81,"item":93,"code":115,"title":116,"together":57},"Control 6","Access Control Management"]