NIST 800-53 r5 · Controls catalogue · Family AC
AC-22Publicly Accessible Content
Designate individuals authorized to make information publicly accessible; Train authorized individuals to ensure that publicly accessible information does not contain nonpublic information; Review the proposed content of information prior to posting onto the publicly accessible system to ensure that nonpublic information is not included; and Review the content on the publicly accessible system for nonpublic information {{ insert: param, ac-22_odp }} and remove such information, if discovered.
Last updated: 04 July 2026 00:28 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (0)
- No ATT&CK techniques mapped to this control yet.
Weaknesses this control addresses (8)AI
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 10,501 | Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors. |
CWE-284 | Improper Access Control | 5,367 | Designating authorized individuals and mandating pre/post-publication reviews enforces access controls on who can publish content publicly. |
CWE-285 | Improper Authorization | 1,356 | Authorization checks via training and content reviews ensure only approved information is released to public systems. |
CWE-668 | Exposure of Resource to Wrong Sphere | 797 | The control ensures information resources are not exposed to the incorrect (public) sphere through review and authorization. |
CWE-552 | Files or Directories Accessible to External Parties | 563 | Controls on authorized publication limit files and directories with nonpublic data from becoming accessible to external parties. |
CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 342 | Ongoing reviews detect and remove sensitive system information before it reaches publicly accessible systems. |
CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 190 | Preventing nonpublic personal information from public posting reduces unauthorized exposure of private personal data. |
CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | 93 | Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-70841 | 7.0 | 10.0 | 0.0038 | good |
CVE-2020-37082 | 7.0 | 9.8 | 0.0054 | good |
CVE-2026-22237 | 7.0 | 9.8 | 0.0042 | good |
CVE-2025-11693 | 7.0 | 9.8 | 0.0195 | good |
CVE-2025-12539 | 7.0 | 10.0 | 0.0095 | good |
CVE-2025-54863 | 7.0 | 10.0 | 0.0061 | good |
CVE-2026-2144 | 5.5 | 8.1 | 0.0047 | good |
CVE-2025-67223 | 5.5 | 7.5 | 0.0063 | good |
CVE-2024-12330 | 5.5 | 7.5 | 0.0049 | good |
CVE-2024-12274 | 5.5 | 7.5 | 0.0062 | good |
CVE-2025-27604 | 5.5 | 7.5 | 0.0035 | good |
CVE-2024-13562 | 5.5 | 7.5 | 0.0043 | good |
CVE-2024-13606 | 5.5 | 7.5 | 0.0040 | good |
CVE-2024-13568 | 5.5 | 7.5 | 0.0040 | good |
CVE-2024-13611 | 5.5 | 7.5 | 0.0046 | good |
CVE-2026-41278 | 5.5 | 7.5 | 0.0042 | good |
CVE-2025-34225 | 5.5 | 8.6 | 0.0076 | good |
CVE-2026-29779 | 5.5 | 7.5 | 0.0029 | good |
CVE-2026-27161 | 5.5 | 7.5 | 0.0041 | good |
CVE-2025-69908 | 5.5 | 7.5 | 0.0038 | good |
CVE-2023-6750 | 5.5 | 7.5 | 0.0196 | good |
CVE-2024-11396 | 3.5 | 5.3 | 0.0194 | good |
CVE-2024-12008 | 3.5 | 5.3 | 0.0217 | good |
CVE-2026-27877 UPD | 3.5 | 6.5 | 0.0031 | good |
CVE-2024-13638 | 3.5 | 5.9 | 0.0044 | good |