AU-13

Discussion

Unauthorized disclosure of information is a form of data leakage. Open-source information includes social networking sites and code-sharing platforms and repositories. Examples of organizational information include personally identifiable information retained by the organization or proprietary information generated by the organization.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Audit and accountability policy; system security plan; privacy plan; procedures addressing information disclosure monitoring; system design documentation; system configuration settings and associated documentation; monitoring records; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for monitoring open-source information and/or information sites; organizational personnel with security and privacy responsibilities].

Test

[SELECT FROM: Mechanisms implementing monitoring for information disclosure].

ID	Assessment Objectives
AU-13a.	<AU-13_ODP[01] open-source information and/or information sites> is/are monitored <AU-13_ODP[02] frequency> for evidence of unauthorized disclosure of organizational information;
AU-13b.01	<AU-13_ODP[03] personnel or roles> are notified if an information disclosure is discovered;
AU-13b.02	<AU-13_ODP[04] additional actions> are taken if an information disclosure is discovered.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!