Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 4 of 15 · AC.L1-b.1.iv
AC.L1-3.1.22 · FAR 52.204-21 (b)(1)(iv) · NIST SP 800-171 3.1.22
Control Public Information
Control information posted or processed on publicly accessible information systems
What it means
Make sure nobody posts federal contract info on your public website, a public blog, or social media.
Why it matters
FCI posted publicly is a direct contract breach and an automatic rejection. One careless social-media post by a junior employee is the usual failure mode, policy plus review is the control.
How to do it, Microsoft 365 (SharePoint / OneDrive)
- 1Go to admin.microsoft.com → SharePoint admin center → Policies → Sharing
- 2Confirm external sharing is restricted (or off for sites containing FCI)
- 3Screenshot the sharing policy
Capture: Screenshot of external sharing settings showing FCI sites are not publicly accessible.
The narrative on file
Cedar Ridge has no public website posting area and no social accounts that publish federal work. The owner reviews the company site quarterly to confirm no drawings, quotes, or contract details are ever posted publicly.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- A written policy stating FCI may not be posted to public surfaces without owner review
- Acknowledgement signatures from every employee
- A recent quarterly review entry (date + surfaces reviewed + findings)
- For M365 path: SharePoint sharing settings showing FCI sites are not public
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.