Navigate

AC-21

AC-21: Information Sharing

The organization:

AC-21a.: Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and

AC-21b.: Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.

Supplemental

This control applies to information that may be restricted in some manner (e.g., privileged medical information, contract-sensitive information, proprietary information, personally identifiable information, classified information related to special access programs or compartments) based on some formal or administrative determination. Depending on the particular information-sharing circumstances, sharing partners may be defined at the individual, group, or organizational level. Information may be defined by content, type, security category, or special access program/compartment.

CIA Levels
Confidentiality	moderate
Integrity	unknown
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AC-21.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Enhancements

The controls below (if any) add on to the requirements of AC-21.

Control	Description
AC-21 (1)	The information system enforces information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.
AC-21 (2)	The information system implements information search and retrieval services that enforce [Assignment: organization-defined information sharing restrictions].

Related CCIs

The CCIs below are tied to AC-21.

CCI	Definition
CCI-000098	The organization facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for organization-defined information circumstances where user discretion is required.
CCI-001470	The organization defines information sharing circumstances where user discretion is required.
CCI-001471	The organization employs organization-defined automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.
CCI-001472	The organization defines the automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions.