---

id: "AU-13" title: "Monitoring for Information Disclosure" family: "AU" family_name: "Audit and Accountability" sort_id: "au-13" priority: "P2" implementation_level: "organization" enhancements: - au-13.1 - au-13.2 - au-13.3

---

Monitor {{ insert: param, au-13_odp.01 }} {{ insert: param, au-13_odp.02 }} for evidence of unauthorized disclosure of organizational information; and

If an information disclosure is discovered:

Notify {{ insert: param, au-13_odp.03 }} ; and

Take the following additional actions: {{ insert: param, au-13_odp.04 }}.

Guidance

Unauthorized disclosure of information is a form of data leakage. Open-source information includes social networking sites and code-sharing platforms and repositories. Examples of organizational information include personally identifiable information retained by the organization or proprietary information generated by the organization.

Assessment Objective: {{ insert: param, au-13_odp.01 }} is/are monitored {{ insert: param, au-13_odp.02 }} for evidence of unauthorized disclosure of organizational information;

Assessment Objective: {{ insert: param, au-13_odp.03 }} are notified if an information disclosure is discovered;

Assessment Objective: {{ insert: param, au-13_odp.04 }} are taken if an information disclosure is discovered.

Audit and accountability policy

system security plan

privacy plan

procedures addressing information disclosure monitoring

system design documentation

system configuration settings and associated documentation

monitoring records

system audit records

other relevant documents or records

Organizational personnel with responsibilities for monitoring open-source information and/or information sites

organizational personnel with security and privacy responsibilities

Mechanisms implementing monitoring for information disclosure