AU-13 — Monitoring for Information Disclosure

Official NIST control content

Control statement

a.Monitor [Organization-defined: open-source information and/or information sites] [Organization-defined: frequency] for evidence of unauthorized disclosure of organizational information; and
b.If an information disclosure is discovered:
1. 1.Notify [Organization-defined: personnel or roles] ; and
2. 2.Take the following additional actions: [Organization-defined: additional actions].

Official NIST discussion

Discussion

Unauthorized disclosure of information is a form of data leakage. Open-source information includes social networking sites and code-sharing platforms and repositories. Examples of organizational information include personally identifiable information retained by the organization or proprietary information generated by the organization.

Official OSCAL parameters

Organization-defined parameters

These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.

open-source information and/or information sitesopen-source information and/or information sites to be monitored for evidence of unauthorized disclosure of organizational information is/are defined;

frequencythe frequency with which open-source information and/or information sites are monitored for evidence of unauthorized disclosure of organizational information is defined;

personnel or rolespersonnel or roles to be notified if an information disclosure is discovered is/are defined;

additional actionsadditional actions to be taken if an information disclosure is discovered are defined;

Original Bare Metal Cyber perspective

From control text to operational evidence

Use Monitoring for Information Disclosure as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to audit event design, trustworthy collection, retention, review, and investigation support.

Implementation workflow

Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
Resolve each organization-defined parameter before declaring the control implemented.
Document how the implementation satisfies every clause of the official control statement.
Collect evidence as a normal byproduct of operation rather than only before an assessment.
Review exceptions, changes, and monitoring results on a risk-based cadence.

Evidence examples

logging standards and event-selection decisions
sample audit records and retention settings
time-synchronization evidence
alert and review records

Common failure patterns

collecting logs without defined use cases
critical events missing from the audit trail
retention shorter than investigative needs
logs accessible to the same administrators being monitored

Questions practitioners should ask

What risk decision is this control intended to support in this system?
Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
What event or threshold requires the implementation to be reviewed or changed?

Official NIST SP 800-53A content

Assessment objectives and methods

Show the assessment objective

AU-13a.[Organization-defined: open-source information and/or information sites] is/are monitored [Organization-defined: frequency] for evidence of unauthorized disclosure of organizational information;
AU-13b.
1. AU-13b.01[Organization-defined: personnel or roles] are notified if an information disclosure is discovered;
2. AU-13b.02[Organization-defined: additional actions] are taken if an information disclosure is discovered.

Examine

Audit and accountability policy
system security plan
privacy plan
procedures addressing information disclosure monitoring
system design documentation
system configuration settings and associated documentation
monitoring records
system audit records
other relevant documents or records

Interview

Organizational personnel with responsibilities for monitoring open-source information and/or information sites
organizational personnel with security and privacy responsibilities

Test

Mechanisms implementing monitoring for information disclosure

Official relationships

Related controls

These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.

Official NIST enhancements

Control enhancements

Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.

Official NIST control enhancement

AU-13(1) — Use of Automated Tools

Monitor open-source information and information sites using [Organization-defined: automated mechanisms].

Official discussion

Automated mechanisms include commercial services that provide notifications and alerts to organizations and automated scripts to monitor new posts on websites.

Organization-defined parameters (1)

automated mechanismsautomated mechanisms for monitoring open-source information and information sites are defined;

Assessment objectives and methods

open-source information and information sites are monitored using [Organization-defined: automated mechanisms].

Examine

Audit and accountability policy
system security plan
privacy plan
procedures addressing information disclosure monitoring
system design documentation
system configuration settings and associated documentation
automated monitoring tools
system audit records
other relevant documents or records

Interview

Organizational personnel with responsibilities for monitoring information disclosures
organizational personnel with information security and privacy responsibilities

Test

Automated mechanisms implementing monitoring for information disclosure

Official NIST control enhancement

AU-13(2) — Review of Monitored Sites

Review the list of open-source information sites being monitored [Organization-defined: frequency].

Official discussion

Reviewing the current list of open-source information sites being monitored on a regular basis helps to ensure that the selected sites remain relevant. The review also provides the opportunity to add new open-source information sites with the potential to provide evidence of unauthorized disclosure of organizational information. The list of sites monitored can be guided and informed by threat intelligence of other credible sources of information.

Organization-defined parameters (1)

frequencythe frequency at which to review the open-source information sites being monitored is defined;

Assessment objectives and methods

the list of open-source information sites being monitored is reviewed [Organization-defined: frequency].

Examine

Audit and accountability policy
system security plan
privacy plan
procedures addressing information disclosure monitoring
system design documentation
system configuration settings and associated documentation
reviews for open-source information sites being monitored
system audit records
other relevant documents or records

Interview

Organizational personnel with responsibilities for monitoring open-source information sites
organizational personnel with information security and privacy responsibilities

Test

Mechanisms implementing monitoring for information disclosure

Official NIST control enhancement

AU-13(3) — Unauthorized Replication of Information

Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.

Official discussion

The unauthorized use or replication of organizational information by external entities can cause adverse impacts on organizational operations and assets, including damage to reputation. Such activity can include the replication of an organizational website by an adversary or hostile threat actor who attempts to impersonate the web-hosting organization. Discovery tools, techniques, and processes used to determine if external entities are replicating organizational information in an unauthorized manner include scanning external websites, monitoring social media, and training staff to recognize the unauthorized use of organizational information.

Assessment objectives and methods

discovery techniques, processes, and tools are employed to determine if external entities are replicating organizational information in an unauthorized manner.

Examine

Audit and accountability policy
system security plan
privacy plan
procedures addressing information disclosure monitoring
procedures addressing information replication
system design documentation
system configuration settings and associated documentation
system audit records
training resources for staff to recognize the unauthorized use of organizational information
other relevant documents or records

Interview

Organizational personnel with responsibilities for monitoring unauthorized replication of information
organizational personnel with information security and privacy responsibilities

Test

Discovery tools for identifying unauthorized information replication

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.