NIST 800-53 REV 5 • ACCESS CONTROL
AC-4(19) — Validation of Metadata
When transferring information between different security domains, implement {{ insert: param, ac-4.19_prm_1 }} on metadata.
CMMC Practice Mapping
No direct CMMC mapping
NIST 800-171 Mapping
No direct NIST 800-171 mapping
Related Controls
No related controls listed
Supplemental Guidance
All information (including metadata and the data to which the metadata applies) is subject to filtering and inspection. Some organizations distinguish between metadata and data payloads (i.e., only the data to which the metadata is bound). Other organizations do not make such distinctions and consider metadata and the data to which the metadata applies to be part of the payload.
Practitioner Notes
Before trusting metadata attached to incoming data, you need to validate it. Metadata can be forged, so your system should verify that labels, classifications, and other tags are legitimate.
Example 1: Configure your cross-domain solution to verify that classification metadata on incoming files matches an approved schema. If a file claims to be UNCLASSIFIED but contains patterns matching CUI content, quarantine it for review rather than passing it through.
Example 2: In your email gateway, validate that X-header markings (like X-Protective-Marking) match the content detected by your DLP scanner. If the header says UNCLASSIFIED but the DLP scanner finds sensitive data, flag the message for security review.