AC.L2-3.1.1
Authorized Access Control [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.1 in the reference catalog with its NIST cross-references
Official requirement
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
Assessment objectives
a. authorized users are identified;
b. processes acting on behalf of authorized users are identified;
c. devices (and other systems) authorized to connect to the system are identified;
d. system access is limited to authorized users;
e. system access is limited to processes acting on behalf of authorized users; and
f. system access is limited to authorized devices (including other systems).
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Keep an approved set of people, processes, and devices and restrict system access to that set.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company maintains a list of all personnel authorized to use company information systems, including those that store, process, and transmit CUI [a]. This list is used to support identification and authentication activities conducted by IT when authorizing access to systems [a,d]. Example 2 A coworker wants to buy a new multi- function printer/scanner/fax device and make it available on the company network within the CUI enclave. You explain that the company controls system and device access to the network and will prevent network access by unauthorized systems and devices [c]. You help the coworker submit a ticket that asks for the printer to be granted access to the network, and appropriate leadership approves the device [f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing account management; system security plan; system design documentation; system configuration settings and associated documentation; list of active system accounts and the name of the individual associated with each account; notifications or records of recently transferred, separated, or terminated employees; list of conditions for group and role membership; list of recently disabled system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; system monitoring records; system audit logs and records; list of devices and systems authorized to connect to organizational systems; other relevant documents or records
Common mistakes
Managing employee accounts while overlooking service accounts and connected devices.