AC.L2-3.1.20
External Connections [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.20 in the reference catalog with its NIST cross-references
Official requirement
Verify and control/limit connections to and use of external systems.
Assessment objectives
a. connections to external systems are identified;
b. the use of external systems is identified;
c. connections to external systems are verified;
d. the use of external systems is verified;
e. connections to external systems are controlled/limited; and
f. the use of external systems is controlled/limited.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Verify and limit connections to external systems and their permitted use.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company has a project that contains CUI. You remind your coworkers of the policy requirement to use their company laptops, not personal laptops or tablets, when working remotely on the project [b,f]. You also remind everyone to work from the cloud environment that is approved for processing and storing CUI rather than the other collaborative tools that may be used for other projects [b,f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing the use of external systems; terms and conditions for external systems; system security plan; list of applications accessible from external systems; system configuration settings and associated documentation; system connection or processing agreements; account management documents; other relevant documents or records
Common mistakes
Assuming a business relationship makes every external connection acceptable.