AC.L2-3.1.3
Control CUI Flow
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.3 in the reference catalog with its NIST cross-references
Official requirement
Control the flow of CUI in accordance with approved authorizations.
Assessment objectives
a. information flow control policies are defined;
b. methods and enforcement mechanisms for controlling the flow of CUI are defined;
c. designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
d. authorizations for controlling the flow of CUI are defined; and
e. approved authorizations for controlling the flow of CUI are enforced.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Define where controlled information may flow and enforce those boundaries.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You configure a proxy device on your company ’s network. CUI is stored within this environment. Your goal is to better mask and protect the devices inside the network while enforcing information flow policies. After the device is configured, information does not flow directly from the internal network to the internet. The proxy device intercepts the traffic and analyzes it to determine if the traffic conforms to organization information flow control policies. If it does, the device allows the information to pass to its destination [b]. The proxy blocks traffic that does not meet policy requirements [e]. Example 2 As a subcontractor on a DoD contract, your organization sometimes needs to transmit CUI to the prime contractor. You create a policy document that specifies who is allowed to transmit CUI and that such transmission requires manager approval [a,c,d]. The policy instructs users to encrypt any CUI transmitted via email or to use a designated secure file sharing utility [b,d]. The policy states that users who do not follow appropriate procedures may be subject to disciplinary action [e].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; information flow control policies; procedures addressing information flow enforcement; system security plan; system design documentation; system configuration settings and associated documentation; list of information flow authorizations; system baseline configuration; system audit logs and records; other relevant documents or records
Common mistakes
Documenting approved data flows without technical enforcement between systems or organizations.