AC.L1-b.1.iii
External Connections [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L1-b.1.iii in the reference catalog with its NIST cross-references
Official requirement
Verify and control/limit connections to and use of external information systems.
Assessment objectives
a. connections to external systems are identified;
b. the use of external systems is identified;
c. connections to external systems are verified;
d. the use of external systems is verified;
e. connections to external systems are controlled/limited; and
f. the use of external systems is controlled/limited.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Identify external systems and connections, approve their use, and restrict the ways they reach your environment.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your company has just been awarded a contract which contains FCI. You remind your coworkers of the policy requirement to use their company laptops, not personal laptops or tablets, when working re motely on this contract [b,f]. You also remind everyone to work from the cloud environment that is approved for processing and storing FCI rather than the other collaborative tools that may be used for other projects [b,f].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing the use of external systems; terms and conditions for external systems; system security plan; list of applications accessible from external systems; system configuration settings and associated documentation; system connection or processing agreements; account management documents; other relevant documents or records
Common mistakes
Allowing vendor connections or personal devices without defining and enforcing their limits.