What This Objective Requires
AC.L2-3.1.17[a] requires you to maintain a clear understanding of every connection to systems that handle Controlled Unclassified Information (CUI). The intent is to ensure you can identify how CUI systems communicate, where access paths exist, and which interfaces could expose data or enable unauthorized access. Proper controlled unclassified information marking is crucial in this process to ensure compliance and security.
Connections to track typically include internal connections (such as user workstations and shared infrastructure), remote access entry points (such as VPN and administrative access), third-party or vendor connectivity, and any interfaces where CUI environments connect to non-CUI systems.
Why Connection Visibility Matters
Untracked connections increase risk because they can become unmonitored access points, enable unauthorized data transfer, or allow attackers to move laterally after an initial compromise. When a connection is unknown, it is difficult to protect, monitor, or justify during an assessment.
This objective supports consistent boundary awareness and helps reduce attack surface by ensuring every pathway into and out of CUI systems is known, documented, and reviewed as part of broader CUI compliance requirements. Understanding CUI marking requirements and implementing a comprehensive cui flow diagram are essential components of this process.
How to Implement AC.L2-3.1.17[a]
Start by identifying all systems that store, process, or transmit CUI, then document every connection into and out of those systems. This is often represented through a network diagram, a system inventory, and supporting data flow documentation that explains how CUI moves through the environment. Ensuring compliance with iso cybersecurity standards and understanding CUI control marking are vital steps in this implementation process.
Validate documentation against real configurations by reviewing firewall rules, access control lists, routing tables, and cloud security group settings. Include wired, wireless, remote, virtual, and cloud-based connections so the inventory reflects how the environment actually operates.
Assign an owner for each connection, define the business purpose, and set a recurring review cadence. This helps keep diagrams accurate through changes and supports evidence expectations for CMMC Level 2 compliance.
Connection Inventory Checklist
| Connection Category | Examples | What to Capture | Minimum Review Practice |
|---|---|---|---|
| Internal connections | Workstations, file servers, printers, management networks | Source/destination, system role, protocol/port, owner | Confirm inventory matches current architecture after changes |
| Remote access paths | VPN, remote admin, remote support tools | Entry point, authentication method, authorized roles, logging | Review access paths and permitted targets on a schedule |
| Third-party/vendor connections | Support tunnels, managed services, external administrators | Approval basis, time bounds, scope, owner, monitoring | Verify current need and remove stale connections |
| Cloud and SaaS interfaces | Cloud services, identity providers, storage integrations | Service name, data pathways, security groups, owners | Validate changes against diagrams and access policies |
| Non-CUI boundary interfaces | CUI to corporate network links, shared services, gateways | Segmentation controls, allowed traffic, justification | Reconfirm segmentation and permitted communications |
Evidence Assessors Commonly Expect
Assessors commonly look for up-to-date network diagrams or architectural drawings, a system inventory that clearly identifies CUI systems and their connected interfaces, and documentation showing the connections are periodically reviewed or validated.
They also often expect connection ownership to be defined, including a business or technical owner who can explain the purpose of the connection and confirm it remains necessary.
Common Gaps to Avoid
Common gaps include having no formal inventory of system connections, maintaining diagrams that are outdated or incomplete, and missing “shadow IT” or ad hoc connections that are not documented or reviewed. Adhering to regulatory compliance cyber security practices can help mitigate these risks.
Another frequent issue is documenting systems but not documenting the interfaces between them, which makes it difficult to prove boundary awareness and defend segmentation decisions. Comprehensive documentation of CUI cybersecurity measures is necessary to avoid these pitfalls.
How Cuick Trac Supports This Objective
Cuick Trac supports this objective by emphasizing known, controlled connectivity for environments handling CUI and by helping teams maintain clearer documentation of internal and external connection boundaries.
With fewer uncontrolled interfaces and stronger documentation discipline, organizations can reduce tracking overhead and improve the reliability of connection inventories used for assessment evidence.
FAQ
What does AC.L2-3.1.17[a] require?
It requires maintaining a clear, current inventory of all network and system connections that touch any system handling CUI, including inbound and outbound interfaces.
What connection types should be included?
Include internal connections, remote access paths, third-party or vendor connections, cloud service interfaces, and any links to non-CUI environments.
What evidence helps demonstrate compliance?
Common evidence includes up-to-date network diagrams, a system inventory identifying CUI systems and interfaces, and records showing periodic review or validation of connections.