Mapped to NIST 800-171 Requirement: 3.1.17
CMMC Assessment Objective: AC.L2-3.1.17[b]
What This Objective Means
This control is about technical validation. You’ve identified all the connections to your CUI systems—now you need to prove that those connections are:
• Authorized
• Controlled through technical settings
• Aligned with your access control policy and architecture
Examples of authorized connection controls include:
• Firewall rules
• IP allowlists
• Virtual LAN (VLAN) segmentation
• VPN tunnels
• Role-based permissions limiting which devices or services may connect
Why It Matters
Even if you’ve defined who can connect, if the systems aren’t configured to enforce it, unauthorized devices or users could:
• Bypass policy controls
• Access CUI through lateral movement
• Exfiltrate data through hidden pathways
Enforcement ensures that only approved systems can interact with CUI environments.
How to Implement It
• Review firewall and router configurations to confirm traffic is restricted to known, authorized IP ranges or devices
• Configure system ACLs, VLANs, or segmentation to isolate CUI systems from general access
• Limit third-party or vendor system access using secure tunnels or proxy gateways
• Use endpoint protection or network access control (NAC) to prevent unauthorized device connections
• Regularly audit and validate that all connections in system configs match your documented inventory (from AC.L2-3.1.17[a])
Evidence the Assessor Will Look For
• Firewall rules, access control lists, or router settings showing allowed connections
• Screenshots from network management tools confirming segmentation
• VPN, SSH, or RDP configuration settings limiting access to specific users, devices, or IP addresses
• Logs or access control audit results that align with the documented list of authorized connections
Common Gaps
• System configurations allow more access than policy permits
• Third-party or legacy access paths exist without formal approval
• Connections documented but not enforced technically
How Cuick Trac Helps
Cuick Trac supports this control by:
• Operating in a pre-segmented, access-controlled enclave with known, limited connection points
• Blocking unauthorized inbound and outbound traffic by default
• Providing documentation and access logs to prove system-level enforcement
• Helping organizations align policy, documentation, and enforcement with CMMC expectations
With Cuick Trac, authorized connections aren’t just allowed—they’re the only ones that exist.
Final CTA
Policy defines access. Configuration enforces it.
Schedule a Cuick Trac demo and close the gap between intent and implementation across your CUI systems.