Mapped to NIST 800-171 Requirement: 3.1.1
CMMC Assessment Objective: AC.L2-3.1.1[f]
What This Objective Means
While earlier objectives focused on policies and procedures, this one is all about the technical enforcement of those rules. The assessor will look at the actual system configurations—user directories, file systems, group policies, etc.—to confirm that only authorized users have access.
This is the practical test: are your systems really doing what your policies and procedures say they should?
Why It Matters
Policies and procedures are only effective if they’re implemented at the system level. If user directories or access control lists (ACLs) allow anyone in, you’re not compliant—no matter what your documentation says.
This is where misalignments often appear between intention and reality.
How to Implement It
• Review user accounts and permissions in:
◦ Active Directory or local user/group settings
◦ File system ACLs and share permissions
◦ Application roles and database access
• Ensure all permissions align with documented user roles and access rights
• Remove or restrict access for:
◦ Disabled or terminated accounts
◦ Generic or default accounts
◦ Overprivileged users
• Use tools like access review dashboards or identity governance platforms to validate configurations
Evidence the Assessor Will Look For
• Screenshots of system settings showing user access and permissions
• Reports from access management tools (e.g., who has access to what)
• Documentation showing that access was set up based on your procedures
• Logs of recent account changes and reviews
Common Gaps
• Users have broader access than documented
• Legacy accounts still enabled in system settings
• Default configurations never updated to match policy
How Cuick Trac Helps
Cuick Trac helps verify and enforce configuration-level access control by:
• Centralizing access to CUI in a pre-configured, role-based system
• Blocking unauthorized access attempts automatically
• Maintaining real-time visibility into who has access, and how it’s configured
• Supporting access reviews and audits with ready-to-export system data
With Cuick Trac, what’s defined in policy is enforced in practice—right down to the configuration level.
Final CTA
True security is enforced at the system level.
Schedule a Cuick Trac demo and make sure your access controls work where it matters most—inside your systems.