What This Objective Requires
AC.L2-3.1.21[a] requires organizations to identify and document all public-facing systems in their environment. Public-facing systems are those that can be accessed from the internet or other external networks without first traversing internal boundaries.
This includes systems such as public websites, externally accessible applications, APIs, email gateways, remote access portals, and cloud services with public exposure. The goal is to ensure no externally reachable system is unknown or unmanaged.
Why Identifying Public-Facing Systems Matters
Public-facing systems represent the most exposed portion of an environment and are common targets for scanning, exploitation, and credential-based attacks. If these systems are not fully identified, they cannot be properly protected, monitored, or segmented.
Maintaining visibility into internet-exposed assets supports stronger boundary protection and helps organizations manage risk as part of broader CUI compliance requirements.
How to Identify All Public-Facing Systems
Start by enumerating all externally reachable IP addresses, domains, and cloud services. Review firewall rules, edge configurations, DNS records, and cloud exposure settings to identify what services are reachable from outside the environment.
Document each public-facing system with its business purpose, system owner, data exposure level, and relationship to any systems that handle Controlled Unclassified Information (CUI). Update network diagrams to clearly show public boundaries and access paths.
Establish a review cadence so the inventory stays current as systems change. This supports ongoing NIST 800-171 compliance and reduces the risk of unmanaged exposure.
Public-Facing Systems Inventory Table
| System Type | Examples | What to Document | Review Practice |
|---|---|---|---|
| Websites and web applications | Corporate site, customer portal | Domain, hosting location, owner, exposure scope | Review after changes and periodically |
| Remote access services | VPN gateways, remote desktop portals | Entry point, authentication method, permitted users | Validate access paths on a defined schedule |
| APIs and integrations | Public APIs, partner interfaces | Endpoint list, data exposure, access controls | Confirm inventory during integration reviews |
| Email and messaging gateways | SMTP servers, security gateways | Service role, configuration owner, logging | Reconfirm exposure and controls regularly |
| Cloud service endpoints | Cloud consoles, storage endpoints | Account, service name, exposure setting | Review after cloud configuration changes |
Evidence Assessors Commonly Expect
Assessors commonly expect to see a complete inventory of public-facing systems, network diagrams showing public boundaries, and documentation demonstrating the inventory is reviewed and maintained.
They may also verify that public-facing systems are clearly separated from CUI environments and that exposure is intentional and controlled.
Common Gaps to Avoid
Common gaps include missing cloud-based services, overlooked DNS entries, legacy systems still exposed to the internet, and inventories that are not kept up to date.
Another frequent issue is documenting public-facing systems without clearly identifying ownership or their relationship to systems that handle CUI.
How Cuick Trac Supports This Objective
Cuick Trac supports this objective by promoting controlled environments with clear boundaries between public-facing systems and systems that handle CUI.
By emphasizing visibility and documentation, organizations can reduce unintended exposure and improve audit readiness over time.
FAQ
What does AC.L2-3.1.21[a] require?
It requires organizations to identify, document, and maintain an inventory of all systems that are publicly accessible from external networks.
What qualifies as a public-facing system?
Any system or service reachable from the internet or other external networks, such as websites, portals, APIs, or remote access gateways.
What evidence supports compliance?
Evidence commonly includes a current inventory, network diagrams showing public boundaries, and records showing the inventory is reviewed and maintained.