Mapped to NIST 800-171 Requirement: 3.1.3
CMMC Assessment Objective: AC.L2-3.1.3[a]
What This Objective Means
This objective is about setting the ground rules for how CUI flows within your environment. You must clearly define:
• Where CUI is allowed to go
• Who can send or receive it
• What tools and systems are approved for that movement
This includes traffic between:
• Workstations and servers
• Internal and external networks
• Applications and APIs
• Cloud and on-prem environments
The flow of CUI must be explicitly approved and documented—not assumed.
Why It Matters
Without defined authorizations:
• CUI could be transferred over insecure channels
• Data may flow to systems or users who aren’t authorized
• You may be noncompliant with CMMC or DFARS regulations
This control helps create a trust boundary around your CUI environment and defines acceptable behavior inside it.
How to Implement It
• Document how CUI is allowed to move across your network
◦ For example: “CUI may only be sent via secure email with encryption enabled”
• Define allowed communication paths between systems (e.g., server to cloud storage, user laptop to SharePoint)
• Establish and approve tools and services for transmitting and storing CUI
• Incorporate flow controls into your network diagrams, SSP, or boundary documentation
• Get formal approval from system owners, security teams, or compliance officers
Evidence the Assessor Will Look For
• CUI flow diagrams or network topology maps
• A list of approved systems and services for CUI transmission and storage
• Documentation that shows who authorized each data flow
• Security plans (SSP) or data handling procedures that reference flow restrictions
Common Gaps
• No documentation of how or where CUI is allowed to flow
• Use of unapproved systems (e.g., Google Drive or Dropbox) to store or share CUI
• Conflicting or outdated documentation across departments
How Cuick Trac Helps
Cuick Trac simplifies this requirement by:
• Defining clear boundaries for CUI flow within a secure enclave
• Eliminating ambiguity about what systems are authorized
• Providing standardized documentation for flow paths and authorized tools
• Enforcing data flow restrictions at the infrastructure level
With Cuick Trac, CUI can only move where it’s meant to—and you can prove it.
Final CTA
You can’t protect what you can’t control—and that starts with controlling the flow of CUI.
Schedule a Cuick Trac demo and document your data movement with clarity and confidence.