Mapped to NIST 800-171 Requirement: 3.1.3
CMMC Assessment Objective: AC.L2-3.1.3[e]
What This Objective Means
This objective is about pinpointing which services and technologies control the flow of CUI—such as:
• Email servers that apply encryption or block attachments
• Secure file transfer services (e.g., SFTP, HTTPS)
• VPNs that tunnel authorized communication
• DNS and web proxies that block unauthorized destinations
• Messaging or collaboration platforms that allow or restrict file sharing
The assessor wants to see which parts of your system actively govern CUI movement, and that you’ve configured them to match your authorized data flow policies.
Why It Matters
Understanding which services control data flow is essential for:
• Proactively managing and securing those services
• Auditing and troubleshooting flow enforcement
• Ensuring all relevant channels are included in your compliance posture
If these services are misconfigured or overlooked, CUI could be transferred or exposed without your knowledge.
How to Implement It
• Create an inventory of systems and services that move or manage CUI
◦ Email (Microsoft 365, Google Workspace, Exchange)
◦ File sharing (SharePoint, OneDrive, Dropbox [if authorized])
◦ VPN or remote access services
◦ Secure transfer tools (SFTP, file transfer appliances)
• Review and document:
◦ Configuration settings
◦ Encryption standards used
◦ User access and permissions
• Validate that each service:
◦ Enforces encryption
◦ Follows your flow control policy
◦ Prevents unauthorized destinations
Evidence the Assessor Will Look For
• System configuration files or dashboards showing:
◦ Transport layer protections (e.g., TLS settings)
◦ Attachment or file sharing restrictions
◦ Email security policies (e.g., DLP, SPF, DKIM, DMARC)
• Network diagrams highlighting authorized communication paths and associated services
• Documentation showing how services are selected, approved, and configured
Common Gaps
• Using default configurations for services that transmit CUI
• Not disabling unused file transfer or messaging protocols
• No documentation linking system services to your flow control strategy
How Cuick Trac Helps
Cuick Trac addresses this requirement by:
• Using a curated, secure list of system services within its enclave
• Ensuring all data movement services are encrypted and monitored
• Limiting file transfers and data sharing to authorized, logged services only
• Providing documentation of configured system services for audit support
With Cuick Trac, your CUI doesn’t rely on default settings—it flows through services you control and trust.
Final CTA
Know what moves your CUI—and make sure it moves the right way.
Schedule a Cuick Trac demo to see how we manage flow-controlling services by design.