This objective requires your organization to identify all systems that are accessible from the public internet or other unrestricted external networks, especially those that may interface directly or indirectly with systems handling Controlled Unclassified Information (CUI).