This objective requires organizations to document and define how CUI is allowed to move across systems, networks, and boundaries. You must establish explicit authorizations that govern where CUI can be stored, transmitted, or processed.