This objective verifies that your organization’s systems are technically enforcing the approved rules for how Controlled Unclassified Information (CUI) moves within and between systems. It’s not enough to have policies—you must show your systems actually control and restrict data flow as intended.