This assessment objective verifies that technical system configurations align with your organization’s defined CUI flow rules. It focuses on direct examination of the infrastructure—firewalls, access control lists, network segmentation, and application settings—to confirm that CUI can only move where it’s explicitly allowed.