This objective confirms whether your organization’s controls and configurations are actually preventing unauthorized software, firmware, and data from being loaded onto systems handling Controlled Unclassified Information (CUI). It goes beyond policy and looks for evidence of functional prevention, not just intent or design.