This objective requires your organization to identify all system components that are publicly accessible, especially those that are internet-facing or accessible outside of your organization’s internal network. This is critical for ensuring that Controlled Unclassified Information (CUI) is never exposed through unprotected or misconfigured systems.