This objective confirms that your organization’s public-facing systems are formally reviewed and authorized before being deployed, especially those that interact with systems processing Controlled Unclassified Information (CUI). This ensures that exposure to the public internet is intentional, justified, and approved.