Mapped to NIST 800-171 Requirement: 3.13.12
CMMC Assessment Objective: SC.L2-3.13.12[c]
What This Control Means
This is the live verification checkpoint.
You must show that:
• Only users identified as authorized actually have access to CUI systems
• There are no rogue, dormant, or unauthorized accounts
• Access levels match business needs and approved roles
• Your authorized user list matches real-world permissions and accounts
This ensures policy matches practice.
Why It Matters
If unauthorized users exist:
• CUI could be exposed to individuals without proper vetting
• Insider threat risk increases
• Dormant accounts could be hijacked by attackers
• You’ll fail critical CMMC or DFARS compliance checks
Good documentation alone is not enough—you must verify access control integrity.
How to Implement It
1. Compare Documentation Against Live Systems
• Review Active Directory, cloud identity providers, local accounts, and application user lists
• Confirm only documented authorized users have access
2. Review Roles and Permissions
• Ensure users have access only to:
◦ The systems they need
◦ The data they are authorized to access
◦ The roles appropriate to their business functions
3. Disable or Remove Unauthorized Users
• Immediately deactivate any accounts:
◦ Without documentation
◦ For departed employees or contractors
◦ Showing inappropriate access rights
4. Perform Access Reviews Regularly
• Quarterly or semiannual access reviews of all systems touching CUI
• Conduct user certifications requiring managers to validate staff access
Evidence the Assessor Will Look For
• Comparison reports matching authorized user lists to system user accounts
• Audit logs showing user access approvals and changes
• Screenshots of user directories or role management systems
• Access review records with management sign-offs
• Records of account disablement or removal for non-authorized users
Common Gaps
• Documented users and live system users do not match
• Dormant accounts active without validation
• Contractors or vendors retaining access beyond contract end dates
• Inconsistent enforcement across different systems or environments
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Comparing authorized user inventories against live system directories
• Flagging discrepancies, dormant accounts, or unauthorized access
• Automating quarterly or semiannual access review workflows
• Linking authorized users directly to system assets and compliance controls
• Generating audit-ready access review reports
With Cuick Trac, your user access control isn’t based on assumptions—it’s verified, enforced, and traceable.
Final CTA
You can’t manage what you don’t verify.
Schedule a Cuick Trac demo to match your authorized users to your real-world system access and protect your CUI with certainty.