Mapped to NIST 800-171 Requirement: 3.13.14
CMMC Assessment Objective: SC.L2-3.13.14[a]
What This Control Means
You must identify specific mechanisms that control:
• Outbound CUI data flows leaving your trusted environment
• Inbound CUI transfers entering your systems from external sources
• Internal segregation between CUI and non-CUI environments
This includes tools, technologies, and administrative processes that:
• Block unauthorized transfers
• Detect and inspect outgoing/incoming data flows
• Limit exposure points where CUI could leak
Why It Matters
Without proper boundary controls:
• CUI could be accidentally sent to unauthorized recipients
• Malware could exfiltrate CUI through unmonitored channels
• Misconfigurations could expose internal systems to external threats
• You would fail compliance audits requiring outbound and inbound CUI controls
Identifying these mechanisms ensures intentional, risk-based control of CUI movement.
How to Implement It
1. Define Boundary Points Where CUI Could Transfer Examples:
• Internet gateways
• VPN tunnels
• Email servers
• Web portals or APIs
• Cloud storage interfaces
2. Identify Data Loss Prevention (DLP) or Content Filtering Tools Examples:
• Email DLP scanning (e.g., Microsoft Purview, Proofpoint)
• Firewall outbound content rules
• CASB (Cloud Access Security Broker) for cloud CUI control
• Application Layer Gateways (e.g., proxy servers inspecting uploads/downloads)
3. Configure Controls to Monitor and Restrict Transfers
• Allowlist approved destinations (e.g., partner portals, secure FTP)
• Block unauthorized file types or data categories
• Encrypt CUI in transit where allowed
• Require manual review for sensitive transfers (e.g., large file uploads)
4. Document These Mechanisms
• In your System Security Plan (SSP)
• In your Network Security Policy or Data Handling Policy
Evidence the Assessor Will Look For
• Lists of tools and controls managing CUI transfers
• Firewall or proxy configuration documentation
• DLP system configuration screenshots
• Email filtering policies for CUI detection and protection
• SSP entries describing CUI transfer restrictions at system boundaries
Common Gaps
• No outbound traffic inspection (only inbound firewall rules)
• No DLP in place to monitor CUI in email or cloud platforms
• Overly broad internet access without restrictions for CUI handling systems
• Manual file transfers allowed without security review or encryption enforcement
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping all points where CUI could cross system boundaries
• Tracking and documenting DLP, firewall, and content inspection settings
• Verifying enforcement of CUI transfer policies at every ingress and egress point
• Linking CUI flow protection mechanisms to your SSP and audit trail
• Alerting if unprotected data flows or policy violations are detected
With Cuick Trac, CUI transfers aren’t accidental—they’re controlled, monitored, and documented.
Final CTA
Every CUI transfer must be intentional, protected, and recorded.
Schedule a Cuick Trac demo to identify, monitor, and secure all communications at your system boundaries.