Mapped to NIST 800-171 Requirement: 3.13.2
CMMC Assessment Objective: SC.L2-3.13.2[a]
What This Control Means
You must maintain visibility into where and how your systems are connected, especially where CUI is involved. This includes:
• Internal system-to-system connections
• Interfaces with external networks or cloud platforms
• APIs or data exchange points with contractors, MSPs, or vendors
• Remote access entry points
This allows you to control, monitor, and secure those connections appropriately.
Why It Matters
If you don’t know where your systems connect:
• You can’t enforce encryption or access control
• CUI may flow through untrusted networks or unknown devices
• Boundary protections may be misaligned
• You may miss insecure APIs, tunnels, or backdoors into your environment
Visibility is the first step to securing communication paths.
How to Implement It
1. Map All System Interfaces
• Identify connections between:
◦ Internal systems (e.g., file servers, workstations, databases)
◦ Internal-to-external systems (e.g., cloud apps, vendor platforms, VPNs)
◦ External-to-external connections that touch your environment (e.g., SaaS platforms)
2. Include All Types of Connections
• Physical (e.g., wired LAN/WAN)
• Wireless (e.g., Wi-Fi, Bluetooth, cellular)
• Virtual (e.g., VPNs, remote desktops)
• API/web services (e.g., RESTful interfaces)
• Cloud storage and backup connections
3. Identify Data Types Transmitted
• Flag systems transmitting or receiving CUI
• Prioritize connections with the highest sensitivity or risk
4. Maintain a System Connection Inventory
• Use diagrams, spreadsheets, or a GRC platform to track:
◦ Connection type and endpoint
◦ Protocols used
◦ Encryption or tunneling status
◦ Owner or responsible party
Evidence the Assessor Will Look For
• Network diagrams or system architecture maps
• Inventory or documentation showing all known system connections
• Descriptions of what data is transmitted and which systems are involved
• Risk assessments evaluating connection trust levels
• SSP entries that reference inter-system connectivity and CUI flows
Common Gaps
• No formal record of system connections
• Overlooked cloud, contractor, or API-based connections
• Unlabeled data flows (e.g., CUI flows across connections, but it’s undocumented)
• Responsibility for system integration is unclear or decentralized
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Mapping and visualizing system connections and CUI data flows
• Maintaining a connection inventory across internal and external interfaces
• Flagging connections that involve CUI and require additional protection
• Assigning ownership for review and documentation updates
• Providing documentation for audits, SSP updates, and risk assessments
With Cuick Trac, your system connections are visible, documented, and secured—end to end.
Final CTA
You can’t protect what you don’t connect.
Schedule a Cuick Trac demo to identify, track, and secure the connections that support your CUI systems.