Mapped to NIST 800-171 Requirement: 3.13.2
CMMC Assessment Objective: SC.L2-3.13.2[b]
What This Control Means
After identifying system connections (SC.L2-3.13.2[a]), this control requires that those connections are:
• Clearly documented
• Linked to specific systems, platforms, and interfaces
• Described in terms of purpose, scope, and data involved
• Maintained as part of your system architecture and compliance documentation
This provides a verifiable and audit-ready record of how CUI is transferred and where it flows.
Why It Matters
Without documentation:
• CUI may be transmitted over unapproved or unsecured connections
• Shadow IT or unmonitored cloud usage may go undetected
• Network segmentation may be impossible to enforce
• You can’t demonstrate control of your system perimeter
This control turns your connection visibility into a compliance asset.
How to Implement It
1. Create a System Connection Inventory
• Include:
◦ Source and destination system names
◦ Type of connection (e.g., API, VPN, cloud sync)
◦ Protocols used (e.g., HTTPS, SFTP)
◦ What data flows across (e.g., CUI, authentication credentials)
2. Link to Data Flow Diagrams
• Diagrams help visualize and contextualize connections
• Label CUI-specific pathways clearly
3. Define Ownership and Review Schedule
• Assign responsibility for each documented connection
• Include dates of last verification or risk review
4. Update SSP and Related Policies
• Reference your connection documentation in your SSP and system boundary definitions
• Ensure policies describe how new connections are approved and monitored
Evidence the Assessor Will Look For
• A system connection inventory or network diagram
• SSP sections describing inter-system communications
• Documentation showing what systems are connected and why
• Change control records for new or modified connections
• Policies or procedures for authorizing and reviewing system interfaces
Common Gaps
• Connections exist but are undocumented
• Documentation only includes internal systems, omitting third-party/cloud services
• No record of who approved or maintains each connection
• SSP or policy language is generic, with no system-specific connection data
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a live inventory of all system connections, including those involving CUI
• Linking connection data to systems, data flows, and user access points
• Providing templates and documentation for SSP integration
• Assigning ownership for connection management and review
• Supporting connection risk scoring and access control analysis
With Cuick Trac, your system connection documentation is accurate, centralized, and compliance-ready.
Final CTA
Your connections form the backbone of your CUI environment—document them well.
Schedule a Cuick Trac demo to build and manage documentation for all CUI-related system connections.