Mapped to NIST 800-171 Requirement: 3.13.5
CMMC Assessment Objective: SC.L2-3.13.5[a]
What This Control Means
You must identify any system or service that is directly accessible from the internet or a public network. These include:
• Public web servers or portals
• Email gateways
• Cloud-hosted applications
• APIs exposed to external users
• Remote access points (e.g., VPN, RDP gateways)
This assessment helps you understand your attack surface and ensures that CUI is not stored, processed, or transmitted through unprotected channels.
Why It Matters
Public-facing systems are:
• The most visible part of your infrastructure to attackers
• Common targets for scanning, brute force, or exploitation
• Potential CUI exposure points if not properly segmented or secured
Identifying these systems is a prerequisite to securing them and reducing your external risk.
How to Implement It
1. Conduct an External Asset Discovery
• Use tools like:
◦ Nmap
◦ Shodan
◦ External vulnerability scanners
◦ Your cloud provider’s asset inventory
2. Review Your Firewall and NAT Configurations
• Identify systems that have public IP addresses
• Check port forwarding or DMZ configurations
3. Review DNS and Public URLs
• Identify subdomains or hostnames associated with your systems
• Map those to specific infrastructure and services
4. Create a Public System Inventory For each item, document:
• Name and location
• Function (e.g., login portal, API endpoint)
• Network location (IP, DNS)
• Business justification
• Data handled (especially if CUI is involved)
5. Keep It Updated
• Include this inventory in change management and vulnerability scanning workflows
• Review regularly (e.g., quarterly or after new deployments)
Evidence the Assessor Will Look For
• Inventory of public-facing systems with IPs, roles, and owners
• Network diagrams showing public vs. internal system placement
• Documentation of tools or methods used to identify these systems
• System Security Plan (SSP) references to external access points
• Change control records that account for newly exposed services
Common Gaps
• No formal inventory of public-facing systems
• Shadow IT or misconfigured devices exposed without approval
• CUI hosted or transmitted through public-facing systems without encryption or segmentation
• Systems exposed due to firewall misconfigurations or lack of review
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Scanning for and logging all publicly accessible systems in your environment
• Maintaining a real-time inventory tied to CUI data flows and system roles
• Alerting on new public IPs or DNS changes that expand your attack surface
• Linking public system records to boundary protection controls and POA&M items
• Generating audit-ready reports for CMMC readiness
With Cuick Trac, your public-facing infrastructure is fully mapped, monitored, and documented.
Final CTA
You can’t protect what you don’t know is exposed.
Schedule a Cuick Trac demo to discover, document, and defend every system open to the public.