3.1.20Verify and limit outside systems
Home computers, partner networks, and personal cloud accounts are verified or kept out.
The requirement, verbatim
NIST SP 800-171 Rev. 2 · 3.1.20Verify and control/limit connections to and use of external systems.
NIST's discussion
External systems are systems or components of systems for which organizations typically have no direct supervision and authority over the application of security requirements and controls or the determination of the effectiveness of implemented controls on those systems. External systems include personally owned systems, components, or devices and privately-owned computing and communications devices resident in commercial or public facilities.
This requirement also addresses the use of external systems for the processing, storage, or transmission of CUI, including accessing cloud services (e.g., infrastructure as a service, platform as a service, or software as a service) from organizational systems.
Organizations establish terms and conditions for the use of external systems in accordance with organizational security policies and procedures. Terms and conditions address as a minimum, the types of applications that can be accessed on organizational systems from external systems. If terms and conditions with the owners of external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems.
This requirement recognizes that there are circumstances where individuals using external systems (e.g., contractors, coalition partners) need to access organizational systems. In those situations, organizations need confidence that the external systems contain the necessary controls so as not to compromise, damage, or otherwise harm organizational systems. Verification that the required controls have been effectively implemented can be achieved by third-party, independent assessments, attestations, or other means, depending on the assurance or confidence level required by organizations.
Note that while “external” typically refers to outside of the organization’s direct supervision and authority, that is not always the case. Regarding the protection of CUI across an organization, the organization may have systems that process CUI and others that do not. And among the systems that process CUI there are likely access restrictions for CUI that apply between systems. Therefore, from the perspective of a given system, other systems within the organization may be considered “external" to that system.
NIST SP 800-171 Rev. 2, discussion under 3.1.20. Whitespace normalised; wording unchanged.
Assessment objectives
An assessor decides each of these separately. The requirement is met only when every objective is.
- [a] connections to external systems are identified
- [b] the use of external systems is identified
- [c] connections to external systems are verified
- [d] the use of external systems is verified
- [e] connections to external systems are controlled/limited
- [f] the use of external systems is controlled/limited
NIST SP 800-171A, determination statements for 3.1.20.
For assessors: examine, interview, test
NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.
Examine
- Access control policy
- procedures addressing the use of external systems
- terms and conditions for external system connections
- system security plan
- security assessment report for external systems
- list of applications accessible from external systems
- system configuration settings and associated documentation
- system audit logs and records
- other relevant documents or records
Interview
- Personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems
- system or network administrators
- personnel with information security responsibilities
Test
- Mechanisms implementing terms and conditions on connections and use of external systems
NIST SP 800-171A, potential assessment methods and objects for 3.1.20.
Evidence
No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.
Scoring weight
Worth 1 point. Not meeting this requirement subtracts 1 from your 110-point SPRS score.
DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.
In Rev. 3
Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is reworded: 03.01.20 Use of External Systems. It gains organization-defined parameters.
See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.
Related requirements
Where this page's facts come from
- Requirement text
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
- Discussion
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
- Practice name
- bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
- Objectives
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
- Examine, interview, test
- bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
- Level
- bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
- Weight
- bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
- Rev. 3 mapping
- bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
- Plain-language title and summary
- editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)