This is the hardest AC control for most small contractors. It’s not about blocking everything external. It’s about being deliberate about what external systems you’re connected to, approving those connections, and proving you’ve prevented CUI leakage. Home office workers, cloud services, and contractor access all create external connection risk that assessors focus on.
What the assessor is actually evaluating
The NIST language says “verify and control/limit connections to and use of external information systems.” The assessor is checking four things:
Do you have a deliberate process for approving external connections? Not a casual decision. A formal process where someone evaluates an external system, assesses the risk of CUI exposure, and decides whether to approve it and under what conditions.
Can you list all approved external connections? This is where contractors usually struggle. Can you produce a list of every external system your organization uses? Slack, Google Drive, Microsoft 365 cloud services, VPNs, cloud backups, contractor networks, third-party APIs. If you can’t list them all, you can’t control them.
How do you prevent CUI from leaking to unapproved systems? Technical controls matter here. This might be network segmentation, data loss prevention (DLP) policies, conditional access restrictions, or application-level controls. The assessor wants to see that CUI can’t reach an external system unless you’ve intentionally allowed it.
What about edge cases like home office workers? If someone’s working from home with a contractor laptop, that laptop is an external system. What controls prevent them from copying CUI to their personal Google Drive, uploading to personal Dropbox, or printing to a personal printer? This is the specific gotcha from real assessments. These controls overlap with AC.L2-3.1.21 (portable storage restrictions) and the boundary protections described in SC.L2-3.13.1.
What a realistic SSP definition looks like
[Organization Name] controls connections to external information systems through a documented External System Approval Process. All external systems that CUI-handling systems connect to, or that personnel may use while handling CUI, must be approved by the IT Director prior to use.
Approved external systems include: [specify], e.g., Microsoft 365 (cloud authentication, Outlook, OneDrive), Slack (approved for non-CUI collaboration), [any third-party APIs or integrations], VPN for remote access. Unapproved systems include Google Drive, personal Dropbox, personal email accounts, and social media.
For approved systems that are cloud-based or operated by external parties, we require data encryption in transit, authentication controls, and audit logging. Contract reviews or Business Associate Agreements document the controls the external system provides.
Technical controls prevent CUI from reaching unapproved external systems. For remote workers, we enforce data loss prevention (DLP) policies that block uploads to non-approved cloud storage. Personal devices are not permitted. Organization-provided devices have USB restrictions preventing data export to unapproved portable storage. Printing is disabled on remote devices.
We monitor external system usage through network monitoring and endpoint tools. Attempts to access unapproved systems are logged and reviewed.
The critical part: you’ve named approved systems, explained why they’re approved, and described the technical enforcement that prevents unauthorized external connections. Network monitoring and logging of external access attempts ties to AU.L2-3.3.2 (audit monitoring for suspicious activity).
How to present your evidence
- External System Approval Policy with formal review process
- Approved External Systems list with descriptions of each system and use case
- Data Loss Prevention (DLP) policies preventing CUI export to unapproved systems
- Conditional Access policies restricting system access from external networks
- Application restrictions or removable media blocking on devices accessing CUI
- Evidence of external system contract reviews or BAAs
- Monitoring logs showing attempts to access unapproved external systems
Approved external systems list. This is your foundation. List every external system, including cloud services, APIs, third-party connections, and VPNs. For each one, note whether CUI can flow to it and under what controls. This list should be thorough and honest. If you use Slack, Google Drive, or other cloud services, they need to be on here or your control fails.
Your external system approval policy. The formal process for evaluating and approving external connections. Who evaluates them, what criteria are used, and how decisions are documented.
DLP or content restriction policies. If using Microsoft 365, show the DLP rules preventing email with CUI to external recipients. Show app-level restrictions preventing copying from protected applications. Show USB restrictions on remote devices.
Conditional access policies. Policies that restrict CUI system access based on where the connection is coming from. For example, blocking access from untrusted networks or requiring MFA for external connections.
Device restrictions for remote workers. Proof that personal devices can’t connect. Proof that organization devices have USB disabled, printing disabled, and camera/microphone disabled when accessing CUI.
Monitoring logs. Evidence that you monitor for external system access attempts. Show SIEM logs or firewall logs demonstrating that unapproved external connections are logged.
Keep answers short. Show the evidence, don't describe it. Let the assessor drive. For more on how to present in the assessment room, see How to Present Evidence in the Assessment Room.
Common failures
No external systems list. You use Microsoft 365, Slack, and Dropbox but you don't have a formal list of approved systems. The assessor asks about Dropbox and you don't have a documented decision about it. This is a finding.
External systems aren't actually controlled. Your policy says Google Drive is unapproved, but employees can still access it from CUI devices. If the assessor opens a browser and navigates to Google Drive, that's a failed control.
No DLP or content controls. Your policy says CUI can't be shared externally, but there are no technical controls preventing it. DLP policies, conditional access, or application-level controls need to be in place.
Cloud services aren't addressed in the SSP. Many contractors mention approved systems but gloss over cloud services. Your SSP needs to explicitly address which cloud services are approved, how you prevent CUI from being shared to unapproved ones, and what monitoring you do.
Home office workers treated the same as office workers. A remote worker's device is an external system. If you don't have controls preventing them from printing to a personal printer, from USB devices, or from uploading to personal cloud storage, this control fails.
No monitoring of external connections. You block some things but you don't monitor for attempts. If someone tries to access an unapproved system, you should be logging that.
Documented external systems list that's complete and honest. Approval process for new external connections. Technical controls preventing CUI from reaching unapproved systems (DLP, network restrictions, device controls). Monitoring for unauthorized external access attempts. Specific controls for remote workers and home office environments. That's a strong answer, and it shows you understand that CUI boundary protection extends across your entire network.
Short, practical breakdowns of what assessors actually ask and how to answer. No compliance jargon, no sales pitch. Subscribe free on Substack.
If you use an MSP/MSSP
If your MSP manages your network or cloud infrastructure, they need to help you define and enforce external system controls.
What’s typically on you:
- Defining which external systems are approved
- Approving new external connections
- Making policy decisions about cloud services, remote work, etc.
What’s typically on the MSP:
- Implementing DLP policies
- Configuring conditional access and network restrictions
- Enforcing device controls (USB, printing, etc.)
- Monitoring external system access attempts
- Providing logs of blocked external access attempts
In the assessment, your MSP should be ready to demonstrate the technical controls. They should show DLP rules, conditional access policies, firewall logs, and device restrictions. They should explain how they prevent CUI from flowing to unapproved systems.
Assessors probe this control by asking about specific cloud services and external systems. Have a clear list of approved external systems and a clear explanation of what's blocked. Know your technical controls (DLP, firewall, web filtering, device controls). Be honest about what your organization uses. Don't claim you block something you don't actually block. Assessors will test cloud services by attempting to access them during the assessment. Be ready.
The toughest assessor conversation I've seen on this control is about cloud services. Many contractors use OneDrive, Google Drive, Slack, and other services without formal approval. Your SSP needs to be honest about what you use. If you use it, it's either approved (with documented controls around CUI) or blocked (with technical enforcement proving it's blocked). The worst answer is "we don't allow it" with no evidence that it's actually blocked. Assessors test this. Have the controls ready to demonstrate.
This page covers AC.L2-3.1.20 from NIST SP 800-171 Rev 2 (3.1.20). The guidance here is based on experience in real CMMC assessments and is intended to help you prepare. It is not legal or compliance advice. Your organization’s situation is unique, and you should work with qualified professionals for formal assessment preparation.
New practice breakdowns and assessment tips every week. Follow on Substack to stay current as the November 2026 deadline gets closer.