CMMC NUGGET #16

Proper Asset Management

AC.L2-3.1.20: Verify and control/limit connections to external systems

This is a Level 1 control, meaning it applies to any organization handling FCI, not just CUI. It requires organizations to know, verify, and control every connection between their systems and external systems, cloud services, partner networks, vendor portals, personal devices connecting from outside the environment, before that connection is permitted.

Example: A contractor’s engineering workstation has a long-standing connection to a supplier’s file-sharing portal that was set up years ago for a project that ended. No one revisited it, and the connection remains active, unmonitored, and undocumented. It becomes an unexamined pathway in and out of the CUI environment.

Implementation components:

• A maintained inventory of authorized external system connections, tied to a business justification for each one
• A verification step before any new external connection is permitted
• Periodic review to identify and terminate connections that are no longer needed

You genuinely cannot control connections to external systems if you don’t have an accurate inventory of your assets and their connection points in the first place. That’s the real link between this control and asset management.

AC.L2-3.1.4: Separate the duties of individuals to reduce the risk of malevolent activity without collusion

This is the control that actually covers segregation of duties, distinct from AC.L2-3.1.20 above. It requires dividing critical tasks (such as requesting, approving, and provisioning system access) among different individuals so no single person can execute a sensitive transaction end-to-end without oversight.

Implementation components:

1. Segregation of duties: Divide critical tasks, particularly around account provisioning, access approval, and system changes, among different people
2. Access reviews: Regularly audit user access rights to confirm duties remain properly separated as roles change
3. Multifactor authentication: MFA for sensitive system access is good practice generally, but note it satisfies IA.L2-3.5.3 (covered in Nugget #10), not this control specifically. Don’t let MFA implementation substitute for actually separating duties.

Assessor Reality Check: A small organization’s honest limitation (“we don’t have enough staff to fully separate these duties”) is a real operational challenge, not a compliance exemption. Assessors expect to see compensating controls, such as documented secondary review or approval, when true segregation isn’t reasonably possible.

Physical and digital media containing CUI are assets too, and they carry their own tracking requirements. We’ll cover the full nine-control Media Protection family in depth in Nugget #17, but three controls are worth introducing here specifically because they intersect with asset tracking:

MP.L2-3.8.3: Sanitize or destroy system media before disposal or release for reuse

A Level 1 control requiring media to be sanitized before it leaves your control, whether it’s being disposed of, repurposed, or returned to a vendor at end of lease.

MP.L2-3.8.4: Mark media with necessary CUI markings and distribution limitations

Example: A contractor exports a spreadsheet of technical data to a USB drive for a site visit. The drive itself carries no marking indicating it contains CUI, and when it’s later found in a shared desk drawer, no one can tell at a glance whether it needs to be handled as CUI or not.

Implementation components:

1. A consistent labeling system applied across all media types, physical and digital
2. Regular training so staff apply markings consistently rather than treating it as optional
3. Automated tagging tools (DLP software, metadata classification) to reduce reliance on manual labeling

MP.L2-3.8.5: Control access to media containing CUI and maintain accountability for that media during transport outside controlled areas

Implementation components:

1. A maintained inventory of media known to contain CUI
2. Encryption of CUI on media before it leaves controlled areas (see MP.L2-3.8.6 in Nugget #17 for the FIPS-validated cryptography requirements this control depends on)
3. Secure transport procedures with tracking, such as a signed chain-of-custody log for anything hand-carried or shipped

The full depth on marking, sanitization, transport, and encryption standards for media, including the FIPS-validation requirements and the remaining MP controls not covered here, is in Nugget #17. Consider this section the asset-tracking preview of that broader topic.

AC.L2-3.1.20 Stale external connections never reviewed or decommissioned

AC.L2-3.1.4 Duties nominally separated on paper but not enforced technically

MP.L2-3.8.3 Media disposed of or reused without sanitization

MP.L2-3.8.4 No consistent marking system; CUI media indistinguishable from non-CUI media

MP.L2-3.8.5 No accountability inventory for media known to contain CUI

The controls in this nugget span two families: AC and MP. AC.L2-3.1.20 and AC.L2-3.1.4 belong under Access Control, even though the first is about external connections and the second is about internal duty separation. Don’t let their shared family lead you to describe them as one combined control in your SSP; they have separate assessment objectives. MP.L2-3.8.3, MP.L2-3.8.4, and MP.L2-3.8.5 belong under Media Protection, alongside the remaining MP controls covered in Nugget #17.

For each control your SSP should document:

• The specific technical or procedural implementation
• The policy governing it, including review and inventory cadence
• Who is responsible for maintaining the relevant inventory or performing the review
• How compliance is verified

For assistance building an asset inventory that actually supports your external connection reviews, contact DTC’s C3PAO team.