Access Control · AC.L1-b.1.iii(e)
Connections to external systems are controlled/limited
An assessment objective under requirement AC.L1-b.1.iii, External Connections, in the Access Control domain.
Objective Statement
Connections to external systems are controlled/limited
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Access Control (AC)
- Objective ID
- AC.L1-b.1.iii(e)
- Parent Requirement
- AC.L1-b.1.iii · Verify and control connections to external systems
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Access control policy
- Procedures addressing the use of external systems
- Terms and conditions for external systems
- System security plan
- List of applications accessible from external systems
- System configuration settings and associated documentation
- System connection or processing agreements
- Account management documents
- Other relevant documents or records
Interview
- Personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems
- System or network administrators
- Personnel with information security responsibilities
Test
- Mechanisms implementing terms and conditions on use of external systems
Related Objectives
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC AC.L1-b.1.iii(e): Connections to external systems are controlled/limited.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/connections-to-external-systems-are-controlled-limited/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.