NIST SP 800-171 Rev 2 · 3.1 Access Control

3.1.20 External connections

Verify and control/limit connections to and use of external systems.

SPRS weight: 1; 1 point deducted from 110 when not implemented.
CMMC level: L1 + L2; Level 1 practice AC.L1-3.1.20, from FAR 52.204-21(b)(1)(iii)
Assessment objectives: 6; From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.1.20 into 6 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external systems; terms and conditions for external systems; security plan; list of types of applications accessible from external systems; system configuration settings and associated documentation; other relevant documents or records].
Interview: [SELECT FROM: Personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems; system or network administrators; personnel with information security responsibilities].
Test: [SELECT FROM: Mechanisms implementing terms and conditions on use of external systems].

Not POA&M-eligible: named exclusion · 1 point deducted

Named in 32 CFR 170.21(a)(2)(iii) as barred from a Level 2 POA&M, even though it is worth a single point. It must be closed before the assessment.

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

Supply chain risk management processes are established Supply Chain Risk Management

No direct mapping.

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.1.20
get_assessment_objectives 3.1.20
generate_poam_entries ["3.1.20"]

From MacZine