Control the flow of CUI in accordance with approved authorizations
📖 What This Means
This practice requires organizations to ensure that Controlled Unclassified Information (CUI) only moves between systems and users based on approved permissions. Think of it like a security checkpoint where only authorized personnel can pass through with specific items. For example, in a hospital, only doctors and nurses can access patient records, and only certain staff can transfer those records between departments. Similarly, in your organization, CUI should only flow where it’s explicitly allowed, preventing unauthorized access or leaks. This helps maintain confidentiality and ensures that sensitive information doesn’t end up in the wrong hands.
🎯 Why It Matters
Uncontrolled flow of CUI can lead to data breaches, exposing sensitive information to unauthorized users. For instance, in the 2017 Equifax breach, poorly managed data flow allowed hackers to access millions of sensitive records, costing the company over $1.4 billion. From a DoD perspective, ensuring CUI flows only through approved channels is critical to protecting national security and maintaining trust with defense contractors. Failure to implement this control can result in costly fines, loss of contracts, and reputational damage.
✅ How to Implement
- 1. Use Identity and Access Management (IAM) tools in AWS/Azure/GCP to define role-based access controls for CUI.
- 2. Configure Data Loss Prevention (DLP) policies to monitor and restrict CUI transfers.
- 3. Enable logging for all data transfers involving CUI using cloud-native logging services (e.g., AWS CloudTrail, Azure Monitor).
- 4. Set up network segmentation and Virtual Private Clouds (VPCs) to isolate CUI traffic.
- 5. Regularly review and update access permissions to ensure they align with approved authorizations.
📋 Evidence Examples
IAM Policy Document
Firewall Configuration Screenshot
Access Logs
DLP Policy Report
Training Records
📝 SSP Guidance
Use this guidance when writing the System Security Plan (SSP) narrative for this control.
How to Write the SSP Narrative
For AC.L2-3.1.3 ("Control the flow of CUI in accordance with approved authorizations"), your SSP narrative should specifically describe: (1) the tools and technologies you use to implement this control, (2) the configuration or process that enforces it, (3) who is responsible for maintaining it, and (4) what evidence proves it's working. Describe how access to CUI systems is controlled, including the specific IAM tools, policies, and processes used. Reference your Access Control Policy and identify the systems in scope. Be specific -- name your actual products, settings, and responsible personnel.
Example SSP Narratives
"AC.L2-3.1.3 is implemented using cloud-native controls. [Organization] uses [specific cloud service/feature] to control the flow of cui in accordance with approved authorizations. The configuration is managed through [Azure Policy/AWS Config/Terraform] and monitored via [SIEM tool]. Responsible party: [IT Security Manager]. Evidence: [specific artifact, e.g., 'Azure AD Conditional Access policy screenshot, CloudTrail logs']."
"AC.L2-3.1.3 is implemented through on-premise infrastructure controls. [Organization] uses [Active Directory/Group Policy/specific tool] to control the flow of cui in accordance with approved authorizations. Configuration is documented in [location] and audited [frequency]. Responsible party: [System Administrator]. Evidence: [specific artifact, e.g., 'Group Policy export, Windows Event logs']."
"AC.L2-3.1.3 is implemented across both cloud and on-premise environments. [Organization] uses [Azure AD Connect/hybrid tool] to ensure consistent enforcement. Cloud resources are managed via [cloud tool] and on-premise systems via [on-prem tool]. Both environments report to [centralized SIEM]. Responsible party: [IT Director]. Evidence: [artifacts from both environments]."
System Boundary Considerations
- • Identify all access points to CUI systems (VPN, direct network, cloud portals)
- • Document which IAM system manages access (Azure AD, AWS IAM, on-prem AD)
- • Map user roles to system access levels
- • Ensure this control covers all systems within your defined CUI boundary where control the flow of cui in accordance with approved authorizations applies
- • Document any systems where this control is not applicable and explain why
Key Documentation to Reference in SSP
- 📄 Access Control Policy
- 📄 IAM configuration documentation
- 📄 Access request and approval records
- 📄 Evidence artifacts specific to AC.L2-3.1.3
- 📄 POA&M entry if control is not fully implemented
What the Assessor Looks For
The assessor will verify that access controls are implemented as described, test whether unauthorized users are blocked, and review access logs for evidence of enforcement.
💬 Self-Assessment Questions
Use these questions to assess your compliance. Each "NO" answer provides specific remediation guidance.
Question 1: Do you have a documented policy for controlling CUI flow?
Question 2: Are IAM roles configured to restrict CUI flow in cloud environments?
Question 3: Are firewall rules in place to control CUI flow on-premise?
Question 4: Are logs being maintained for CUI transfers?
Question 5: Have staff been trained on CUI flow policies?
⚠️ Common Mistakes (What Auditors Flag)
1. Incomplete IAM role configuration
2. Missing firewall rules
3. Inadequate logging
4. Outdated policies
5. Lack of staff training
📚 Parent Policy
This practice is governed by the Access Control Policy