What this requirement asks
FAR 52.204-21(b)(1)(iii) text:
Verify and control/limit connections to and use of external information systems.
This is CMMC Level 1 requirement AC.L1-b.1.iii — FAR 52.204-21(b)(1)(iii) — in the Access Control family. Level 1 is assessed on Federal Contract Information (FCI) by annual self-assessment; no POA&M is allowed — every requirement must be fully met at attestation.
Mapped NIST SP 800-171 requirement
- 3.1.20 — assessed in full at Level 2
Assessment objectives (1)
- AC.L1-b.1.iii[a] — Verify and control/limit connections to and use of external information systems.
Evidence that defends it
Define allowed external services; enforce via egress controls
Check your readiness
Level 1 self-assessment
FCI · 15 FAR requirements · annual self-assessment · no POA&M
Self-reported readiness only — not an SPRS score, verified result, or certification. A tick means you report satisfying the entire FAR item.
Path: close all remaining gaps
15 requirements remain unticked. All 15 must be met; Level 1 has no Conditional or POA&M path. Ticking all items does not establish an official status.
Remaining requirements (15)
- AC.L1-b.1.i — Authorized Access Control
- AC.L1-b.1.ii — Access Enforcement
- AC.L1-b.1.iii — External Connections
- AC.L1-b.1.iv — Control Publicly Posted Information
- IA.L1-b.1.v — Identification
- IA.L1-b.1.vi — Authentication
- MP.L1-b.1.vii — Media Sanitization
- PE.L1-b.1.viii — Limit Physical Access
- PE.L1-b.1.ix — Visitor Escort, Physical Access Logs & Access Devices
- SC.L1-b.1.x — Boundary Protection
- SC.L1-b.1.xi — Subnetwork Separation
- SI.L1-b.1.xii — Flaw Remediation
- SI.L1-b.1.xiii — Malicious Code Protection
- SI.L1-b.1.xiv — Malicious Code Updates
- SI.L1-b.1.xv — System & File Scanning
Only your Level 1 requirement ticks are saved in this browser; nothing is sent to Athena. Privacy policy