What this requirement asks
Control the flow of CUI in accordance with approved authorizations.
This is a CMMC Level 2 requirement in the Access Control family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (5)
- 3.1.3[a] — information flow control policies are defined
- 3.1.3[b] — methods and enforcement mechanisms for controlling the flow of CUI are defined
- 3.1.3[c] — designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified
- 3.1.3[d] — authorizations for controlling the flow of CUI are defined
- 3.1.3[e] — approved authorizations for controlling the flow of CUI are enforced
What an assessor examines
Examine:
- Access control policy
- information flow control policies
- procedures addressing information flow enforcement
- system security plan
- system design documentation
- system configuration settings and associated documentation
- list of information flow authorizations
- system baseline configuration
- system audit logs and records
- other relevant documents or records
Interview:
- System or network administrators
- personnel with information security responsibilities
- system developers
Test:
- Mechanisms implementing information flow enforcement policy
Evidence that defends it
Document flows; export firewall/DLP rules; log evidence of enforcement
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.