3.1.20OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW

3.1.20 — External system connections

3.1 Access Control · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Verify and control/limit connections to and use of external systems.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗

Independent interpretation

What this requirement is after

External systems are systems you do not control — a partner's network, an employee's home computer, a cloud service outside your tenancy. Before your information or your users touch them, you verify what they are and set limits on the connection, instead of discovering the arrangement after the fact.

Mapped practices

Brilliant at the Basics practices that support this requirement

IT-08 — Secure AI adoptionIT

Partial implementation supportModerate confidence

Why: Third-party AI services are external systems, and the practice does to them exactly what this requirement asks: inventory what is in use, sanction specific services under known terms, and limit or block the rest.

What this does not claim: External systems reach far beyond AI — personal devices, partner networks, every unsanctioned cloud service — and the practice governs only the AI class, so the requirement's full inventory and verification work remains. Sanctioning a tool also requires verifying its handling terms (retention, training use, tenancy) against your obligations, which takes contract and configuration review the acceptable-use rule alone does not provide.

Practice-side activities

Inventory AI tools and embedded AI features already in use, including browser extensions
Sanction specific services under reviewed terms and block or restrict the remainder
Provide the sanctioned alternative so unsanctioned use has somewhere legitimate to go

Evidence this produces

The sanctioned AI service list with the terms review per service
Blocking or discovery reports for unsanctioned AI services

Review status: Technical review complete · Reviewed by inDirectIT practitioner review — CUI security and NIST SP 800-171 engineering · updated 2026-08-06

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment

Inventory the external systems already in use — partner portals, personal devices, unsanctioned cloud services — before writing rules about hypothetical ones.
Set the terms per class: which external systems are approved for what, under what agreement, and enforce technically where you can — tenant restrictions, egress filtering, blocking unapproved services.
Give employees a sanctioned path for the legitimate need each unsanctioned service was meeting, or the inventory will just refill.

What operating evidence looks likeRecords worth retaining, not a submission checklist

The approved external system list with the terms and agreement per entry
Technical enforcement configuration limiting unapproved external connections
Records of unsanctioned services found and dispositioned

Suggested owners, derived from the mapped practices and artifacts: Engineering lead · IT leader or compliance lead · IT leader. Ownership is a named person in your organization, not a role on a website.

Artifacts

Templates and worksheets with a mapped relationship

INVENTORY · REVIEW QUARTERLY FULL REVIEW; NEW SERVICES ADDED WITHIN A WEEK OF DISCOVERY OR PROCUREMENTCloud Service and SaaS Inventory WORKSHEET · REVIEW QUARTERLYAI Use-Case and Data-Handling Worksheet

The other revision

Where this lands in Rev. 3

03.01.20 — Use of External Systems

Provenance

Sources and review status

Primary sources	NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review status	Pending NIST SME review
Content version	1.0
Updated	2026-08-06