Control CUI Flow

Official Source Material

Control the flow of CUI in accordance with approved authorizations.

Determine if:

[a] information flow control policies are defined;
[b] methods and enforcement mechanisms for controlling the flow of CUI are defined;
[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
[d] authorizations for controlling the flow of CUI are defined; and
[e] approved authorizations for controlling the flow of CUI are enforced.

Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024

Practitioner Guidance

How to meet it

Flow control is about where CUI travels, not who may access it.

CUI is the controlled unclassified information your contract requires you to protect. AC.L2-3.1.1 and AC.L2-3.1.2 govern access. This requirement asks you to name where CUI is allowed to move: between your enclave and the prime, between your sites, into and out of cloud services and subcontractors. You do not have to account for where all traffic goes, only where CUI goes, so there is no obligation to list every website your users visit.

A data flow diagram carries objective [c].

Draw every place CUI enters, lives, and leaves, the systems it sits in, and the channels between them, with a short explanation of each source and destination. That one artifact answers [c], and the rest of the requirement refers back to it.

Objectives [a], [b], and [d] call for a policy. [e] asks for proof.

Write down how CUI is allowed to move, which methods and mechanisms enforce that movement, and who is authorized to move it. Then show the enforcement: access control lists on the CUI library, sharing restrictions, or a data loss prevention (DLP) rule. In a small shop, the signed policy and the training records that back it are the enforcement. Objective [e] is where the assessor checks that [a] through [d] are real.

Policy plus training is a legitimate enforcement mechanism for a small organization.

The assessment guide's own example meets the requirement with a written transmission policy, manager approval, encryption or a secure transfer utility for outbound CUI, and a disciplinary clause. As users, devices, and data volume grow, add technical enforcement such as sensitivity labels and DLP, because at scale a signature does not stop an upload.

Do not block the internet to pass this.

No objective requires blocking public web access, allowlisting inbound email senders, or banning personal email sites. Building an egress allowlist of every site your users may reach is a huge undertaking the requirement never asks for. Keep the controls pointed at the paths CUI actually takes.

What falls short

A policy that only covers sending CUI to the prime contractor. Internal flows and flows to subcontractors are also flows, so [c] and [d] are incomplete.
Policy-only enforcement in a large organization with many users, devices, and data paths. At that scale [e] needs technical enforcement behind the signatures.

Edge cases

When some of your CUI is export controlled, apply the strictest flow rules to the whole set rather than maintaining parallel flow regimes.
A DLP workflow that prompts senders for justification and notifies IT satisfies the enforcement leg. Keep the authorize, implement, and monitor roles with different people so the workflow does not collide with AC.L2-3.1.4.