AC.L3-3.1.3e  

Reference: CMMC v2.13

Family: AC

Level Introduced: 3

Title: Secured Information Transfer

Practice:
Employ secure information transfer solutions to control information flows between security domains on connected systems.

Further Discussion:
The organization implementing this requirement must decide on the secure information transfer solutions they will use. The solutions must be configured to have strong protection mechanisms for information flow between security domains. Secure information transfer solutions control information flow between a Level 3 enclave and other CMMC or non-CMMC enclaves. If CUI requiring Level 3 protection resides in one area of the environment or within a given enclave outside of the normal working environment, protection to prevent unauthorized personnel from accessing, disseminating, and sharing the protected information is required. Physical and virtual methods can be employed to implement secure information transfer solutions.

Example
You are the administrator for an enterprise that stores and processes CUI requiring Level 3 protection. The files containing CUI information are tagged by the company as CUI. To ensure secure information transfer, you use an intermediary device to check the transfer of any CUI files. The device sits at the boundary of the CUI enclave, is aware of all other CUI domains in the enterprise, and has the ability to examine the metadata in the encrypted payload. The tool checks all outbound communications paths. It first checks the metadata for all data being transferred. If that data is identified as CUI, the device checks the destination to see if the transfer is to another, sufficiently certified CUI domain. If the destination is not a sufficient CUI domain, the tool blocks the communication path and does not allow the transfer to take place. If the destination is a sufficient CUI domain, the transfer is allowed. The intermediary device logs all blocks.

Potential Assessment Considerations
• Has the organization defined the secure information transfer solutions it is using [b]?
• Has the organization defined domains, boundaries, and flows between those domains that need to be controlled [a]?
• Has the organization defined attributes to be associated with the CUI, and both source and destination objects [b]?
• Has the organization defined metadata or some other tagging mechanism to be used as a means of enforcing CUI flow control [b]?
• Has the organization defined filters to be used as a basis for enforcing flow control decisions [b]?
• Has the organization identified CUI flows for which flow control decisions are to be applied and enforced [a,b]?

Source: CMMC v2.13