AC.L3-3.1.2e  

Reference: CMMC v2.13

Family: AC

Level Introduced: 3

Title: Organizationally Controlled Assets

Practice:
Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization.

Further Discussion:
Implementing this requirement ensures that an organization has control over the systems that can connect to organizational assets. This control will allow more effective and efficient application of security policy. The terms “has control over” provides policy for systems that are not owned outright by the organization. Control includes policies, regulations or standards that are enforced on the resource accessing contractor systems. Control may also be exercised through contracts or agreements with the external party. Provisioned includes setting configuration, whether through direct technical means or by policy or agreement. For purposes of this requirement, GFE can be considered provisioned by the OSA.

Example 1
You are the chief network architect for your company. Company policy states that all company-owned assets must be separated from all non-company-owned (i.e., guest or employee) assets. You decide the best way forward is to modify the corporate wired and wireless networks to only allow company-owned devices to connect [b]. All other devices are connected to a second (untrusted) network that non-corporate devices may use to access the internet. The two environments are physically separated and are not allowed to be connected. You also decide to limit the virtual private network (VPN) services of the company to devices owned by the corporation by installing certificate keys and have the VPN validate the configuration of connecting devices before they are allowed in [b].

Example 2
You are a small company that uses an External Service Provider (ESP) to provide your audit logging. Access between the ESP and the organization is controlled by the agreement between the organization and the ESP. That agreement will include the policies, standards, and configuration for the required access. Technical controls should be documented and in place which limit the ESP’s access to the minimum required to perform the logging service.

Potential Assessment Considerations
• Can the organization demonstrate a non-company-owned device failing to access information resources owned by the company [b]?
• How is this requirement met for organizational devices that are specialized assets (GFE, restricted information systems) [a,b]?
• Does the company allow employees to charge personal cell phones on organizational systems [b]?

Source: CMMC v2.13