Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
AC.L1-3.1.20 · FAR 52.204-21 (b)(1)(iii) · NIST SP 800-171 3.1.20
External Connections
Verify and control/limit connections to and use of external information systems
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Control what outside systems (personal laptops, vendor tools, random cloud apps) can connect to yours.
Why it matters
For small contractors this usually means personal devices and SaaS tools touching contract info. A written list of external connections plus a short use policy is the control, not a zero-trust deployment.
The proof on file
- Access and session policies (Microsoft 365)Pulled read only from Microsoft 365 · June 10, 2026On file
The narrative on file
There are no public terminals or shared logins. The one shop floor estimating PC signs in with the same managed accounts and connects to the tenant over the company VPN only. The only outside connection is High Desert IT Services' remote support, which signs in through its named admin account under the same access and session policies as staff. No other external system connects into the Federal Programs tenant.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- The full inventory lists every external connection: SaaS tools, prime portals, BYOD, vendor VPNs
- For each connection: purpose, what data it touches, who authorized it
- A written 'External System Use' policy or rule is included or referenced
- Owner signature and date on the inventory
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365, step by step
- 1Go to entra.microsoft.com → External Identities → External collaboration settings
- 2Screenshot the guest access and sharing settings
- 3Go to Users → Guest users and screenshot the list of current guests
Capture: Screenshot of external collaboration settings plus the guest-user list.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.