AC.2.020 — Verify and Control Connections to External Systems

What AC.2.020 means in plain English

When your employees connect company devices to external networks or systems — like using their work laptop on a coffee shop Wi-Fi, connecting to a customer's network, or accessing a cloud service not approved by your company — you need rules around that. Company devices that handle CUI should only connect to trusted, known networks, and there should be a process for approving connections to outside systems.

The assessment question

“Do you have a policy and technical controls that restrict company computers and devices (especially those that handle CUI) from connecting to untrusted external networks without protection — for example, requiring VPN use when on public Wi-Fi, maintaining a list of approved cloud services, and prohibiting CUI work on personal or guest networks?”

How to implement AC.2.020

1. Establish a written policy requiring employees to use the company VPN whenever working on any non-company network (hotel, coffee shop, client site). The VPN encrypts traffic and routes it through your controlled gateway.
2. Create an approved cloud services list: document which cloud services employees are authorized to use for work (Microsoft 365 GCC, specific approved SaaS tools) and prohibit use of unauthorized services for CUI (personal Dropbox, personal Google Drive, WeTransfer, etc.).
3. Enable Microsoft Defender's "Network Protection" feature to block connections to known malicious sites: in Windows Security > Virus and Threat Protection > Virus and Threat Protection Settings, enable Cloud-delivered protection and Automatic sample submission.
4. Use Microsoft 365 Conditional Access to require that company devices be compliant (enrolled in Intune, up to date) before accessing Microsoft 365 resources — this prevents unmanaged or personal devices from accessing CUI in the cloud.
5. Conduct a quarterly review of which cloud services are being used: Microsoft 365 GCC Defender for Cloud Apps can generate a Cloud Discovery report showing all cloud services accessed from your network.

Evidence your assessor will ask for

• Written External Connection Policy or Acceptable Use Policy listing approved and prohibited external services
• VPN usage policy and evidence that VPN is deployed and required for remote work
• Approved cloud services list with authorization documentation
• Conditional Access policy screenshots (if using M365)
• Cloud Discovery report showing controlled cloud service usage (if available)

More Access Control controls