AC.L2-3.1.20

AC.L2-3.1.20 requires the contractor to 'verify and control/limit connections to and use of external systems.' External systems include cloud services, partner networks, contractor-owned BYOD devices, and any other system not owned or controlled by the contractor that connects to the in-scope environment.

In practice, this means maintaining an inventory of external connections, assessing each one for risk, applying technical controls to limit what data flows across the connection, and periodically reviewing whether each connection is still necessary.