| name | External System Services (03.16.03)_external-system-services |
| description | Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security re... |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","external system services (03-16-03)","family-03.16","cui-protection","cmmc"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
External System Services (03.16.03) External System Services
High-Level Description
Family: System and Services Acquisition
Framework: NIST SP 800-171 Rev 3
Applicability: Systems processing, storing, or transmitting CUI
Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [organization-defined].
Define and document user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers.
Implement processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis.
What to Check
How to Test
Step 1: Review System Security Plan
Examine the SSP for External System Services (03.16.03) implementation description and responsible parties.
Step 2: Assess Implementation
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Step 3: CMMC Assessment Validation
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Remediation Guide
Requirement Statement
Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [organization-defined].
Define and document user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers.
Implement processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis.
