03.01.20 Use of External Systems
What the standard requires
a. Prohibit the use of external systems unless the systems are specifically authorized. b. Establish the following security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized individuals: [security requirements]. c. Permit authorized individuals to use external systems to access the organizational system or to process, store, or transmit CUI only after: 1. Verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied and 2. Retaining approved system connection or processing agreements with the organizational entities hosting the external systems. d. Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems.
Quoted verbatim from NIST SP 800-171 Rev 3, which is in the public domain.
Cross-framework mappings
No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.