Use of External Systems governs how authorized individuals may use systems that your organization does not own or control to reach your system or to handle Controlled Unclassified Information (CUI). External systems include personally owned devices, privately owned devices in public facilities, systems owned by nonfederal organizations, and systems managed by contractors. Use of External Systems (03.01.20) prohibits their use unless specifically authorized, requires you to establish the security requirements they must meet, permits their use only after verification and agreements are in place, and restricts organization-controlled portable storage devices on them. It is closely related to External System Services (03.16.03), which covers the services those external systems provide.
A common difficulty with this requirement is treating it as a simple "no personal devices" policy. R3 is more structured than that. It expects a defined set of security requirements for external systems, verification against your system security plan before use, retained connection or processing agreements, and a specific restriction on portable storage devices. The single Organization-Defined Parameter (ODP) here is the set of security requirements external systems must satisfy, and the Department of Defense (DoD) has published guidance on what that parameter should address.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.01.20 Use of External Systems. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts, and part c has two sub-parts:
The source controls are AC-20, AC-20(01), and AC-20(02) from NIST 800-53. The bracketed assignment in part b is the Organization-Defined Parameter (ODP): the security requirements external systems must satisfy. Per the NIST discussion, organizations may prohibit any type of external system or specific types, and terms and conditions are consistent with the trust relationships established with the entities that own, operate, or maintain those systems. You can read the requirement directly at NIST 800-171 R3, 03.01.20 (p. 17).
One (1) value sits inside this requirement. Depending on your contract, your organization may be permitted to define it. Organizations in the DIB subject to CMMC are not, because the DoD has defined it as policy.
The value below comes from Attachment A of the DoD Chief Information Officer (CIO) memorandum dated 10 April 2025 (signed David W. McKeown). The memo identifies each parameter by requirement sub-part, while NIST 800-171A R3 identifies the same parameter by ODP number. Both identifiers appear below so you can match your System Security Plan (SSP) language to either document.
The guidance for 03.01.20.b, quoted from the memo:
Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems. If applicable, use NIST SP 800-47 as a guide for establishing information exchanges between organizations.
Where the memo gives guidance rather than a fixed value, the guidance tells you how to approach the decision and the decision itself remains yours to make and document. The memorandum does this in four (4) instances across the whole publication.
The memo states that its values "will be updated as necessary," so confirm against the current version before writing them into policy.
NIST 800-171A R3 breaks 03.01.20 into six (6) assessment objectives: one (1) Organization-Defined Parameter (ODP) and five (5) determination statements. These AOs are:
The ODP defines the security requirements external systems must satisfy. If you are a DoD contractor, treat it as guided rather than open. Per ComplianceForge's NIST 800-171 R3 Transition Guide, the DoD guidance for this parameter is that, at a minimum, the terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems, and that if terms and conditions cannot be established with the external system owners, the organization may impose restrictions on personnel using those systems. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.01.20 (p. 20).
Examine: access control policy and procedures; procedures for the use of external systems; terms and conditions for the use of external systems; external systems security requirements; list of types of applications accessible from external systems; system configuration settings; system security plan.
Interview: personnel with responsibilities for defining terms, conditions, and security requirements for the use of external systems; personnel with information security responsibilities; system administrators.
Test: mechanisms for implementing or enforcing terms, conditions, and security requirements for the use of external systems.
03.01.20 maps from NIST 800-171 R2 requirement 3.1.20 (verify and control or limit connections to and use of external systems), and it absorbs R2 requirement 3.1.21 (limit use of portable storage devices on external systems):
Mapped against the six (6) AOs, all six (6) are indirect (moderate effort), with no net-new AOs and none with no mapping. On the surface that means no brand-new objectives, but the indirect mapping is doing real work here. R3 pulled the external systems requirement and the portable storage requirement together and restructured them around a defined set of security requirements, verification against the system security plan, and retained agreements. You should re-analyze rather than assume your R2 external systems evidence transfers as-is.
Source Controls in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.01.20 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about structure and evidence, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.01.20 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.01.20 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.01.20 recording the ODP values you adopted.
With all six (6) AOs mapping indirectly, 03.01.20 is a moderate lift, but the restructuring means real re-analysis. A realistic sequence:
What value does the DoD require for the organization-defined parameter in NIST 800-171 R3 03.01.20? R3 leaves the value to the organization. For the DIB, the DoD set it in the 10 April 2025 memorandum under ODP identifier 03.01.20.b: guidance rather than a fixed value. Organizations establish specific terms and conditions for the use of external systems in accordance with organizational security policies and procedures. At a minimum, terms and conditions address the specific types of applications that can be accessed on organizational systems from external systems and the highest security category of information that can be processed, stored, or transmitted on external systems. If the terms and conditions with the owners of the external systems cannot be established, organizations may impose restrictions on organizational personnel using those external systems. If applicable, use NIST SP 800-47 as a guide for establishing information exchanges between organizations.
How many assessment objectives does NIST 800-171 R3 03.01.20 have? NIST 800-171A R3 breaks 03.01.20 into six (6) assessment objectives: one (1) Organization-Defined Parameters (ODPs) and five (5) determination statements. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 controls does NIST 800-171 R3 03.01.20 come from? AC-20, AC-20(01), AC-20(02).
Where does NIST 800-171 R3 03.01.20 sit in the NIST 800-171 R3 Kill Chain? Phase 16, IT Asset Management (ITAM). The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.01.20 Use of External Systems prohibits unauthorized external systems, defines the security requirements they must meet, permits their use only after verification and retained agreements, and restricts organization-controlled portable storage on them. It maps from R2 3.1.20 and absorbs 3.1.21, with all six (6) assessment objectives transitioning indirectly, so there is no net-new objective but real restructuring. Define the security-requirements parameter (guided by DoD for DoD work), authorize specific external systems, verify against your system security plan, retain the agreements, and restrict portable storage.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3 and references the DoD ODP memorandum of 10 April 2025. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
