AUD-2026-03Q3 Internal ISMS + CMMC readiness auditIn fieldwork Sep 15 – Sep 26 · day 9 of 10
JCML
Checked42 of 58
A.5 Organizational
A.8 Technological
9 Performance evaluation
10 Improvement
CK-013A.5 Organizational
3 of 10
Are external system connections inventoried and controlled?
ISO 27001 A.5.19CMMC 3.1.20· one checklist item, two criteria sets (integrated audit)
- Guidance
- Compare firewall export to connection inventory.
- Method
- Test
- Sample
- All 7 site-to-site / vendor tunnels
- Auditee
- TOTom Okafor
Nonconformity recorded — no finding raised yet
Findings need a grade, a statement and an owner before the closing meeting.
Evidence · 1
Preview · Firewall rule export.txt
rule 212 permit tcp 10.40.0.0/16 → m365-gcch 443
rule 213 permit udp 10.40.0.0/16 → ntp 123
rule 214 permit ipsec atlas-backup-gw → 10.40.8.0/24
rule 215 deny any any log
Firewall rule export.txt
Config export · Tom Okafor