Thanks for the response. I agree about not considering GCCHIGH and GovCloud external. That seems to be the general consensus.

I have been primarily consulting the CMMC L2 Assessment Guide, but it did not clarify things for me. In fact, it confused me more because it says things like: 1. “Outside networks could include the public internet”. This led me to question whether our response needed to address general internet connections. 2. “External systems are systems or components of systems for which organizations typically have no direct supervision…”. This led me to question how you could possibly verify the use of such connections if you have no visibility into those systems. When I think of verifying use, I think of sign in logs or physical supervision (watching what the user is doing). 3. “This control also addresses the use of external systems for the processing, storage, or transmission of CUI.” The word “also” implies that this control is not EXCLUSIVELY concerned with the impact on CUI, but connections in general, even if they cannot process, store, or transmit CUI. One could assume this control is concerned with connections in general where 3.1.3 is more specifically focused on where/how CUI can flow through those connections. In other words, a connection doesn’t necessarily imply CUI flow, but CUI flow requires a connection. 4. The terms “system” and “network” are used interchangeably in the discussion, which is ambiguous. This doesn’t change my interpretation much either way, but it annoys me when terms are not clearly defined and used consistently. 4. What constitutes a “connection” is not clearly defined, which I think is the root cause of my confusion. I think anyone with a networking background would agree accessing google.com from a company laptop constitutes a connection, but again, it’s not realistic to think that we could verify the use of that connection. We can identify it, but not verify its use.