In Episode 17 of my NIST SP 800-53 Rev 5 Access Control series, I break down AC-20 (Use of External Systems) and simplify what the control is really asking you to do. The core idea is straightforward: only authorized and trusted external systems and organizations should be able to access your networks, systems, and data. I also explain what NIST means by “external systems” (personally owned devices, contractor-managed systems, systems outside your authorization boundary, and even other systems inside the same org but under different boundaries). And I call out an important nuance—public-facing interfaces used to serve the public are outside the scope of AC-20. From there, I walk through what you should document and monitor: terms and conditions aligned to trust relationships, prohibiting unauthorized connections, monitoring for unauthorized use, and documenting each external connection (interfaces, security requirements, and what information is being communicated). I also point out that AC-20 has multiple enhancements (like restrictions on portable storage and non-org owned systems). Finally, I share how I assess it in real SCA work: I review the SSP plus AC policies/procedures, and I look for the SLA/MOU/ISA (or MOA) that spells out the security measures before any interconnection happens. In practice, you’ll often see AC-20 referenced and tested under CA-3, and if there are no interconnections, this control may be not applicable.