What requirement in the Access Control section of the NIST SP 800-171 2nd revision requires controlling the flow of CUI in accordance with approved authorizations?
This requirement is 3.1.3 and is found in the Access Control section of the SP 800-171.
That requirement is 3.1.3.