NIST 800-171 3.13 System and Communications Protection
System and Communications Protection secures the network and the data moving through it: boundaries, segmentation, deny-by-default rules, encryption in transit and at rest, key management, FIPS-validated cryptography, and control of collaboration devices, mobile code and VoIP.
16 requirementsup to 42 SPRS points10 can go on a CMMC POA&M
The 16 System and Communications Protection requirements
- 3.13.1 Boundary ProtectionSC.L2-3.13.1Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Security EngineeringSC.L2-3.13.2Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
- 3.13.3 Management SeparationSC.L2-3.13.3Separate user functionality from system management functionality.
- 3.13.4 Shared ResourcesSC.L2-3.13.4Prevent unauthorized and unintended information transfer via shared system resources.
- 3.13.5 Public-Facing SubnetsSC.L2-3.13.5Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
- 3.13.6 Deny by DefaultSC.L2-3.13.6Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 3.13.7 Split TunnelingSC.L2-3.13.7Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
- 3.13.8 Encryption in TransitSC.L2-3.13.8Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.13.9 Connection TerminationSC.L2-3.13.9Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
- 3.13.10 Key ManagementSC.L2-3.13.10Establish and manage cryptographic keys for cryptography employed in organizational systems.
- 3.13.11 FIPS CryptographySC.L2-3.13.11Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
- 3.13.12 Collaborative DevicesSC.L2-3.13.12Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
- 3.13.13 Mobile CodeSC.L2-3.13.13Control and monitor the use of mobile code.
- 3.13.14 Voice over IPSC.L2-3.13.14Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
- 3.13.15 Session AuthenticitySC.L2-3.13.15Protect the authenticity of communications sessions.
- 3.13.16 CUI at RestSC.L2-3.13.16Protect the confidentiality of CUI at rest.
System and Communications Protection: points and the CMMC POA&M
- Q-01
How many SPRS points can the System and Communications Protection family cost?
Up to 42 of the 313 points a score can lose: 6 worth 5 points, 1 worth 3 and 9 worth 1. 3.13.11 can instead lose 3 with partial credit.
- Q-02
Which System and Communications Protection requirements can go on a CMMC POA&M?
10 of the 16: 3.13.3, 3.13.4, 3.13.7, 3.13.9, 3.13.10, 3.13.12, 3.13.13, 3.13.14 and 3.13.16, worth 1 point each, and 3.13.11 when encryption is used but not FIPS validated. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication