--- title: "NIST 800-171 3.13 System and Communications Protection" description: "The 16 NIST SP 800-171 System and Communications Protection requirements (3.13, CMMC SC): text, SPRS points, POA&M rules and evidence." url: https://policycortex.com/nist-800-171/system-and-communications-protection sealed: 2026-11-11 amended: 2026-11-11 register: nist-800-171/system-and-communications-protection records: 4 digest: sha3:dedd8cc53db7091c5364815dabe438ff48e38418946352f5f79a108550dc01c7 --- # NIST 800-171 3.13 System and Communications Protection NIST 800-171 / System and Communications Protection System and Communications Protection secures the network and the data moving through it: boundaries, segmentation, deny-by-default rules, encryption in transit and at rest, key management, FIPS-validated cryptography, and control of collaboration devices, mobile code and VoIP. 16 requirements · up to 42 SPRS points · 10 can go on a CMMC POA&M ## The 16 System and Communications Protection requirements | Requirement | CMMC practice | SPRS points | Requirement text | |---|---|---|---| | [3.13.1 Boundary Protection](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.1) | SC.L2-3.13.1 | 5 points | Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | | [3.13.2 Security Engineering](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.2) | SC.L2-3.13.2 | 5 points | Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | | [3.13.3 Management Separation](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.3) | SC.L2-3.13.3 | 1 point | Separate user functionality from system management functionality. | | [3.13.4 Shared Resources](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.4) | SC.L2-3.13.4 | 1 point | Prevent unauthorized and unintended information transfer via shared system resources. | | [3.13.5 Public-Facing Subnets](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.5) | SC.L2-3.13.5 | 5 points | Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | | [3.13.6 Deny by Default](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.6) | SC.L2-3.13.6 | 5 points | Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | | [3.13.7 Split Tunneling](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.7) | SC.L2-3.13.7 | 1 point | Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | | [3.13.8 Encryption in Transit](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.8) | SC.L2-3.13.8 | 3 points | Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | | [3.13.9 Connection Termination](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.9) | SC.L2-3.13.9 | 1 point | Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | | [3.13.10 Key Management](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.10) | SC.L2-3.13.10 | 1 point | Establish and manage cryptographic keys for cryptography employed in organizational systems. | | [3.13.11 FIPS Cryptography](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.11) | SC.L2-3.13.11 | 3 or 5 points | Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | | [3.13.12 Collaborative Devices](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.12) | SC.L2-3.13.12 | 1 point | Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. | | [3.13.13 Mobile Code](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.13) | SC.L2-3.13.13 | 1 point | Control and monitor the use of mobile code. | | [3.13.14 Voice over IP](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.14) | SC.L2-3.13.14 | 1 point | Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | | [3.13.15 Session Authenticity](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.15) | SC.L2-3.13.15 | 5 points | Protect the authenticity of communications sessions. | | [3.13.16 CUI at Rest](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.16) | SC.L2-3.13.16 | 1 point | Protect the confidentiality of CUI at rest. | ## System and Communications Protection: points and the CMMC POA&M **Q: How many SPRS points can the System and Communications Protection family cost?** A: Up to 42 of the 313 points a score can lose: 6 worth 5 points, 1 worth 3 and 9 worth 1. 3.13.11 can instead lose 3 with partial credit. **Q: Which System and Communications Protection requirements can go on a CMMC POA&M?** A: 10 of the 16: 3.13.3, 3.13.4, 3.13.7, 3.13.9, 3.13.10, 3.13.12, 3.13.13, 3.13.14 and 3.13.16, worth 1 point each, and 3.13.11 when encryption is used but not FIPS validated. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88. ## Related pages - **Calculator**: [SPRS score calculator: mark the System and Communications Protection requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-SC) - **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package) - **Previous family**: [3.12 Security Assessment](https://policycortex.com/nist-800-171/security-assessment) - **Next family**: [3.14 System and Information Integrity](https://policycortex.com/nist-800-171/system-and-information-integrity) - **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171) Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | FAMILY | 4a5f8c748e6a | 836b0acbc348 | | REC 0001 | REQUIREMENTS | 76374a57347a | 4a5f8c748e6a | | REC 0002 | POINTS AND POA&M | d4aa6abb6ccf | 76374a57347a | | REC 0003 | RELATED | dedd8cc53db7 | d4aa6abb6ccf | Head sha3:dedd8cc53db7091c5364815dabe438ff48e38418946352f5f79a108550dc01c7. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.