NIST 800-171 3.13.1 (SC.L2-3.13.1): Boundary Protection

What 3.13.1 means in practice

Define the system's external boundary and its key internal boundaries, then monitor, control and protect the traffic crossing them with firewalls, gateways and proxies. Assessors want to see the boundary drawn and the devices that enforce it, with their rules and logs.

SPRS points and the CMMC POA&M

What an assessor checks for 3.13.1

NIST SP 800-171A gives 8 determination statements for 3.13.1, each found satisfied or other than satisfied. Determine if:

1. 3.13.1[a] the external system boundary is defined.
2. 3.13.1[b] key internal system boundaries are defined.
3. 3.13.1[c] communications are monitored at the external system boundary.
4. 3.13.1[d] communications are monitored at key internal boundaries.
5. 3.13.1[e] communications are controlled at the external system boundary.
6. 3.13.1[f] communications are controlled at key internal boundaries.
7. 3.13.1[g] communications are protected at the external system boundary.
8. 3.13.1[h] communications are protected at key internal boundaries.

NIST SP 800-171A (June 2018), assessment objectives for 3.13.1

Evidence that shows 3.13.1 is met

• A network diagram showing the external boundary and the key internal boundaries.
• Firewall and gateway rule sets at each boundary.
• Logs or monitoring records from the boundary devices.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.13.1 from it. Each line says what the product checks.

• Azure: Network security groups. Checks that network security groups control boundary traffic with explicit rules, not Azure's default rules alone.
• Azure: Firewalls and WAF policies. Checks that an Azure Firewall or network virtual appliance is deployed for boundary protection.
• AWS: EC2 and VPC networking. Checks that security groups restrict SSH and common ports from the internet, that default security groups are closed, that instances run inside a VPC without public addresses, and that VPC flow logs are on.
• AWS: S3 buckets · Data stores · Load balancers, API Gateway, CloudFront and Lambda. Checks that S3 buckets, RDS instances, Redshift clusters and Lambda functions are not open to the public, and that Lambda functions run inside a VPC.