--- title: "NIST 800-171 3.13.1 (SC.L2-3.13.1): Boundary Protection" description: "NIST SP 800-171 3.13.1 Boundary Protection: 5 SPRS points, not allowed on a CMMC POA&M. The text, what assessors check and the evidence." url: https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.1 sealed: 2026-11-11 amended: 2026-11-11 register: nist-800-171/system-and-communications-protection/3.13.1 records: 7 digest: sha3:361c1ea76417d220e9ba0b694a7323350ab4e02d076814b4bc0885f06404e219 --- # NIST 800-171 3.13.1 (SC.L2-3.13.1): Boundary Protection NIST 800-171 / System and Communications Protection / 3.13.1 "Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems." ([NIST SP 800-171 Rev. 2, requirement 3.13.1](https://doi.org/10.6028/NIST.SP.800-171r2)) CMMC Level 2 practice SC.L2-3.13.1. ## What 3.13.1 means in practice Define the system's external boundary and its key internal boundaries, then monitor, control and protect the traffic crossing them with firewalls, gateways and proxies. Assessors want to see the boundary drawn and the devices that enforce it, with their rules and logs. ## SPRS points and the CMMC POA&M - **CMMC Level 2 practice**: SC.L2-3.13.1 - **SPRS points**: 5 points. When it is not met, the DoD Assessment Methodology subtracts 5 from the score of 110. - **CMMC POA&M**: Not allowed. It is worth 5 points, and 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point, with one exception: 3.13.11 when encryption is used but not FIPS validated. Sources: [NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A](https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf); [32 CFR 170.21, Plan of Action and Milestones requirements](https://www.ecfr.gov/current/title-32/section-170.21). ## What an assessor checks for 3.13.1 NIST SP 800-171A gives 8 determination statements for 3.13.1, each found satisfied or other than satisfied. Determine if: - 3.13.1[a] the external system boundary is defined. - 3.13.1[b] key internal system boundaries are defined. - 3.13.1[c] communications are monitored at the external system boundary. - 3.13.1[d] communications are monitored at key internal boundaries. - 3.13.1[e] communications are controlled at the external system boundary. - 3.13.1[f] communications are controlled at key internal boundaries. - 3.13.1[g] communications are protected at the external system boundary. - 3.13.1[h] communications are protected at key internal boundaries. [NIST SP 800-171A (June 2018), assessment objectives for 3.13.1](https://doi.org/10.6028/NIST.SP.800-171A) ## Evidence that shows 3.13.1 is met - A network diagram showing the external boundary and the key internal boundaries. - Firewall and gateway rule sets at each boundary. - Logs or monitoring records from the boundary devices. ## How PolicyCortex gathers the evidence PolicyCortex reads this evidence with the collectors below, read only, and grades 3.13.1 from it. Each line says what the product checks. - **Azure: Network security groups.** Checks that network security groups control boundary traffic with explicit rules, not Azure's default rules alone. - **Azure: Firewalls and WAF policies.** Checks that an Azure Firewall or network virtual appliance is deployed for boundary protection. - **AWS: EC2 and VPC networking.** Checks that security groups restrict SSH and common ports from the internet, that default security groups are closed, that instances run inside a VPC without public addresses, and that VPC flow logs are on. - **AWS: S3 buckets · Data stores · Load balancers, API Gateway, CloudFront and Lambda.** Checks that S3 buckets, RDS instances, Redshift clusters and Lambda functions are not open to the public, and that Lambda functions run inside a VPC. ## Related pages - **Calculator**: [SPRS score calculator: mark 3.13.1 and the other 109 requirements and see the score.](https://policycortex.com/sprs-score-calculator#family-SC) - **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package) - **Family**: [All 16 System and Communications Protection requirements (3.13).](https://policycortex.com/nist-800-171/system-and-communications-protection) - **Previous**: [3.12.4: System Security Plan](https://policycortex.com/nist-800-171/security-assessment/3.12.4) - **Next**: [3.13.2: Security Engineering](https://policycortex.com/nist-800-171/system-and-communications-protection/3.13.2) - **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171) Meet the requirement once. Keep the evidence current. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | REQUIREMENT | 83fb8b9cd7bb | 9700c4ca8aa1 | | REC 0001 | MEANING | 1196e3d3747e | 83fb8b9cd7bb | | REC 0002 | POINTS AND POA&M | 644bbb2cb2e0 | 1196e3d3747e | | REC 0003 | ASSESSMENT OBJECTIVES | 02f0dd61e9f2 | 644bbb2cb2e0 | | REC 0004 | EVIDENCE | 2dacadff571a | 02f0dd61e9f2 | | REC 0005 | COLLECTORS | 300cadbe9ca7 | 2dacadff571a | | REC 0006 | RELATED | 361c1ea76417 | 300cadbe9ca7 | Head sha3:361c1ea76417d220e9ba0b694a7323350ab4e02d076814b4bc0885f06404e219. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.