NIST 800-171 3.13.5 (SC.L2-3.13.5): Public-Facing Subnets

What 3.13.5 means in practice

Anything the public can reach, such as a web server or a file transfer service, sits in its own subnetwork (often called a DMZ), physically or logically separated from internal networks, with rules that limit what can cross between them. In a cloud environment that usually means a separate subnet or virtual network for public endpoints, with rules that let only the needed traffic in.

SPRS points and the CMMC POA&M

What an assessor checks for 3.13.5

NIST SP 800-171A gives 2 determination statements for 3.13.5, each found satisfied or other than satisfied. Determine if:

1. 3.13.5[a] publicly accessible system components are identified.
2. 3.13.5[b] subnetworks for publicly accessible system components are physically or logically separated from internal networks.

NIST SP 800-171A (June 2018), assessment objectives for 3.13.5

Evidence that shows 3.13.5 is met

• A list of publicly accessible system components.
• A network diagram showing the separate subnetwork that holds them.
• Firewall or network rules between that subnetwork and the internal networks.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.13.5 from it. Each line says what the product checks.

• Azure: Virtual networks. Reads Azure virtual networks and checks that workloads are segmented into separate subnets.