AO coverage. Addresses all eight Boundary Protection objectives: defining the external boundary and key internal boundaries, then monitoring, controlling, and protecting communications at each.

Boundary definition [a][b]. The SSP network appendix names them explicitly. External boundary: the HQ NGFW pair, the Azure hub firewall, and the Microsoft 365 / SaaS tenant perimeter. Key internal boundaries: enclave spoke ↔ corporate spoke, engineering lab VLAN ↔ office VLAN, and the management/PAW VLAN ↔ everything else. Anything not on that list is not treated as a boundary, and adding one requires a diagram update in the same change ticket.

Monitoring [c][d]. NGFW traffic and threat logs, Azure Firewall logs, and NSG flow logs stream to Sentinel. The lab has no NSG equivalent, so a Zeek sensor on a SPAN port supplies east-west protocol visibility there. Standing detections: new permit rule on any boundary, SMB or RDP crossing an internal boundary outside the approved pairs, and enclave→internet volume above a rolling baseline.

Control [e][f]. Each boundary has its own default-deny rulebase in both directions. Enclave→internet egress is restricted to an allow-list of SaaS FQDNs and update endpoints. Corporate→enclave is limited to the published app ports; enclave→corporate is limited to DNS and the print path. The management VLAN accepts nothing inbound except from the PAW subnet.

Protection [g][h]. The site-to-site tunnel uses approved IPsec suites from the crypto inventory. Published internal tools sit behind a reverse proxy with TLS 1.2+ rather than being NAT-exposed. Decryption for outbound inspection is applied where legally and technically allowed, with documented bypass categories (banking, health, HR).

Maintenance. Quarterly rulebase review against the boundary diagram; rules with no hit count in 90 days are proposed for removal. Monthly silent-source check so a boundary that stops logging opens a ticket. New spokes cannot peer without a rule ticket referencing the diagram version.

Accepted gap. One CNC network segment supports neither host agents nor a SPAN tap on the available switch. It is a leaf VLAN with a deny-all policy toward every other segment, monitored only at its single upstream interface, and carries no CUI at rest. Listed on the exception register with a switch-refresh target date.

• Boundary diagram / SSP network appendix with the versioned list of external and internal boundaries
• Firewall rulebase exports for each named boundary showing the default-deny base rule
• Sentinel log-source inventory mapped one-to-one to the boundary list
• Sample detection and ticket for an unexpected internal-boundary flow
• Exception register entry for the CNC segment with its compensating rules