Implementation examples
6 examples referencing NGFW
- SI.L2-3.14.6[a] [b] [c]
Inbound, outbound, and off-network telemetry with business-hours triage and on-call paging
AO coverage. Addresses all three Monitor Communications for Attacks objectives: the system is monitored, inbound traffic is monitored, and outbound traffic is monitored. System monitoring [a]. EDR…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.14[a] [b]
One sanctioned VoIP platform on a voice VLAN, with call records and toll-fraud alerting reviewed
AO coverage. Addresses both Voice Over Internet Protocol objectives: use of VoIP is controlled, and use of VoIP is monitored. Sanctioned platform. One cloud PBX is approved for business voice.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.9[a] [b] [c]
Inactivity windows defined per connection type: 15 minutes for admin sessions, 12 hours for VPN
AO coverage. Addresses all three Connections Termination objectives: defining the inactivity period, terminating at end of session, and terminating after the defined inactivity period. Defined…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.6[a] [b]
Default-deny rulebases north-south and east-west, with exceptions that expire
AO coverage. Addresses both Network Communication By Exception objectives: deny by default, allow by exception. Deny by default [a]. Every rulebase ends in an explicit deny-all-and-log rule, and the…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.5[a] [b]
One investigation timeline across identity, endpoint, network, and file-server events
AO coverage. Addresses both Audit Correlation objectives: the review, analysis, and reporting processes are defined, and those processes are correlated across sources rather than run independently.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.14[a] [b]
All remote paths land on managed VPN or IdP — no direct RDP to enclave
AO coverage. Addresses both Remote Access Routing objectives. Control points. Internet users reach CUI only via (1) IdP SSO to SaaS or (2) full-tunnel VPN into the lab VRF. Edge firewall denies…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet