Boundary Protection [CUI Data]

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.1.Source

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

1. [a]

   the external system boundary is defined;

   1 example covers this

2. [b]

   key internal system boundaries are defined;

   1 example covers this

3. [c]

   communications are monitored at the external system boundary;

   1 example covers this

4. [d]

   communications are monitored at key internal boundaries;

   1 example covers this

5. [e]

   communications are controlled at the external system boundary;

   1 example covers this

6. [f]

   communications are controlled at key internal boundaries;

   1 example covers this

7. [g]

   communications are protected at the external system boundary; and

   1 example covers this

8. [h]

   communications are protected at key internal boundaries.

   1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

• addresses[a][b][c][d][e][f][g][h]

  SC.L2-3.13.1 · Boundary Protection [CUI Data]

  Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

  • [a]

    the external system boundary is defined;

  • [b]

    key internal system boundaries are defined;

  • [c]

    communications are monitored at the external system boundary;

  • [d]

    communications are monitored at key internal boundaries;

  • [e]

    communications are controlled at the external system boundary;

  • [f]

    communications are controlled at key internal boundaries;

  • [g]

    communications are protected at the external system boundary; and

  • [h]

    communications are protected at key internal boundaries.

  Named external and internal boundaries, each with its own monitor/control/protect story

  CCControlVerdict Corpus@cv-corpusOSCJul 31, 2026

  Community is just starting — add yours. Only 2 verdicts so far.Last verdict Aug 2, 2026

  Implementation

  AO coverage. Addresses all eight Boundary Protection objectives: defining the external boundary and key internal boundaries, then monitoring, controlling, and protecting communications at each.

  Boundary definition [a][b]. The SSP network appendix names them explicitly. External boundary: the HQ NGFW pair, the Azure hub firewall, and the Microsoft 365 / SaaS tenant perimeter. Key internal boundaries: enclave spoke ↔ corporate spoke, engineering lab VLAN ↔ office VLAN, and the management/PAW VLAN ↔ everything else. Anything not on that list is not treated as a boundary, and adding one requires a diagram update in the same change ticket.

  Monitoring [c][d]. NGFW traffic and threat logs, Azure Firewall logs, and NSG flow logs stream to Sentinel. The lab has no NSG equivalent, so a Zeek sensor on a SPAN port supplies east-west protocol visibility there. Standing detections: new permit rule on any boundary, SMB or RDP crossing an internal boundary outside the approved pairs, and enclave→internet volume above a rolling baseline.

  Control [e][f]. Each boundary has its own default-deny rulebase in both directions. Enclave→internet egress is restricted to an allow-list of SaaS FQDNs and update endpoints. Corporate→enclave is limited to the published app ports; enclave→corporate is limited to DNS and the print path. The management VLAN accepts nothing inbound except from the PAW subnet.

  Protection [g][h]. The site-to-site tunnel uses approved IPsec suites from the crypto inventory. Published internal tools sit behind a reverse proxy with TLS 1.2+ rather than being NAT-exposed. Decryption for outbound inspection is applied where legally and technically allowed, with documented bypass categories (banking, health, HR).

  Maintenance. Quarterly rulebase review against the boundary diagram; rules with no hit count in 90 days are proposed for removal. Monthly silent-source check so a boundary that stops logging opens a ticket. New spokes cannot peer without a rule ticket referencing the diagram version.

  Accepted gap. One CNC network segment supports neither host agents nor a SPAN tap on the available switch. It is a leaf VLAN with a deny-all policy toward every other segment, monitored only at its single upstream interface, and carries no CUI at rest. Listed on the exception register with a switch-refresh target date.

  What the evidence looks like

  • Boundary diagram / SSP network appendix with the versioned list of external and internal boundaries
  • Firewall rulebase exports for each named boundary showing the default-deny base rule
  • Sentinel log-source inventory mapped one-to-one to the boundary list
  • Sample detection and ticket for an unexpected internal-boundary flow
  • Exception register entry for the CNC segment with its compensating rules

  Environment

  Aerospace machining supplier, ~320 staff. CUI enclave is an Azure hub-spoke plus one on-prem engineering lab reached over a site-to-site tunnel.

  Tools

  • Palo Alto NGFW
  • Azure Firewall
  • Cloud NSG
  • Microsoft Sentinel
  • Zeek

  Edit history

  · No edits yet

  2 ratings on this revision

  • BarelyCCControlVerdict Consultant@cv-consultantConsultantAug 2, 2026

    Across the finish line

    Firewall / CA split is named.

    Gaps

    Want more on how management plane access to the boundary devices is controlled.
  • AlignedCAControlVerdict Assessor@cv-assessorAug 2, 2026

    Across the finish line

    Boundary protection story is concrete for a single-enclave OSC.