Skip to content
ControlVerdict
Sign in
SC.L2-3.13.5CMMC Level 2Level 2

Public-access System Separation [CUI Data]

Submit your own example

Practice statement

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.5.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    publicly accessible system components are identified; and

    1 example covers this

  2. [b]

    subnetworks for publicly accessible system components are physically or logically separated from internal networks.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.5Public-access System Separation [CUI Data]
    Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

    • [a]

      publicly accessible system components are identified; and

    • [b]

      subnetworks for publicly accessible system components are physically or logically separated from internal networks.

    Public web and file-drop portal in a separate cloud account with no route home

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Public-access System Separation objectives: identifying publicly accessible components and separating their subnetworks from internal networks.

    Publicly accessible components identified [a]. The marketing CMS and its database, the careers portal, the customer file-drop portal and its object storage bucket, the outbound mail relay for marketing, and the guest wireless network. Each is listed in the asset inventory with a “public” data-flow classification, and anything newly exposed to the internet must be added before the DNS record is published.

    Logical separation [b]. Public workloads run in their own cloud account with its own identity boundary, not in a subnet of the enclave environment. There is no VPC peering, no transit gateway attachment, and no VPN route between that account and the enclave; the route tables are the evidence. Inbound traffic terminates on a reverse proxy in a DMZ subnet; only the proxy can reach the application subnet, and the application subnet has no path to any internal address space.

    File-drop data flow. Customers upload to the portal's storage bucket. A one-way pull job initiated from inside the enclave retrieves files, scans them, and writes them to the labeled store. The portal cannot initiate a connection inward, and no enclave credential is stored in the public account.

    Guest wireless. The guest SSID is a distinct VLAN with an internet-only route, client isolation on, and no DNS resolution for internal zones. Corporate laptops stay on the enterprise SSID; a CUI device on guest Wi-Fi cannot reach enclave apps because it still has to satisfy device compliance through the IdP.

    Maintenance. Quarterly route table and peering review for accidental attachments, plus an external scan of the public account's address ranges to confirm only the intended ports answer. New public services require a data-flow diagram in the change ticket.

    Accepted gap. The marketing CMS shares an administrative SSO group with corporate identity for convenience. Compensating controls: those admins use phishing-resistant MFA, the CMS holds no CUI, and DLP blocks upload of labeled content to the CMS.

    What the evidence looks like

    • Asset inventory entries flagged as publicly accessible
    • Route tables / peering configuration showing no path between the public account and the enclave
    • Reverse proxy and DMZ subnet configuration
    • Guest VLAN configuration with internet-only routing and client isolation
    • Quarterly external scan output and peering review notes

    Environment

    Marketing site, careers pages, and a customer file-drop portal, all internet-facing. Office guest Wi-Fi in the same category.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.