3.13.5

Requirement

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Discussion

Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). DMZs are typically implemented with boundary control devices and techniques that include routers, gateways, firewalls, virtualization, or cloud-based technologies. [SP 800-41] provides guidance on firewalls and firewall policy. [SP 800-125B] provides guidance on security for virtualization technologies

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; system configuration settings and associated documentation; enterprise security architecture documentation; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: System or network administrators; personnel with information security responsibilities; system developer; personnel with boundary protection responsibilities].
Test

[SELECT FROM: Mechanisms implementing boundary protection capability].

ID	Assessment Objectives
3.13.5[a]	Publicly accessible system components are identified.
3.13.5[b]	Subnetworks for publicly accessible system components are physically or logically separated from internal networks.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!