SC-7—Boundary Protection

PBMM (P1)

Secret (P1)

Technical

>Control Description

(A) The information system monitors and controls communications at the external boundary of the system and at key internal boundaries within the system. (B) The information system implements sub-networks for publicly accessible system components that are ☑physically; logically separated from internal organizational networks. (C) The information system connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

>Supplemental Guidance

Managed interfaces include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected sub-networks). Sub-networks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational information systems includes, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses.

Organizations consider the shared nature of commercial telecommunications services in the implementation of security controls associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers, and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions.

Related controls: AC-4, AC-17, CA-3, CM-7, CP-8, IR-4, RA-3, SC-5, SC-13

>Tailoring Guidance

A Web Content Filtering proxy is a common device to monitor and control web traffic. Network-based intrusion detection or prevention system is another common device to monitor and control network traffic.

Ask AI

Configure your API key to use AI features.