Boundary Protection

Define the boundaries before you defend them.

Objectives [a] and [b] ask for definitions, not equipment. Draw the external boundary where your system meets the internet and anything else you do not control. Then name the components that sit on it: the firewall, the VPN (virtual private network) gateway, and the cloud services where your traffic lands. Then decide whether any key internal boundaries exist. A network diagram that names these boundaries answers [a] and [b] and gives the other six objectives something to attach to.

A small, deliberate boundary makes the rest of this family cheaper.

Every boundary you define must then be monitored, controlled, and protected. An enclave isolates the systems touching CUI (Controlled Unclassified Information) behind one firewall and one set of rules. That gives you two boundaries to defend instead of a sprawling network's dozen. The segmentation that carves the enclave out of the rest of your network is itself a key internal boundary under [b], so monitor and control it like the perimeter.

Having no key internal boundaries is an acceptable answer when it is true.

A small flat network with nothing separating one part of the system from another has no key internal boundaries to name. Write that determination down under [b] and the internal halves of [d], [f], and [h] follow it. What fails is silence: an assessor who finds a segmented development network or a separate WiFi you never declared will ask why your definition missed it.

Cover three verbs at each boundary: monitor, control, protect.

Objectives [c] through [h] pair monitoring, control, and protection with each boundary class. Monitoring means the traffic is logged, reviewable, and alerting on the suspicious [c, d]. Control means connections are denied by default and allowed by exception [e, f], which SC.L2-3.13.6 sharpens into its own requirement. Protection means encryption or tunneling where the traffic warrants it [g, h]. Walk each named boundary through all three verbs. Record the mechanism in your system security plan, the document that describes how your system meets each requirement.

A cloud-first company still has boundaries to declare.

When your CUI lives in a cloud tenant and your staff work from anywhere, the external boundary changes shape. It becomes the host-based firewall on each managed endpoint plus the cloud service's own managed perimeter. Declare both, show the endpoint firewall denying unsolicited inbound traffic, and point at the provider's boundary responsibilities in its shared responsibility documentation.