Public-Access System Separation

List what the public can reach before deciding how it is separated.

Objective [a] is an inventory: the public website, the VPN (virtual private network) portal, and the mail gateway. Add anything else with a login page or a service listening for connections from the internet. Publicly accessible means reachable without credentials, so a portal that demands a password still belongs on the list, because its login page is the reachable part.

Separation is a subnetwork with default deny toward the inside.

The classic answer is a DMZ, a buffer network for public-facing components. Put those components on their own subnet or firewall zone. Deny traffic from that zone into the internal network by default, and allow it only by specific rule. Virtual LANs, firewall zones, and cloud network segmentation all qualify as logical separation.

Hosting public components outside your network is separation by construction.

A marketing website run by a third party on the third party's infrastructure never touches your internal network. Identify it under [a], record where it lives, and the separation for [b] is the fact that it shares nothing with the systems holding CUI.