CMMCpedia
Work with me

Terms / Scope and assets

Boundary

The line between what is inside your assessment scope and what is outside it. An assessor tests whether the line is actually enforced.

Also called assessment boundary, scope boundary, boundary protection.

Practitioner Guidance

What it means in practice

A boundary is a claim you have to be able to prove.

Drawing a line on a diagram is not a boundary. The boundary exists where a device enforces it: a firewall rule set, an access control list, an identity policy that refuses the connection. SC.L2-3.13.1 is the requirement that asks you to monitor, control, and protect communications at the external boundary and at key internal boundaries. When an assessor tests your scope, this is what they test.

Separation means deny by default, not a different network number.

A separate VLAN with a routable path and a permissive rule between it and the rest of the network separates nothing. The test is whether traffic is denied unless a rule permits it, and whether each permitted rule is narrow enough that controlled information cannot ride through it. Look at the rules, not the diagram. A rule that allows file sharing between an enclave and the rest of the business dissolves the boundary you paid for.

The boundary decides which assets you can call out of scope.

An out-of-scope asset must be unable to process, store, or transmit controlled information, and physical or logical separation is what makes that true. If the separation is weak, the asset is in scope as a contractor risk managed asset instead. That is not a failure. It is a cheaper position to defend than an out-of-scope claim the assessor rejects.

Every path across the boundary is a place evidence has to exist.

Remote access, a file transfer to a customer, a backup that leaves the enclave, and an administrator connecting from a management tool are all crossings. Each one needs a rule, a record, and a reason. Count the crossings before the assessment. An unlisted crossing found during the assessment is the finding that costs you the most time.

What falls short

  • A diagram that shows a boundary no device enforces. The rules are the evidence, and the diagram only describes them.
  • A firewall rule set nobody has reviewed since installation. CM.L2-3.4.1 and SC.L2-3.13.1 both rest on the rules matching what you claim.
  • Separation described as a separate subnet. A subnet is addressing, and separation is enforcement.

Edge cases

  • Your enclave and your ordinary network share an identity provider. That identity service protects the scope, so it is a security protection asset and it is assessed.
  • A user needs to move a file across the boundary as part of the job. Define the path, restrict it to named people, and log it. An undocumented path people use anyway is worse than a documented one.
  • Your boundary is physical rather than network based, such as a locked room holding paper. The same logic applies, and the door and the log are the enforcement.

Over-engineering

  • A dedicated hardware firewall for a four-person enclave inside a cloud tenant. The tenant's own conditional access and network rules enforce the boundary.
  • Buying a data loss prevention suite to create a boundary. Preventing information from crossing a path does not make the asset unable to carry it, so the asset stays in scope either way.