CMMC Practice SC.L1-3.13.5

Public-Access System Separation: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Monarch ISC Guidance

Organizations that host services available to the public will need to have a DMZ defined at the firewall that creates a safe zone to serve public users without exposing or potentially compromising the internal network. Define the need for a DMZ for all publicly accessible systems, and the plan will note the same firewall defined in SC.L1-3.13.1. The Plan should also note who is responsible for making and approving changes to the firewall which impact the DMZ. To measure the effectiveness of this control, conduct regular penetration tests.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). DMZs are typically implemented with boundary control devices and techniques that include routers, gateways, firewalls, virtualization, or cloud-based technologies. NIST SP 800-41 provides guidance on firewalls and firewall policy. SP 800-125B provides guidance on security for virtualization technologies.