SC.L2-3.13.1
Boundary Protection [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.1 in the reference catalog with its NIST cross-references
Official requirement
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
Assessment objectives
a. the external system boundary is defined;
b. key internal system boundaries are defined;
c. communications are monitored at the external system boundary;
d. communications are monitored at key internal boundaries;
e. communications are controlled at the external system boundary;
f. communications are controlled at key internal boundaries;
g. communications are protected at the external system boundary; and
h. communications are protected at key internal boundaries.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Monitor, control, and protect communications at external and key internal boundaries.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are setting up the new network and want to keep your company’s information and resources safe. You start by sketching out a simple diagram that identifies the external boundary of your network and any internal boundaries that are needed [a,b]. The first piece 188 NIST SP 800-171 Rev. 2, p. 36. of equipment you install is the firewall, a device to separate your internal network from the internet. The firewall also has a feature that allows you to block access to potentially malicious websites, and you configure that service as well [a,c,e,g]. Some of your coworkers complain that they cannot get onto certain websites [c,e,g]. You explain that the new network blocks websites that are known for spreading malware. The firewall sends you a daily digest of blocked activity so that you can monitor the system for attack trends [c,d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing boundary protection; system security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; enterprise security architecture documentation; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Assuming a perimeter firewall covers every important internal or external boundary.