SC.L2-3.13.5
Public-Access System Separation [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.5 in the reference catalog with its NIST cross-references
Official requirement
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Assessment objectives
a. publicly accessible system components are identified; and
b. subnetworks for publicly accessible system components are physically or logically separated from internal networks.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Separate publicly accessible system components from internal networks.
Implementation example
Example from the source assessment guide (not a mandatory implementation): The head of recruiting at your company wants to launch a website to post job openings and allow the public to download an application form [a]. After some discussion, your team realizes it needs to use a firewall to create a perimeter network to do this [b]. You host the server separately from the company’s internal network and make sure the network on which it resides is isolated with the proper firewall rules [b].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and commun ications protection policy; procedures addressing boundary protection; system security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; system configuration settings and associated documentation; enterprise security architecture documentation; system audit logs and records; other relevant documents or records
Common mistakes
Allowing public-facing services unrestricted access to internal systems.