SC.L2-3.13.7
Split Tunneling
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.7 in the reference catalog with its NIST cross-references
Official requirement
Prevent remote devices from simultaneously establishing non- remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
Assessment objectives
a. remote devices are prevented from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks (i.e., split tunneling).
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prevent remote devices from using split tunneling when connected to organizational systems.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator responsible for configuring the network to prevent remote users from using split tunneling . You review the configuration of remote user laptops . You discover that remote users are able to access files, email, database and other services through the VPN connection while also being able to print and access resources on their local network. You change the configuration setting s for all company computers to disable split tunneling [a]. You test a laptop that has had the new hardening procedures applied and verify that all traffic from the laptop is now routed through the VPN connection.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing boundary protection; system security plan; system design documentation; system hardware and software; system architecture; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Allowing a remote device to bridge the protected session and another network simultaneously.