SC.L1-b.1.x
Boundary Protection [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L1-b.1.x in the reference catalog with its NIST cross-references
Official requirement
Monitor, control, and protect organizational communications ( i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
Assessment objectives
a. the external system boundary is defined;
b. key internal system boundaries are defined;
c. communications are monitored at the external system boundary;
d. communications are monitored at key internal boundaries;
e. communications are controlled at the external system boundary;
f. communications are controlled at key internal boundaries;
g. communications are protected at the external system boundary; and
h. communications are protected at key internal boundaries.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Control and protect communications crossing external and important internal system boundaries.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are setting up the new network with an FCI enclave. You start by sketching out a simple diagram that identifies the external boundary of your network and any internal boundaries that are needed [a,b]. The first piece of equipment you install is the firewall, a device to 26 NIST SP 800-171 Rev. 2, p. 36 separate your internal network from the internet. The firewall also has a feature that allows you to block access to potentially malicious websites, and you configure that service as well [a,c,e,g]. Some of your coworkers complain that they cannot get to certain websites [c,e,g]. You explain that the new network blocks websites that are known for spreading malware. The firewall sends you a daily digest of blocked activity so that you can monitor the system for attack trends [c,d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing boundary protection; system security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; enterprise security architecture documentation; system audit logs and records; system configuration settings and associated documentation; other relevant documents or records
Common mistakes
Assuming an installed firewall proves every required boundary is identified and protected.