SC.L1-b.1.xi

Public-Access System Separation [FCI Data]

Source and approval

CMMC Assessment Guide — Level 1 · Revision 2.13

Publisher approved · Complete cited source edition 2026-10-31

See SC.L1-b.1.xi in the reference catalog with its NIST cross-references

Official requirement

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objectives

a. publicly accessible system components are identified; and

b. su bnetworks for publicly accessible system components are physically or logically separated from internal networks.

Implementation guidance

Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.

In plain language

Separate publicly accessible systems from internal networks that require protection.

Implementation example

Example from the source assessment guide (not a mandatory implementation): The head of recruiting at your firm wants to launch a website to post job openings and allow the public to download an application form [a]. After some discussion, your team realizes it needs to use a firewall to create a perimeter network to do this b ecause your network contains FCI [b]. You host the server separately from the company’s internal network where FCI is stored and make sure the network on which it resides is isolated with the proper firewall rules [b].

Evidence examples

Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing boundary protection; system security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; system configuration settings and associated documentation; enterprise security architecture documentation; system audit logs and records; other relevant documents or records

Common mistakes

Placing a public-facing service on the same unrestricted network as internal workstations.

Apply this in your workspace →