Frameworks / NIST SP 800-53 Rev 5 / NIST800-SC-7 NIST SP 800-53 Rev 5
SC - System and Communications Protection
NIST SP 800-53 Rev 5 NIST800-SC-7: Boundary protection Requires communications to be monitored and controlled at external managed interfaces and at key internal interfaces, publicly accessible components to sit in subnetworks physically or logically separated from internal networks, and connections to external networks or systems to pass only through managed interfaces built from boundary protection devices arranged per the security architecture.
What else in your programme already covers this This control maps to 188 controls across 39 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
1.2.3 Network diagrams maintained 1.2.4 Data flow diagram of account data 1.2.5 Services, protocols, ports inventoried and justified 1.2.6 Security features for insecure services defined 1.3.1 Inbound traffic to CDE restricted 1.3.2 Outbound traffic from CDE restricted 1.3.3 NSCs between wireless and CDE 1.4.1 NSCs between trusted and untrusted networks 1.4.2 Inbound traffic from untrusted networks restricted 1.4.3 Anti-spoofing measures implemented 1.4.4 Account data not stored on internet-accessible systems 1.4.5 Internal IP and routing information protected 1.5.1 Security controls on dual-connected computing devices 11.5.1 IDS/IPS in place 12.6.1 Formal security awareness program implemented 2.2.5 Insecure services or protocols documented 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks, with at least the following: • Is installed in front of public-facing web applications and is configured 7.3.3 The access control system(s) is set to “deny all” by default 9.2.2 Physical and/or logical controls are implemented to restrict use of publicly accessible network jacks within the facility CIS-1.2 Address Unauthorized Assets CIS-12.2 Establish and Maintain a Secure Network Architecture CIS-12.3 Securely Manage Network Infrastructure CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS-13.10 Perform Application Layer Filtering CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.4 Perform Traffic Filtering Between Network Segments CIS-13.6 Collect Network Traffic Flow Logs CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS-13.9 Deploy Port-Level Access Control CIS-3.10 Encrypt Sensitive Data in Transit CIS-4.4 Implement and Manage a Firewall on Servers CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS-4.6 Securely Manage Enterprise Assets and Software CIS-9.2 Use DNS Filtering Services CIS-9.3 Maintain and Enforce Network-Based URL Filters CIS-9.6 Block Unnecessary File Types CM-2(7) Configure Systems and Components for High-Risk Areas SA-2 Allocation of Resources SA-9(2) Identification of Functions, Ports, Protocols, and Services SC-5 Denial-of-Service Protection SC-7 Boundary Protection SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components] SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(7) Split Tunneling for Remote Devices SC-7(8) Route Traffic to Authenticated Proxy Servers SI-4(4) Inbound and Outbound Communications Traffic CM-2(7) Configure Systems and Components for High-Risk Areas SA-2 Allocation of Resources SA-9(2) Identification of Functions, Ports, Protocols, and Services SC-5 Denial-of-Service Protection SC-7 Boundary Protection SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components] SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(7) Split Tunneling for Remote Devices SC-7(8) Route Traffic to Authenticated Proxy Servers SI-4(4) Inbound and Outbound Communications Traffic ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy ASBv3-GS-4 Define and implement network security strategy ASBv3-IM-2 Protect identity and authentication systems ASBv3-NS-6 Deploy web application firewall NS-1 Establish network segmentation boundaries NS-2 Secure cloud services with network controls NS-3 Deploy firewall at the edge of enterprise network 5.23 Information security for use of cloud services 8.12 Data leakage prevention 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.23 Web filtering 8.4 Access to source code ASD37-07 Web content filtering (Excellent) ASD37-08 Deny direct internet connectivity (Excellent) ASD37-22 Network segmentation (Excellent) ASD37-25 Software firewall - inbound (Very Good) ASD37-26 Software firewall - outbound (Very Good) ASD37-32 Network-based IDS/IPS (Limited) 5.23 Information security for use of cloud services 8.12 Data leakage prevention 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.23 Web filtering 6.10 Communications security 6.10.1 Network security management 6.11.1 Security requirements of information systems 6.6.4 System and application access control 6.8.1 Secure areas 6.9.6 Technical vulnerability management 3.13.1e Create Diversity in System Components to Limit Malicious Code Propagation 3.13.2e Introduce Unpredictability into System Operations 3.13.3e Confuse and Mislead Adversaries 3.13.4e Physical and Logical Isolation Techniques 3.13.5e Distribute and Relocate System Functions or Resources ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations ANSSI-HYG-19 Segment the Network and Partition the Zones ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway ANSSI-HYG-23 Partition Internet Facing Services from the Rest of the Information System C5-COS-01 Technical safeguards C5-COS-02 Security requirements for connections in the Cloud Service Provider's network C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-COS-04 Cross-network access CM-2(7) Configure Systems and Components for High-Risk Areas SA-2 Allocation of Resources SC-5 Denial-of-Service Protection SC-7 Boundary Protection CM-2(7) Configure Systems and Components for High-Risk Areas SA-2 Allocation of Resources SC-5 Denial-of-Service Protection SC-7 Boundary Protection NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage NIST-CSF-RS.MI-01 Incidents are contained SA-2 Allocation of Resources SC-5 Denial-of-Service Protection SC-7 Boundary Protection SOC2-CC5.1 COSO principle 10: Selects and develops control activities to mitigate risks SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets SOC2-CC6.6 Measures against threats outside system boundaries are implemented CE-FW.1 Boundary Firewalls Deployed CE-FW.4 Approve and Document Inbound Rules CE-FW.5 Remove or Disable Unused Rules 03.13.01 Boundary Protection 03.13.06 Network Communications - Deny by Default - Allow by Exception AUCDR-IS-2 Secure the network and systems within the data environment Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in SC - System and Communications Protection You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-SC-7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 300 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 188 it maps to, and the evidence behind each claim, over MCP and REST.