NIST SP 800-53 Rev 5
SC - System and Communications Protection

NIST SP 800-53 Rev 5 NIST800-SC-7: SC-7 Boundary Protection

a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 185 controls across 40 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 19 controls

  • 1.2.3 1.2.3 Accurate network diagram of CDE connections
  • 1.2.4 1.2.4 Accurate data-flow diagram for account data
  • 1.2.5 1.2.5 Allowed services, protocols and ports justified
  • 1.2.6 1.2.6 Security features for insecure services in use
  • 1.3.1 1.3.1 Inbound CDE traffic restricted
  • 1.3.2 1.3.2 Outbound CDE traffic restricted
  • 1.3.3 1.3.3 NSCs between wireless networks and the CDE
  • 1.4.1 1.4.1 NSCs between trusted and untrusted networks
  • 1.4.2 1.4.2 Restricting traffic entering trusted networks from outside
  • 1.4.3 1.4.3 Anti-spoofing measures at trusted boundary
  • 1.4.4 1.4.4 Cardholder data stores not reachable from untrusted networks
  • 1.4.5 1.4.5 Internal IP and routing disclosure limited
  • 1.5.1 1.5.1 Security controls on dual-connected devices
  • 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic
  • 12.6.1 12.6.1 Formal security awareness program
  • 2.2.5 2.2.5 Insecure services, protocols or daemons secured
  • 6.4.2 6.4.2 Automated web attack detection and prevention
  • 7.3.3 7.3.3 Access control default deny all
  • 9.2.2 9.2.2 Controls on publicly accessible network jacks

CIS Controls v8 · 17 controls

  • CIS-1.2 Address Unauthorized Assets
  • CIS-12.2 Establish and Maintain a Secure Network Architecture
  • CIS-12.3 Securely Manage Network Infrastructure
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work
  • CIS-13.10 Perform Application Layer Filtering
  • CIS-13.3 Deploy a Network Intrusion Detection Solution
  • CIS-13.4 Perform Traffic Filtering Between Network Segments
  • CIS-13.6 Collect Network Traffic Flow Logs
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution
  • CIS-13.9 Deploy Port-Level Access Control
  • CIS-3.10 Encrypt Sensitive Data in Transit
  • CIS-4.4 Implement and Manage a Firewall on Servers
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices
  • CIS-4.6 Securely Manage Enterprise Assets and Software
  • CIS-9.2 Use DNS Filtering Services
  • CIS-9.3 Maintain and Enforce Network-Based URL Filters
  • CIS-9.6 Block Unnecessary File Types

FedRAMP High · 12 controls

  • CM-2(7) Configure Systems and Components for High-Risk Areas
  • SA-2 Allocation of Resources
  • SA-9(2) Identification of Functions, Ports, Protocols, and Services
  • SC-5 Denial-of-Service Protection
  • SC-7 Boundary Protection
  • SC-7(12) Boundary Protection | Host-based Protection (SC-7(12))
  • SC-7(3) Access Points
  • SC-7(4) External Telecommunications Services
  • SC-7(5) Deny by Default Allow by Exception
  • SC-7(7) Split Tunneling for Remote Devices
  • SC-7(8) Route Traffic to Authenticated Proxy Servers
  • SI-4(4) Inbound and Outbound Communications Traffic

FedRAMP Moderate · 12 controls

  • CM-2(7) Configure Systems and Components for High-Risk Areas
  • SA-2 Allocation of Resources
  • SA-9(2) Identification of Functions, Ports, Protocols, and Services
  • SC-5 Denial-of-Service Protection
  • SC-7 Boundary Protection
  • SC-7(12) Boundary Protection | Host-based Protection (SC-7(12))
  • SC-7(3) Access Points
  • SC-7(4) External Telecommunications Services
  • SC-7(5) Deny by Default Allow by Exception
  • SC-7(7) Split Tunneling for Remote Devices
  • SC-7(8) Route Traffic to Authenticated Proxy Servers
  • SI-4(4) Inbound and Outbound Communications Traffic

NIST SP 800-187 · 9 controls

NIST SP 800-207 · 8 controls

3GPP 5G Security Architecture (TS 33.501) · 7 controls

Azure Security Benchmark · 7 controls

  • ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy
  • ASBv3-GS-4 Define and implement network security strategy
  • ASBv3-IM-2 Protect identity and authentication systems
  • ASBv3-NS-6 Deploy web application firewall
  • NS-1 Establish network segmentation boundaries
  • NS-2 Secure cloud services with network controls
  • NS-3 Deploy firewall at the edge of enterprise network

ISO 27001:2022 · 7 controls

  • 5.23 Information security for use of cloud services
  • 8.12 Data leakage prevention
  • 8.20 Networks security
  • 8.21 Security of network services
  • 8.22 Segregation of networks
  • 8.23 Web filtering
  • 8.4 Access to source code

ASD Strategies to Mitigate Cyber Security Incidents · 6 controls

  • ASD37-07 Web content filtering (Excellent)
  • ASD37-08 Deny direct internet connectivity (Excellent)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)
  • ASD37-26 Software firewall - outbound (Very Good)
  • ASD37-32 Network-based IDS/IPS (Limited)

CMMC 2.0 · 6 controls

ISO 27002:2022 · 6 controls

  • 5.23 Information security for use of cloud services
  • 8.12 Data leakage prevention
  • 8.20 Networks security
  • 8.21 Security of network services
  • 8.22 Segregation of networks
  • 8.23 Web filtering

ISO 27701:2019 · 6 controls

  • 6.10 Communications security
  • 6.10.1 Network security management
  • 6.11.1 Security requirements of information systems
  • 6.6.4 System and application access control
  • 6.8.1 Secure areas
  • 6.9.6 Technical vulnerability management

AWS Well-Architected Security Pillar · 5 controls

NIST SP 800-172 · 5 controls

  • 3.13.1e Create Diversity in System Components to Limit Malicious Code Propagation
  • 3.13.2e Introduce Unpredictability into System Operations
  • 3.13.3e Confuse and Mislead Adversaries
  • 3.13.4e Physical and Logical Isolation Techniques
  • 3.13.5e Distribute and Relocate System Functions or Resources

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 4 controls

  • ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations
  • ANSSI-HYG-19 Segment the Network and Partition the Zones
  • ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway
  • ANSSI-HYG-23 Partition Internet Facing Services from the Rest of the Information System

C5 (Germany) · 4 controls

  • C5-COS-01 Technical safeguards
  • C5-COS-02 Security requirements for connections in the Cloud Service Provider's network
  • C5-COS-03 Monitoring of connections in the Cloud Service Provider's network
  • C5-COS-04 Cross-network access

CISA Industrial Control Systems (ICS) Security Guidance · 4 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained
  • NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
  • NIST-CSF-RS.MI-01 Incidents are contained

SOC 2 · 3 controls

  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  • SOC2-CC6.1 CC6.1 Logical access security over protected information assets
  • SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

UK Cyber Essentials · 3 controls

  • CE-FW.1 Boundary Firewalls Deployed
  • CE-FW.4 Approve and Document Inbound Rules
  • CE-FW.5 Remove or Disable Unused Rules

African Union Malabo Convention · 2 controls

CISA Zero Trust Maturity Model · 2 controls

CMMC 2.0 Level 1 · 2 controls

DoD Zero Trust Reference Architecture · 2 controls

HIPAA Security Rule · 2 controls

NIST SP 800-171 · 2 controls

NIST SP 800-171 Rev 3 · 2 controls

  • 03.13.01 Boundary Protection
  • 03.13.06 Network Communications - Deny by Default - Allow by Exception

NIST SP 800-66 Rev 2 · 2 controls

API 1164 · 1 control

  • API1164-05 Network Segmentation and Zones

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-2 Secure the network and systems within the data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

Competition and Consumer Act 2010 Part IVD (Consumer Data Right) · 1 control

  • CDR-RULE-SECURITY Information Security (CDR Rules Schedule 2)

DORA · 1 control

GLI-33 - Gaming Laboratories International Event Wagering Systems · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • SC-7 SC-7 Boundary Protection

NIST SP 800-53 Rev 5 LOW · 1 control

  • SC-7 SC-7 Boundary Protection

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • SC-7 SC-7 Boundary Protection

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in SC - System and Communications Protection

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-SC-7 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 185 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls