Boundary Protection

frameworkCMMC Level 2 sectionSC System and Communications Protection csf 2.0DE.CM-01 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-01 topicsFirewall / Net Seg, Web Security, Zero Trust frameworks6 3 0

Official textMonitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of SC.L2-3.13.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01 PR.PS-06	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Users, services, and hardware are authenticated…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust, Web Security 4 loosely related (not mappings) DE.CM-01 Networks and network services are monitored to find potentially adverse events Loosely related Only shares CSF DE.CM-01: related, not a mapping PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Loosely related Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.15 A.8.5 A.8.20 A.8.21 A.8.22 A.8.26	Access control; Secure authentication…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg, Web Security 32 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.14 Information transfer Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 24 more in the downloads
CIS v8.1	CIS 6.8 CIS 12.2 CIS 4.4 CIS 4.5 CIS 9.3 CIS 12.3 CIS 12.4 CIS 12.6 CIS 12.7 CIS 13.4 CIS 13.5 CIS 13.9 CIS 13.10 CIS 16.10	Define and Maintain Role-Based Access Control; Establish and Maintain a Secure Network Architecture…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg, Web Security 24 loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 16 more in the downloads
SOC 2	CC6.6	Protection against threats from outside system boundaries	Editorial	Same topic: Firewall / Net Seg, Web Security, Zero Trust (editorial pick) 7 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	1.2.3 7.2.1 8.3.1 1.2.1 1.3.1 1.4.1 6.4.1 6.4.3	Accurate network diagram maintained; Access control model defined…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust, Web Security 33 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 25 more in the downloads
800-53	AC-3 AC-4 AC-6 IA-2 SC-7 SI-10 SA-8	Access Enforcement; Information Flow Enforcement…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg, Web Security NIST SP 800-171r2 Appendix D 32 loosely related (not mappings) SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping AC-2 Account Management Loosely related Only shares CSF DE.CM-01, PR.DS-10: related, not a mapping …and 24 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(A)	Information System Activity Review; Workforce Security…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.DS-01, PR.DS-02, PR.DS-10…: related, not a mapping +22 more loosely related (not mappings) §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +2 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping
NIS2	6.7 6.8 11.1 11.6	Network security; Network segmentation…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust 4 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping
Essential Eight	ISM-0109 ISM-1488 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Microsoft Office macros in files originating from the internet are blocked…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.DS-02: related, not a mapping
DORA	Art.9(4)(b)	Protection and prevention	Editorial	Same topic: Firewall / Net Seg (editorial pick) 11 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 3 more in the downloads
CPS 234	Para 21 Para 23	Timely controls commensurate with risk and asset life-cycle; Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping
Cyber Essentials	CE 1	Firewalls	Editorial	Same topic: Firewall / Net Seg (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.