Boundary Protection

frameworkNIST SP 800-53 Rev 5.2 sectionSC System and Communications Protection csf 2.0DE.CM-01 PR.DS-01 PR.DS-02 PR.DS-10 PR.IR-01 topicsFirewall / Net Seg, Web Security, WAF frameworks6 3 0

Official texta. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
b. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of SC-7 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-01 ID.AM-03 PR.IR-01 PR.PS-06	Networks and network services are monitored to find potentially adverse events; Representations of the organization's authorized network communication and internal and external network data flows are maintained…	Crosswalk	Same topic: WAF, Firewall / Net Seg, Web Security 3 loosely related (not mappings) PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected Loosely related Only shares CSF PR.DS-01: related, not a mapping PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected Loosely related Only shares CSF PR.DS-02: related, not a mapping PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.8.20 A.8.21 A.8.22 A.8.26 A.5.14 A.8.16 A.8.23	Networks security; Security of network services…	Crosswalk	Same topic: Firewall / Net Seg, WAF, Web Security NIST SP 800-53 → ISO 27001 mapping 30 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.2 Privileged access rights Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 22 more in the downloads
CIS v8.1	CIS 12.2 CIS 4.4 CIS 4.5 CIS 9.3 CIS 12.3 CIS 12.4 CIS 12.6 CIS 13.4 CIS 13.9 CIS 13.10 CIS 16.10	Establish and Maintain a Secure Network Architecture; Implement and Manage a Firewall on Servers…	Crosswalk	Same topic: Firewall / Net Seg, Web Security, WAF 26 loosely related (not mappings) CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 3.11 Encrypt Sensitive Data at Rest Loosely related Only shares CSF PR.DS-01: related, not a mapping CIS 13.1 Centralize Security Event Alerting Loosely related Only shares CSF DE.CM-01: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
SOC 2	CC6.6	Protection against threats from outside system boundaries	Editorial	Same topic: Firewall / Net Seg, Web Security, WAF (editorial pick) 7 loosely related (not mappings) C1.2 Disposing of confidential information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.5 Protection of data when assets are disposed of Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-01: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	1.2.3 1.2.1 1.3.1 1.4.1 6.4.1 6.4.2 6.4.3	Accurate network diagram maintained; Configuration standards for network security controls…	Crosswalk	Same topic: Firewall / Net Seg, Web Security, WAF 32 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 24 more in the downloads
CMMC	SC.L2-3.13.1 SC.L2-3.13.5 SC.L2-3.13.6 SC.L2-3.13.2 SC.L2-3.13.7	Boundary Protection; Public-Access System Separation…	Crosswalk	Same topic: Firewall / Net Seg, Web Security NIST SP 800-171r2 Appendix D 26 loosely related (not mappings) SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Loosely related Only shares CSF DE.CM-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-01, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping SC.L2-3.13.11 CUI Encryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.2 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.4 Update Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.5 System & File Scanning Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
HIPAA	§164.308(a)(1)(ii)(D)§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(A)	Information System Activity Review; Workforce Security…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.DS-01, PR.DS-02, PR.DS-10…: related, not a mapping +22 more loosely related (not mappings) §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF DE.CM-01, PR.DS-10, PR.IR-01: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.32(1)(a)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +2 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.28(1) Processor Loosely related Only shares CSF PR.IR-01: related, not a mapping
NIS2	6.7 6.8	Network security; Network segmentation	Crosswalk	Same topic: Firewall / Net Seg 4 loosely related (not mappings) 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 4.3 Crisis management Loosely related Only shares CSF DE.CM-01: related, not a mapping 6.9 Protection against malicious and unauthorised software Loosely related Only shares CSF DE.CM-01: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping
Essential Eight	ISM-0109 ISM-1488 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Microsoft Office macros in files originating from the internet are blocked…	Loosely related	No mapping. Only shares CSF DE.CM-01, PR.DS-02: related, not a mapping
DORA	Art.9(4)(b)	Protection and prevention	Editorial	Same topic: Firewall / Net Seg (editorial pick) 11 loosely related (not mappings) Art.9(2) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(c) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(1) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping Art.10(2) Detection Loosely related Only shares CSF DE.CM-01: related, not a mapping …and 3 more in the downloads
CPS 234	Para 21 Para 23	Timely controls commensurate with risk and asset life-cycle; Detect and respond to incidents in a timely manner	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01: related, not a mapping
Cyber Essentials	CE 1	Firewalls	Editorial	Same topic: Firewall / Net Seg (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.