# NIST 800-171 3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

- Source: https://support.icompaas.com/support/solutions/articles/62000229334-nist-800-171-3-13-1-monitor-control-and-protect-communications-i-e-information-transmitted-or-re
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Communications can be monitored, controlled, and protected at boundary components and by restricting or prohibiting interfaces in organizational systems. Boundary components include gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a system security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Restricting or prohibiting interfaces in organizational systems includes restricting external web communications traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses.  Organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions. \[SP 800-4\] provides guidance on firewalls and firewall policy. \[SP 800-25B\] provides guidance on security for virtualization technologies.  
  
\[28\] There is no prescribed format or specified level of detail for system security plans. However, organizations ensure that the required information in 3.2.is conveyed in those plans. 

  

**Priority**: High 

  

**Category**: Security Architecture 

  

**Services Associated with AWS:**   

-   AWS Network Firewall, AWS VPC Traffic Mirroring, AWS Direct Connect, AWS WAF, AWS Shield
-   AWS Security Groups, AWS Identity and Access Management (IAM), AWS WAF, AWS Shield 

  

**Objective Evidence:**  

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how content filtering is governed
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of configuration settings
-   Technical: screenshot of content filter settings 

  

Possible Technology Considerations : 

-   Secure Baseline Configurations (SBC)
-   IT Asset Management (ITAM)
-   Configuration Management Database (CMDB)
-   Content / DNS Filtering Solution 

  

**What needs to be answered :**  

  

Has the company identified network communications boundaries? Does the system monitor and manage communications at the system boundary and at key internal boundaries within the system? Do policies for managed interfaces such as gateways, routers, firewalls, VPNs, and company DMZs restrict external web traffic to only designated servers exist? 

-   Monitoring and Control of Communication at Boundaries  
    Description: This check ensures that communications are monitored, controlled, and protected at the external boundaries and key internal boundaries of organizational systems. This includes the use of boundary components such as gateways, routers, firewalls, and encrypted tunnels.
-   Restricting and Prohibiting Interfaces in Organizational Systems  
    Description: This check verifies that interfaces in organizational systems are restricted or prohibited as necessary. This could include restricting external web communications traffic to designated web servers and prohibiting external traffic that appears to be spoofing internal addresses.
-   Consideration of Commercial Telecommunications Services in Security Implementation  
    Description: This check confirms that organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements. Despite contract security provisions, such services can represent sources of increased risk.  
    Related AWS Service: AWS Direct Connect, AWS Transit Gateway, AWS VPN 

  

**More Details:**  

Company systems monitored at internal and external communication boundaries.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.