# CMMC 2.0 SC.1.175 Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information system - Source: https://support.icompaas.com/support/solutions/articles/62000229720-cmmc-2-0-sc-1-175-monitor-control-and-protect-organizational-communications-i-e-information-tran - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CMMC](https://support.icompaas.com/support/solutions/62000112530) › [2.0](https://support.icompaas.com/support/solutions/folders/62000168778) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Level  1** **Description:**    Communications can be monitored, controlled, and protected at boundary components and by restricting or prohibiting interfaces in organizational systems. Boundary components include gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a system security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Restricting or prohibiting interfaces in organizational systems includes restricting external web communications traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses. Organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions. \[SP 800-4\] provides guidance on firewalls and firewall policy. \[SP 800-25B\] provides guidance on security for virtualization technologies. \[28\] There is no prescribed format or specified level of detail for system security plans. However, organizations ensure that the required information in 3.2.is conveyed in those plans.  **Priority**: High  **Domain:**  SYSTEM AND COMMUNICATIONS PROTECTION (SC)  **Category**: Security Architecture  **Services Associated with AWS:**    - AWS Network Firewall, AWS VPC Traffic Mirroring, AWS Direct Connect, AWS WAF, AWS Shield - AWS Security Groups, AWS Identity and Access Management (IAM), AWS WAF, AWS Shield  **Services Associated with Azure:** - ****Azure Monitor****  - ****Azure Traffic Manager****  - ****Azure Application Gateway****  - ****Azure Network Security Groups****  - ****Azure Firewall****  **Objective Evidence:**   - Administrative: documented policies, standards & procedures - Administrative: supporting documentation to demonstrate how content filtering is governed - Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations - Technical: screenshot of configuration settings - Technical: screenshot of content filter settings  Possible Technology Considerations :  - Secure Baseline Configurations (SBC) - IT Asset Management (ITAM) - Configuration Management Database (CMDB) - Content / DNS Filtering Solution  **What needs to be answered :**   Has the company identified network communications boundaries? Does the system monitor and manage communications at the system boundary and at key internal boundaries within the system? Do policies for managed interfaces such as gateways, routers, firewalls, VPNs, and company DMZs restrict external web traffic to only designated servers exist?  **Checks for AWS**  - Monitoring and Control of Communication at Boundaries Description: This check ensures that communications are monitored, controlled, and protected at the external boundaries and key internal boundaries of organizational systems. This includes the use of boundary components such as gateways, routers, firewalls, and encrypted tunnels. - Restricting and Prohibiting Interfaces in Organizational Systems Description: This check verifies that interfaces in organizational systems are restricted or prohibited as necessary. This could include restricting external web communications traffic to designated web servers and prohibiting external traffic that appears to be spoofing internal addresses. - Consideration of Commercial Telecommunications Services in Security Implementation Description: This check confirms that organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements. Despite contract security provisions, such services can represent sources of increased risk. Related AWS Service: AWS Direct Connect, AWS Transit Gateway, AWS VPN  **Checks for Azure**  - Monitoring and Control of Communication at Boundaries:  Description: This policy ensures that communications are monitored, controlled, and protected at the external boundaries and key internal boundaries of organizational systems. This includes the use of boundary components such as gateways, routers, firewalls, and encrypted tunnels. - Restricting and Prohibiting Interfaces in Organizational Systems: Description: This policy verifies that interfaces in organizational systems are restricted or prohibited as necessary. This could include restricting external web communications traffic to designated web servers and prohibiting external traffic that appears to be spoofing internal addresses. - Consideration of Commercial Telecommunications Services in Security Implementation: Description: This policy confirms that organizations consider the shared nature of commercial telecommunications services in the implementation of security requirements. Despite contract security provisions, such services can represent sources of increased risk. **More Details:**   Company systems monitored at internal and external communication boundaries. ## Related compliance guidance - [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout. - [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.