What this control covers
This control requires monitoring and controlling communications at external and key internal interfaces to the system, implementing subnetworks (DMZs) for publicly accessible components, and connecting to external systems only through managed interfaces with boundary protection devices. These measures help secure communication paths and prevent unauthorized access or spoofing. This control supports the Boundary Protection capability within the Situational Awareness (3.13) family.
Why it matters
Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.
How to implement
AWS
Bake hardening into EC2 Image Builder + AMI accounts; use Systems Manager Fleet Manager for inventory and patch state.
Azure
Intune enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via Defender for Endpoint.
GCP
Centralize via Cloud Logging log sinks at the org level to a locked log bucket with 7-year retention. Use SCC Premium for posture findings and Chronicle for SIEM correlation.
Google Workspace
Endpoint Management (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.
GitHub
Stream the Enterprise audit log to your SIEM and enable Audit Log API alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.
Evidence to collect
user_device_scan— Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Boundary Protection.
Quick checklist
- Access — Management / External Systems
- Publicly — Management / External Systems
- Protection — Management / External Systems
- System — Management / External Systems
- Security — Management / External Systems
- Boundary — Management / External Systems
Related articles on this site
- NIST 800-171 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
- CMMC 2.0 SC.1.175 Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information system
- CMMC 2.0 SC.1.176 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
- NIST 800-171 3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.