NIST SP 800-171 & CMMC 2.0 System and Communications Protections

• 3.13.1

  Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

• 3.13.2

  Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

• 3.13.3

  Separate user functionality from system management functionality.

• 3.13.4

  Prevent unauthorized and unintended information transfer via shared system resources.

• 3.13.5

  Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

• 3.13.6

  Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

• 3.13.7

  Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

• 3.13.8

  Implement cryptographic mechanisms to prevent unauthorized disclosure of “Controlled Unclassified Information” (CUI) during transmission unless otherwise protected by alternative physical safeguards.

• 3.13.9

  Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

• 3.13.10

  Establish and manage cryptographic keys for cryptography employed in organizational systems.

• 3.13.11

  Employ FIPS-validated cryptography when used to protect the confidentiality of “Controlled Unclassified Information” (CUI).

• 3.13.12

  Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

• 3.13.13

  Control and monitor the use of mobile code.

• 3.13.14

  Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

• 3.13.15

  Protect the authenticity of communications sessions.

• 3.13.16

  Protect the confidentiality of “Controlled Unclassified Information” (CUI) at rest.

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.