SC.L2-3.13.13[d] – Determine if control and monitoring mechanisms for communications at system boundaries are enforced.

This objective ensures that your organization’s control and monitoring protections at system boundaries are not only active, but strictly enforced—meaning communications cannot bypass security controls, and monitoring is continuous and cannot be disabled without authorization.

SC.L2-3.13.12[b] – Examine documentation to confirm authorized system users are identified.

This objective ensures your organization has formally documented who is authorized to access systems—especially those processing, storing, or transmitting Controlled Unclassified Information (CUI). This documentation must clearly connect users, their assigned systems, and their approved roles.

SC.L2-3.13.1[a] – Identify boundary protection methods.

This objective requires your organization to identify the methods, technologies, and practices used to protect system boundaries—particularly where Controlled Unclassified Information (CUI) flows between internal and external networks or systems.

SC.L2-3.13.2[c] – Determine if system connections are authorized.

This objective verifies that your organization has formally authorized all system connections that process, store, or transmit Controlled Unclassified Information (CUI). You must ensure each connection is approved before it becomes operational and that authorization is documented and traceable.

SC.L2-3.13.2[b] – Examine documentation to confirm system connections are identified.

This objective ensures that your organization has formally documented all system connections that process, transmit, or store Controlled Unclassified Information (CUI). These include internal, external, cloud-based, and remote access connections that must be controlled and secured.

SC.L2-3.13.14[c] – Determine if mechanisms to control communications at system boundaries and limit CUI transfers are used.

This objective ensures your organization’s documented mechanisms to control communications and limit CUI transfers are not just planned—they’re actively in use at your system boundaries. Assessors will want to verify that real controls exist and operate as intended.

SC.L2-3.13.6[b] – Examine documentation to confirm security functions implemented as separate modules are identified.

This objective ensures that your organization has formally documented where and how key security functions are isolated from general user functionality. These functions must be clearly identified and described in your policies, architecture diagrams, or System Security Plan (SSP), especially where they protect Controlled Unclassified Information (CUI).

SC.L2-3.13.10[d] – Determine if methods to protect the authenticity of communications sessions are enforced.

This objective ensures that your organization’s session authenticity protections are mandatory, consistent, and actively enforced across all communications paths involving Controlled Unclassified Information (CUI)—making it impossible for unauthorized or unauthenticated sessions to occur.

SC.L2-3.13.8[a] – Identify encrypted sessions for remote access.

This objective requires your organization to identify all remote access sessions that allow users to connect to systems handling Controlled Unclassified Information (CUI) and ensure those sessions are encrypted using approved cryptographic methods.

SC.L2-3.13.1[b] – Examine documentation to confirm boundary protection methods are identified.

This objective ensures your organization has formally documented the boundary protection mechanisms in place to protect Controlled Unclassified Information (CUI) as it flows across networks and system interfaces—particularly between internal and external systems.