Mapped to NIST 800-171 Requirement: 3.13.1
CMMC Assessment Objective: SC.L2-3.13.1[b]
What This Control Means
After identifying your boundary protection methods (SC.L2-3.13.1[a]), this control requires you to record those protections in your documentation, including:
• What boundary protections are in place
• Where they’re deployed
• How they function
• Who manages them
This documentation typically resides in your:
• System Security Plan (SSP)
• Network security policy
• Infrastructure diagrams
• Firewall or gateway configuration documentation
Why It Matters
Without documented boundary protections:
• Internal teams may misunderstand what systems are exposed
• CUI may traverse insecure interfaces without inspection
• Security monitoring may miss traffic at critical points
• Assessors cannot verify your perimeter defense strategy
Documentation shows that your network architecture has been intentionally designed and reviewed to protect CUI.
How to Implement It
1. Include Boundary Protection Details in Your SSP For each system boundary, describe:
• The protection method (e.g., firewall, proxy, VPN)
• Location and purpose (e.g., internet gateway, cloud connector)
• Devices and services involved
• Traffic filtering rules or inspection protocols
2. Map to Network Diagrams
• Label boundary protection devices in your network topology
• Show which segments are considered “trusted” vs. “untrusted”
3. Link to Roles and Responsibilities
• Identify who manages or maintains each protection mechanism
• Document how alerts, failures, or maintenance are handled
4. Use Plain Language
• Assessors may not want to decode configurations—use clear, summarized descriptions supported by technical detail when needed
Evidence the Assessor Will Look For
• SSP entries listing all boundary protection mechanisms
• Diagrams showing boundary placement and protections
• Firewall rulesets, IPS/IDS configurations, or VPN access policies
• Policy or procedure documentation describing boundary control management
• Assignment of responsibilities for boundary protection systems
Common Gaps
• Boundary protection implemented but undocumented
• No formal network diagram or boundary definitions
• SSP or network security documentation does not describe boundary technologies
• Responsibility for managing perimeter defenses is unclear or shared informally
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Providing templates for documenting boundary protection systems and configurations
• Integrating diagrams and control summaries into your SSP
• Assigning ownership and logging documentation updates
• Mapping CUI data flows across documented system boundaries
• Generating audit-ready evidence showing how protections are described and reviewed
With Cuick Trac, your boundary defense isn’t just deployed—it’s documented and defensible.
Final CTA
You’ve built the defenses—now document them.
Schedule a Cuick Trac demo to document your boundary protection methods and pass your next assessment with clarity and confidence.