NIST SP 800-171 Rev 2 · 3.13 System & Communications Protection

3.13.5 Subnetworks for public components

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

SPRS weight

5

5 points deducted from 110 when not implemented.

CMMC level

L1 + L2

Level 1 practice SC.L1-3.13.5, from FAR 52.204-21(b)(1)(xi)

Assessment objectives

2

From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.13.5 into 2 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

1. [a]Determine if publicly accessible system components are identified.
2. [b]Determine if subnetworks for publicly accessible system components are physically or logically separated from internal networks.

Examine

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; security plan; list of key internal boundaries of the system; system design documentation; boundary protection hardware and software; system configuration settings and associated documentation; enterprise security architecture documentation; system audit logs and records; other relevant documents or records].

Interview

[SELECT FROM: System or network administrators; personnel with information security responsibilities; system developer; personnel with boundary protection responsibilities].

Test

[SELECT FROM: Mechanisms implementing boundary protection capability].

If it is open: POA&M eligibility

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

Where 3.13.5 maps

Query it from your own tools

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.13.5
get_assessment_objectives 3.13.5
generate_poam_entries ["3.13.5"]

Install the MCP server, free, no account.