NIST SP 800-171 & CMMC 2.0 3.13.5 Requirement:
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
NIST SP 800-171 & CMMC 2.0 3.13.5 Requirement Explanation:
Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs). DMZs are typically implemented with boundary control devices and techniques that include routers, gateways, firewalls, virtualization, or cloud-based technologies.
Example NIST SP 800-171 & CMMC 2.0 3.13.5 Implementation:
Do not place servers that need to be publicly accessible on your internal network. Instead, set up a "demilitarized zone" (DMZ) and place those servers in it.
NIST SP 800-171 & CMMC 2.0 3.13.5 Scenario(s):
- Scenario 1:
Alice built a server that will host her company's website. Instead of placing the web-server on her internal network she creates a DMZ and places the webserver in it. The web server is now accessible from the internet and is separate from her company network. If a hacker compromises the webserver he gets trapped in the DMZ and can't access the internal network.
- Scenario 2:
Alice needs to find a solution to host her company's new website. Instead of setting up her own web server and DMZ, she decides to use a web hosting company. As a result, she avoids having to set up a DMZ.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.