{"data":{"id":"SC-07","name":"Boundary Protection","family":"SC","family_name":"System and Communications Protection","withdrawn":false,"description":"a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;\nb. Implement subnetworks for publicly accessible system components that are [Selection (one): physically; logically] separated from internal organizational networks; and\nc. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.","supplemental_guidance":"Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189] provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).","enhancements":[{"id":"SC-07(01)","name":"Physically Separated Subnetworks","withdrawn":true,"incorporated_into":["SC-07"]},{"id":"SC-07(02)","name":"Public Access","withdrawn":true,"incorporated_into":["SC-07"]},{"id":"SC-07(03)","name":"Access Points","statement":"Limit the number of external network connections to the system.","baselines":["moderate","high"]},{"id":"SC-07(04)","name":"External Telecommunications Services","statement":"a. Implement a managed interface for each external telecommunication service;\nb. Establish a traffic flow policy for each managed interface;\nc. Protect the confidentiality and integrity of the information being transmitted across each interface;\nd. Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;\ne. Review exceptions to the traffic flow policy [Assignment: organization-defined frequency] and remove exceptions that are no longer supported by an explicit mission or business need;\nf. Prevent unauthorized exchange of control plane traffic with external networks;\ng. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and\nh. Filter unauthorized control plane traffic from external networks.","baselines":["moderate","high"]},{"id":"SC-07(05)","name":"Deny by Default — Allow by Exception","statement":"Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].","baselines":["moderate","high"]},{"id":"SC-07(06)","name":"Response to Recognized Failures","withdrawn":true,"incorporated_into":["SC-07(18)"]},{"id":"SC-07(07)","name":"Split Tunneling for Remote Devices","statement":"Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].","baselines":["moderate","high"]},{"id":"SC-07(08)","name":"Route Traffic to Authenticated Proxy Servers","statement":"Route [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.","baselines":["moderate","high"]},{"id":"SC-07(09)","name":"Restrict Threatening Outgoing Communications Traffic","statement":"a. Detect and deny outgoing communications traffic posing a threat to external systems; and\nb. Audit the identity of internal users associated with denied communications.","baselines":[]},{"id":"SC-07(10)","name":"Prevent Exfiltration","statement":"a. Prevent the exfiltration of information; and\nb. Conduct exfiltration tests [Assignment: organization-defined frequency].","baselines":[]},{"id":"SC-07(11)","name":"Restrict Incoming Communications Traffic","statement":"Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].","baselines":[]},{"id":"SC-07(12)","name":"Host-based Protection","statement":"Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].","baselines":[]},{"id":"SC-07(13)","name":"Isolation of Security Tools, Mechanisms, and Support Components","statement":"Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.","baselines":[]},{"id":"SC-07(14)","name":"Protect Against Unauthorized Physical Connections","statement":"Protect against unauthorized physical connections at [Assignment: organization-defined managed interfaces].","baselines":[]},{"id":"SC-07(15)","name":"Networked Privileged Accesses","statement":"Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.","baselines":[]},{"id":"SC-07(16)","name":"Prevent Discovery of System Components","statement":"Prevent the discovery of specific system components that represent a managed interface.","baselines":[]},{"id":"SC-07(17)","name":"Automated Enforcement of Protocol Formats","statement":"Enforce adherence to protocol formats.","baselines":[]},{"id":"SC-07(18)","name":"Fail Secure","statement":"Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.","baselines":["high"]},{"id":"SC-07(19)","name":"Block Communication from Non-organizationally Configured Hosts","statement":"Block inbound and outbound communications traffic between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.","baselines":[]},{"id":"SC-07(20)","name":"Dynamic Isolation and Segregation","statement":"Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.","baselines":[]},{"id":"SC-07(21)","name":"Isolation of System Components","statement":"Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].","baselines":["high"]},{"id":"SC-07(22)","name":"Separate Subnets for Connecting to Different Security Domains","statement":"Implement separate network addresses to connect to systems in different security domains.","baselines":[]},{"id":"SC-07(23)","name":"Disable Sender Feedback on Protocol Validation Failure","statement":"Disable feedback to senders on protocol format validation failure.","baselines":[]},{"id":"SC-07(24)","name":"Personally Identifiable Information","statement":"For systems that process personally identifiable information:\na. Apply the following processing rules to data elements of personally identifiable information: [Assignment: organization-defined processing rules];\nb. Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;\nc. Document each processing exception; and\nd. Review and remove exceptions that are no longer supported.","baselines":["privacy"]},{"id":"SC-07(25)","name":"Unclassified National Security System Connections","statement":"Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].","baselines":[]},{"id":"SC-07(26)","name":"Classified National Security System Connections","statement":"Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].","baselines":[]},{"id":"SC-07(27)","name":"Unclassified Non-national Security System Connections","statement":"Prohibit the direct connection of [Assignment: organization-defined unclassified non-national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].","baselines":[]},{"id":"SC-07(28)","name":"Connections to Public Networks","statement":"Prohibit the direct connection of [Assignment: organization-defined system] to a public network.","baselines":[]},{"id":"SC-07(29)","name":"Separate Subnets to Isolate Functions","statement":"Implement [Selection (one): physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organization-defined critical system components and functions].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"SC-07","name":"Boundary Protection","description":"a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;\nb. Implement subnetworks for publicly accessible system components that are [Selection (one): physically; logically] separated from internal organizational networks; and\nc. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.","discussion":"Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189] provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).","related_controls":["AC-04","AC-17","AC-18","AC-19","AC-20","AU-13","CA-03","CM-02","CM-04","CM-07","CM-10","CP-08","CP-10","IR-04","MA-04","PE-03","PL-08","PM-12","SA-08","SA-17","SC-05","SC-26","SC-32","SC-35","SC-43"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Control text changes 'boundary' to 'managed interfaces; adds 'and privacy' in reference to organizational security architecture"}},"compliance_mappings":{"iso_27001_2022":["A.5.14","A.5.23","A.8.12","A.8.16","A.8.20","A.8.21","A.8.22","A.8.23","A.8.27"],"iso_27002_2022":["5.14","5.23","8.12","8.20","8.21","8.22","8.23","8.27"],"cobit_2019":["DSS05"],"pci_dss_v4":["1.1","1.2","1.2.1","1.2.5","1.3","1.4","1.5","5.4","6.4"],"nist_csf_2":["ID.AM-03","PR.DS-01","PR.DS-02","PR.DS-10","PR.IR-01","DE.CM-01","RS.MI-01"],"cis_controls_v8":["CIS 3.12","CIS 3.13","CIS 4","CIS 4.2","CIS 4.4","CIS 4.5","CIS 9","CIS 9.2","CIS 9.3","CIS 9.6","CIS 12","CIS 12.2","CIS 12.8","CIS 13","CIS 13.3","CIS 13.4","CIS 13.8","CIS 13.9","CIS 13.10"],"soc2_tsc":["CC6.1","CC6.1-POF5","CC6.6","CC6.6-POF1","CC6.6-POF3","CC6.8"],"finos_ccc":["CCC-C05","CCC-C09"],"iso_42001_2023":[],"iec_62443":["3-3 SR 5.1","3-3 SR 5.2"],"asd_e8":["E8-5 ML2"],"nis2":[],"apra_cps_234":["Para 22-23"],"mas_trm":["11","14","15"],"pra_op_resilience":["SS2/21-14.1"],"bsi_grundschutz":["APP.3.1","NET.1.1","NET.1.2","NET.3.1"],"anssi":["Hygiene.22","Hygiene.23","Hygiene.27","SecNumCloud.14.1","SecNumCloud.14.4"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.C(62)","IV.C(63)"],"gdpr":["Art.5(1)(f)","Art.32(1)(a)","Art.32(1)(b)"],"dora":["Art.9(4)(a)"],"bio2":["5.14","5.23","8.12","8.20","8.21","8.22","8.23","8.27"],"rbi_csf":["Annex1.4","Annex1.15","ITGRCA.19"],"fisc":["FISC.T3","FISC.T8","FISC.T9","FISC.T10","FISC.T11","FISC.T13"],"lgpd_bcb":["BCB.Art.3","BCB.Art.13","BCB.OpenFinance","BCB.PIX","LGPD.Art.46"],"hkma_tme1":["TME1.7.3","TME1.10.1","TME1.10.3","TME1.12.4"],"mlps_2":["8.1.2.1","8.1.3.1","8.1.3.2","8.1.3.3","8.2","8.3","8.5"],"dnb_good_practice":["DNB.18.1","DNB.18.4","DNB.20.1"],"cra":["CRA.I.2i","CRA.I.2j"],"swift_cscf":["SWIFT.1.1","SWIFT.1.3","SWIFT.1.4","SWIFT.1.5","SWIFT.2.3","SWIFT.6.5A"],"cbb_tm":["TM-8"],"cbuae":["CR-7"],"nca_ecc":["2-3","2-4","2-5","2-14","4-2","5-1"],"qatar_nia":["CS"],"sama_csf":["2.1","3.3","4.3"],"uae_ia":["T8"],"bog_cisd":["CISD-IX","CISD-VI","CISD-VIII","CISD-XI","CISD-XII","CISD-XIII"],"bom_ctrm":["3.2","3.13"],"cbe_csf":["CRM-2","CTO-5","CTO-6","CTO-8","CTO-11"],"cbn_csf":["Part3.1","Part3.3","Part5.1","Part5.2"],"popia":["s19","s72"],"sa_js2":["JS2-7.2","JS2-7.6"],"bcbs_239":["Principle 2"],"bot_cyber":["Ch2.4","Ch5.2","Ch8.2","Ch9.1"],"cpmi_pfmi":["CG.DE","CG.PR","PFMI.P17","PFMI.P22"],"eba_ict":["3.4.4"],"ecb_croe":["CROE.2.3.5","CROE.2.4"],"ffiec_is":["II.C.2","II.C.6","II.C.9","II.C.12","II.C.16"],"hipaa_sr":["§164.308(a)(4)(ii)(A)","§164.312(e)(1)","§164.314(b)(1)","§164.314(b)(2)"],"iosco_cyber":["DET-4","PFMI-20","PROT-2"],"nydfs_500":["500.2","500.14"],"sebi_cscrf":["EMAIL-SEC","PR.CS","PR.NS"],"cmmc_2":["SC"],"nerc_cip":["CIP-002-5.1a","CIP-003-9","CIP-005-7","CIP-007-6","CIP-010-4","CIP-012-2","CIP-015-1"],"nrc_73_54":["73.54(c)(1)","73.54(c)(2)","RG5.71-A-SC"],"tsa_psd":["SD-2 Sec A","SD-2 Sec F"],"ieee_1686":["5.6"],"ferc_cip":["Order 881","Order 887","Order 2222"],"doe_c2m2":["ARCHITECTURE"],"api_1164":["Sec 5"],"awia":["AWWA Sec 4"],"iaea_nss":["Sec 5.1","Sec 5.6"],"pci_pts":["E"],"fips_140":["FIPS 140-3 §7.3"],"cbest":["CBEST.5"],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FDP","CC Part 2 — FPT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.30"],"fda_cyber":["PU-3","TM-2"],"hitrust_csf":["01.b","01.d","05.c","09.e"],"iso_27799":["13.1","H.2","H.3"],"lloyds_ms":["MS8.9"],"naic_ds":["4","4-monitoring","4B"],"nhs_dspt":["NDG-9.2","NDG-9.4","NDG-9.5"],"pra_ss1_23":["P-IT.3"],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":["MASVS-NETWORK-1","MASVS-PLATFORM-1","MASVS-PLATFORM-2"],"csa_ccm_v4":["IVS-03","IVS-05","IVS-06","IVS-08","IVS-09","UEM-10","UEM-11"],"csa_aicm":["AIS-08","I&S-03","I&S-05","I&S-06","I&S-08","I&S-09","IAM-17","UEM-10","UEM-11"],"ccss_v9":[],"mica":["Art.62(5)","Art.68(1)"],"basel_sco60":["SCO60.21","SCO60.41","SCO60.51","SCO60.64","SCO60.65"],"bssc":["NOS-04","TIS-04"],"sec_custody_digital":["SEC-CD-09"],"dpdpa":["Act.8(5)","Rules.13(4)","Rules.Sch1.B.7"],"nist_ai_rmf_1":[],"eu_ai_act":["Art.55(1)(d)"]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: iso_27001_2022 A.8.16 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.DS-01, PR.DS-02, PR.DS-10 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-003-9, CIP-007-6, CIP-010-4, CIP-012-1 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-011","SP-012","SP-013","SP-015","SP-017","SP-019","SP-020","SP-023","SP-025","SP-026","SP-027","SP-028","SP-029","SP-030","SP-031","SP-034","SP-035","SP-036","SP-037","SP-038","SP-039","SP-040","SP-041","SP-042","SP-046","SP-047","SP-050","SP-051","SP-053","SP-054"],"attack":{"techniques":156,"route":"/api/v1/controls/SC-07?fields=attack"}}}