💼 SC-7 Boundary Protection

• Contextual name: 💼 SC-7 Boundary Protection
• ID: /frameworks/nist-sp-800-53-r5/sc/07
• Located in: 💼 SC System And Communications Protection

Description

a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/auto-scaling/05
  • /frameworks/aws-fsbp-v1.0.0/dms/01
  • /frameworks/aws-fsbp-v1.0.0/documentdb/03
  • /frameworks/aws-fsbp-v1.0.0/ec2/01
  • /frameworks/aws-fsbp-v1.0.0/ec2/02
  • /frameworks/aws-fsbp-v1.0.0/ec2/09
  • /frameworks/aws-fsbp-v1.0.0/ec2/10
  • /frameworks/aws-fsbp-v1.0.0/ec2/15
  • /frameworks/aws-fsbp-v1.0.0/ec2/18
  • /frameworks/aws-fsbp-v1.0.0/ec2/19
  • /frameworks/aws-fsbp-v1.0.0/ec2/21
  • /frameworks/aws-fsbp-v1.0.0/ec2/25
  • /frameworks/aws-fsbp-v1.0.0/ec2/55
  • /frameworks/aws-fsbp-v1.0.0/ec2/56
  • /frameworks/aws-fsbp-v1.0.0/ec2/57
  • /frameworks/aws-fsbp-v1.0.0/ec2/58
  • /frameworks/aws-fsbp-v1.0.0/ec2/60
  • /frameworks/aws-fsbp-v1.0.0/ecs/02
  • /frameworks/aws-fsbp-v1.0.0/eks/01
  • /frameworks/aws-fsbp-v1.0.0/elasticache/07
  • /frameworks/aws-fsbp-v1.0.0/emr/01
  • /frameworks/aws-fsbp-v1.0.0/emr/02
  • /frameworks/aws-fsbp-v1.0.0/es/02
  • /frameworks/aws-fsbp-v1.0.0/lambda/01
  • /frameworks/aws-fsbp-v1.0.0/neptune/03
  • /frameworks/aws-fsbp-v1.0.0/network-firewall/06
  • /frameworks/aws-fsbp-v1.0.0/opensearch/02
  • /frameworks/aws-fsbp-v1.0.0/rds/01
  • /frameworks/aws-fsbp-v1.0.0/rds/02
  • /frameworks/aws-fsbp-v1.0.0/rds/23
  • /frameworks/aws-fsbp-v1.0.0/redshift/01
  • /frameworks/aws-fsbp-v1.0.0/redshift/07
  • /frameworks/aws-fsbp-v1.0.0/s3/01
  • /frameworks/aws-fsbp-v1.0.0/s3/02
  • /frameworks/aws-fsbp-v1.0.0/s3/03
  • /frameworks/aws-fsbp-v1.0.0/s3/19
  • /frameworks/aws-fsbp-v1.0.0/sagemaker/01
  • /frameworks/aws-fsbp-v1.0.0/sagemaker/02
  • /frameworks/aws-fsbp-v1.0.0/service-catalog/01
  • /frameworks/aws-fsbp-v1.0.0/ssm/04
  • /frameworks/aws-fsbp-v1.0.0/waf/02
  • /frameworks/aws-fsbp-v1.0.0/waf/03
  • /frameworks/aws-fsbp-v1.0.0/waf/08
• Internal
  • ID: dec-c-898bb59e

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [AutoScaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.1] Database Migration Service replication instances should not be public		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.1] Amazon EBS snapshots should not be publicly restorable			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.2] VPC default security groups should not allow inbound or outbound traffic			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.9] Amazon EC2 instances should not have a public IPv4 address			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.19] Security groups should not allow unrestricted access to ports with high risk			10
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.55] VPCs should be configured with an interface endpoint for ECR API
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.56] VPCs should be configured with an interface endpoint for Docker Registry
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.57] VPCs should be configured with an interface endpoint for Systems Manager
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.2] ECS services should not have public IP addresses assigned to them automatically
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.1] EKS cluster endpoints should not be publicly accessible
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.7] ElastiCache clusters should not use the default subnet group
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.2] Amazon EMR block public access setting should be enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.2] Elasticsearch domains should not be publicly accessible
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Lambda.1] Lambda function policies should prohibit public access
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Neptune.3] Neptune DB cluster snapshots should not be public
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.6] Stateless Network Firewall rule group should not be empty
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.2] OpenSearch domains should not be publicly accessible
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.1] RDS snapshot should be private		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.23] RDS instances should not use a database engine default port		1	1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.1] Amazon Redshift clusters should prohibit public access
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.7] Redshift clusters should use enhanced VPC routing
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.1] S3 general purpose buckets should have block public access settings enabled			1
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.2] S3 general purpose buckets should block public read access
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.3] S3 general purpose buckets should block public write access
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.19] S3 access points should have block public access settings enabled
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SageMaker.1] Amazon SageMaker AI notebook instances should not have direct internet access
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SageMaker.2] SageMaker AI notebook instances should be launched in a custom VPC
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SSM.4] SSM documents should not be public
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.2] AWS WAF Classic Regional rules should have at least one condition
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.3] AWS WAF Classic Regional rule groups should have at least one rule
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)	10	8	48
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)			33
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			118
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			117
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			97
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			111
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			69

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 SC-7(1) Boundary Protection _ Physically Separated Subnetworks
💼 SC-7(2) Boundary Protection _ Public Access
💼 SC-7(3) Boundary Protection _ Access Points			8
💼 SC-7(4) Boundary Protection _ External Telecommunications Services			28
💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception		4	18
💼 SC-7(6) Boundary Protection _ Response to Recognized Failures
💼 SC-7(7) Boundary Protection _ Split Tunneling for Remote Devices
💼 SC-7(8) Boundary Protection _ Route Traffic to Authenticated Proxy Servers
💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic			14
💼 SC-7(10) Boundary Protection _ Prevent Exfiltration			6
💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic			22
💼 SC-7(12) Boundary Protection _ Host-based Protection
💼 SC-7(13) Boundary Protection _ Isolation of Security Tools, Mechanisms, and Support Components
💼 SC-7(14) Boundary Protection _ Protect Against Unauthorized Physical Connections
💼 SC-7(15) Boundary Protection _ Networked Privileged Accesses
💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components			23
💼 SC-7(17) Boundary Protection _ Automated Enforcement of Protocol Formats
💼 SC-7(18) Boundary Protection _ Fail Secure
💼 SC-7(19) Boundary Protection _ Block Communication from Non-organizationally Configured Hosts
💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation			8
💼 SC-7(21) Boundary Protection _ Isolation of System Components			22
💼 SC-7(22) Boundary Protection _ Separate Subnets for Connecting to Different Security Domains
💼 SC-7(23) Boundary Protection _ Disable Sender Feedback on Protocol Validation Failure
💼 SC-7(24) Boundary Protection _ Personally Identifiable Information
💼 SC-7(25) Boundary Protection _ Unclassified National Security System Connections
💼 SC-7(26) Boundary Protection _ Classified National Security System Connections
💼 SC-7(27) Boundary Protection _ Unclassified Non-national Security System Connections
💼 SC-7(28) Boundary Protection _ Connections to Public Networks
💼 SC-7(29) Boundary Protection _ Separate Subnets to Isolate Functions

Policies (24)

Policy	Logic Count	Flags
📝 AWS DMS Replication Instance is publicly accessible 🟢	1	🟢 x6
📝 AWS EBS Snapshot is publicly accessible 🟢	1	🟢 x6
📝 AWS EC2 Auto Scaling Group behind ELB assigns public IP to instances 🟢	1	🟢 x6
📝 AWS EC2 Default Security Group does not restrict all traffic 🟢	1	🟢 x6
📝 AWS EC2 Instance with an auto-assigned public IP address is in a default subnet 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted CIFS traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted FTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted RPC traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted SMTP traffic 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MSSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to MySQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted traffic to PostgreSQL 🟢	1	🟢 x6
📝 AWS EC2 Security Group allows unrestricted Telnet traffic 🟢	1	🟢 x6
📝 AWS RDS Instance is publicly accessible and in an unrestricted public subnet 🟢	1	🟢 x6
📝 AWS RDS Instance uses default endpoint port 🟢	1	🟢 x6
📝 AWS RDS Snapshot is publicly accessible 🟢	1	🟢 x6
📝 AWS S3 Bucket is not configured to block public access 🟢	1	🟢 x6
📝 AWS VPC is not configured with a VPC Endpoint for Amazon EC2 service 🟢	1	🟢 x6
📝 AWS VPC Network ACL exposes admin ports to public internet ports 🟢	1	🟢 x6
📝 AWS VPC Subnet Map Public IP On Launch is enabled 🟢	1	🟢 x6
📝 Google GCE Instance IP Forwarding is not disabled. 🟢	1	🟢 x6
📝 Google GCE Network has Firewall Rules which allow unrestricted SSH access from the Internet 🟢	1	🟢 x6