💼 SC-7 Boundary Protection

• ID: /frameworks/nist-sp-800-53-r5/sc/07

Description

a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Similar

• Sections
  • /frameworks/aws-fsbp-v1.0.0/auto-scaling/05
  • /frameworks/aws-fsbp-v1.0.0/dms/01
  • /frameworks/aws-fsbp-v1.0.0/documentdb/03
  • /frameworks/aws-fsbp-v1.0.0/ec2/01
  • /frameworks/aws-fsbp-v1.0.0/ec2/02
  • /frameworks/aws-fsbp-v1.0.0/ec2/09
  • /frameworks/aws-fsbp-v1.0.0/ec2/10
  • /frameworks/aws-fsbp-v1.0.0/ec2/15
  • /frameworks/aws-fsbp-v1.0.0/ec2/18
  • /frameworks/aws-fsbp-v1.0.0/ec2/19
  • /frameworks/aws-fsbp-v1.0.0/ec2/21
  • /frameworks/aws-fsbp-v1.0.0/ec2/25
  • /frameworks/aws-fsbp-v1.0.0/ec2/55
  • /frameworks/aws-fsbp-v1.0.0/ec2/56
  • /frameworks/aws-fsbp-v1.0.0/ec2/57
  • /frameworks/aws-fsbp-v1.0.0/ec2/58
  • /frameworks/aws-fsbp-v1.0.0/ec2/60
  • /frameworks/aws-fsbp-v1.0.0/ecs/02
  • /frameworks/aws-fsbp-v1.0.0/eks/01
  • /frameworks/aws-fsbp-v1.0.0/elasticache/07
  • /frameworks/aws-fsbp-v1.0.0/emr/01
  • /frameworks/aws-fsbp-v1.0.0/emr/02
  • /frameworks/aws-fsbp-v1.0.0/es/02
  • /frameworks/aws-fsbp-v1.0.0/lambda/01
  • /frameworks/aws-fsbp-v1.0.0/neptune/03
  • /frameworks/aws-fsbp-v1.0.0/network-firewall/06
  • /frameworks/aws-fsbp-v1.0.0/opensearch/02
  • /frameworks/aws-fsbp-v1.0.0/rds/01
  • /frameworks/aws-fsbp-v1.0.0/rds/02
  • /frameworks/aws-fsbp-v1.0.0/rds/23
  • /frameworks/aws-fsbp-v1.0.0/redshift/01
  • /frameworks/aws-fsbp-v1.0.0/redshift/07
  • /frameworks/aws-fsbp-v1.0.0/s3/01
  • /frameworks/aws-fsbp-v1.0.0/s3/02
  • /frameworks/aws-fsbp-v1.0.0/s3/03
  • /frameworks/aws-fsbp-v1.0.0/s3/19
  • /frameworks/aws-fsbp-v1.0.0/sagemaker/01
  • /frameworks/aws-fsbp-v1.0.0/sagemaker/02
  • /frameworks/aws-fsbp-v1.0.0/service-catalog/01
  • /frameworks/aws-fsbp-v1.0.0/ssm/04
  • /frameworks/aws-fsbp-v1.0.0/waf/02
  • /frameworks/aws-fsbp-v1.0.0/waf/03
  • /frameworks/aws-fsbp-v1.0.0/waf/08
• Internal
  • ID: dec-c-898bb59e

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [AutoScaling.5] Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DMS.1] Database Migration Service replication instances should not be public		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.1] Amazon EBS snapshots should not be publicly restorable			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.2] VPC default security groups should not allow inbound or outbound traffic			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.9] Amazon EC2 instances should not have a public IPv4 address			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.10] Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.15] Amazon EC2 subnets should not automatically assign public IP addresses			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.19] Security groups should not allow unrestricted access to ports with high risk			10		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.25] Amazon EC2 launch templates should not assign public IPs to network interfaces					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.55] VPCs should be configured with an interface endpoint for ECR API					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.56] VPCs should be configured with an interface endpoint for Docker Registry					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.57] VPCs should be configured with an interface endpoint for Systems Manager					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.58] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.60] VPCs should be configured with an interface endpoint for Systems Manager Incident Manager					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ECS.2] ECS services should not have public IP addresses assigned to them automatically					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EKS.1] EKS cluster endpoints should not be publicly accessible					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElastiCache.7] ElastiCache clusters should not use the default subnet group					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EMR.2] Amazon EMR block public access setting should be enabled					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ES.2] Elasticsearch domains should not be publicly accessible					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Lambda.1] Lambda function policies should prohibit public access					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Neptune.3] Neptune DB cluster snapshots should not be public					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.6] Stateless Network Firewall rule group should not be empty					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Opensearch.2] OpenSearch domains should not be publicly accessible					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.1] RDS snapshot should be private		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [RDS.23] RDS instances should not use a database engine default port		1	1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.1] Amazon Redshift clusters should prohibit public access					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Redshift.7] Redshift clusters should use enhanced VPC routing					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.1] S3 general purpose buckets should have block public access settings enabled			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.2] S3 general purpose buckets should block public read access					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.3] S3 general purpose buckets should block public write access					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [S3.19] S3 access points should have block public access settings enabled					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SageMaker.1] Amazon SageMaker AI notebook instances should not have direct internet access					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SageMaker.2] SageMaker AI notebook instances should be launched in a custom VPC					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ServiceCatalog.1] Service Catalog portfolios should be shared within an AWS organization only					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [SSM.4] SSM documents should not be public					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.2] AWS WAF Classic Regional rules should have at least one condition					no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.3] AWS WAF Classic Regional rule groups should have at least one rule			1		no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [WAF.8] AWS WAF Classic global web ACLs should have at least one rule or rule group			1		no data

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 FedRAMP High Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)	10	8	50		no data
💼 FedRAMP Low Security Controls → 💼 SC-7 Boundary Protection (L)(M)(H)			35		no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			145		no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			148		no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			125		no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			142		no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			95		no data

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 SC-7(1) Boundary Protection _ Physically Separated Subnetworks					no data
💼 SC-7(2) Boundary Protection _ Public Access					no data
💼 SC-7(3) Boundary Protection _ Access Points			8		no data
💼 SC-7(4) Boundary Protection _ External Telecommunications Services			28		no data
💼 SC-7(5) Boundary Protection _ Deny by Default — Allow by Exception		4	18		no data
💼 SC-7(6) Boundary Protection _ Response to Recognized Failures					no data
💼 SC-7(7) Boundary Protection _ Split Tunneling for Remote Devices					no data
💼 SC-7(8) Boundary Protection _ Route Traffic to Authenticated Proxy Servers					no data
💼 SC-7(9) Boundary Protection _ Restrict Threatening Outgoing Communications Traffic			14		no data
💼 SC-7(10) Boundary Protection _ Prevent Exfiltration			6		no data
💼 SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic			24		no data
💼 SC-7(12) Boundary Protection _ Host-based Protection					no data
💼 SC-7(13) Boundary Protection _ Isolation of Security Tools, Mechanisms, and Support Components					no data
💼 SC-7(14) Boundary Protection _ Protect Against Unauthorized Physical Connections					no data
💼 SC-7(15) Boundary Protection _ Networked Privileged Accesses					no data
💼 SC-7(16) Boundary Protection _ Prevent Discovery of System Components			25		no data
💼 SC-7(17) Boundary Protection _ Automated Enforcement of Protocol Formats					no data
💼 SC-7(18) Boundary Protection _ Fail Secure					no data
💼 SC-7(19) Boundary Protection _ Block Communication from Non-organizationally Configured Hosts					no data
💼 SC-7(20) Boundary Protection _ Dynamic Isolation and Segregation			8		no data
💼 SC-7(21) Boundary Protection _ Isolation of System Components			24		no data
💼 SC-7(22) Boundary Protection _ Separate Subnets for Connecting to Different Security Domains					no data
💼 SC-7(23) Boundary Protection _ Disable Sender Feedback on Protocol Validation Failure					no data
💼 SC-7(24) Boundary Protection _ Personally Identifiable Information					no data
💼 SC-7(25) Boundary Protection _ Unclassified National Security System Connections					no data
💼 SC-7(26) Boundary Protection _ Classified National Security System Connections					no data
💼 SC-7(27) Boundary Protection _ Unclassified Non-national Security System Connections					no data
💼 SC-7(28) Boundary Protection _ Connections to Public Networks					no data
💼 SC-7(29) Boundary Protection _ Separate Subnets to Isolate Functions					no data

Policies (26)

Policy	Logic Count	Flags	Compliance
🛡️ AWS DMS Replication Instance is publicly accessible🟢	1	🟢 x6	no data
🛡️ AWS EBS Snapshot is publicly accessible🟢	1	🟢 x6	no data
🛡️ AWS EC2 Auto Scaling Group behind ELB assigns public IP to instances🟢	1	🟢 x6	no data
🛡️ AWS EC2 Default Security Group does not restrict all traffic🟢	1	🟢 x6	no data
🛡️ AWS EC2 Instance with an auto-assigned public IP address is in a default subnet🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted CIFS traffic🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted FTP traffic🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted RPC traffic🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted SMTP traffic🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MSSQL🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MySQL🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to PostgreSQL🟢	1	🟢 x6	no data
🛡️ AWS EC2 Security Group allows unrestricted Telnet traffic🟢	1	🟢 x6	no data
🛡️ AWS RDS Instance is publicly accessible and in an unrestricted public subnet🟢	1	🟢 x6	no data
🛡️ AWS RDS Instance uses default endpoint port🟢	1	🟢 x6	no data
🛡️ AWS RDS Snapshot is publicly accessible🟢	1	🟢 x6	no data
🛡️ AWS S3 Bucket is not configured to block public access🟢	1	🟢 x6	no data
🛡️ AWS VPC is not configured with a VPC Endpoint for Amazon EC2 service🟢	1	🟢 x6	no data
🛡️ AWS VPC Network ACL exposes admin ports to public internet ports🟢	1	🟢 x6	no data
🛡️ AWS VPC Subnet Map Public IP On Launch is enabled🟢	1	🟢 x6	no data
🛡️ AWS WAF Rule Group has no WAF Rules🟢	1	🟠 x1, 🟢 x5	no data
🛡️ AWS WAF Web ACL has no WAF Rules or WAF Rule Groups🟢	1	🟠 x1, 🟢 x5	no data
🛡️ Google GCE Instance IP Forwarding is not disabled.🟢	1	🟢 x6	no data
🛡️ Google GCE Network allows unrestricted SSH traffic🟢	1	🟢 x6	no data