Boundary Protection SC-7
System and Communications Protection · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds SC-7 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, System and Communications Protection family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
SC-7 (Boundary Protection) requires monitoring and controlling communications at the external boundary and at key internal boundaries of the system. You connect to outside networks only through managed interfaces such as firewalls or gateways, deny traffic by default, and allow only what is explicitly needed. It carries from the Low baseline into Moderate.
What good looks like
- Route all external connections through managed interfaces (firewalls or gateways), not ad-hoc paths.
- Deny traffic by default and allow only explicitly authorized ports, protocols, and sources (
default deny incoming). - Separate publicly reachable components from internal ones with a subnet or demilitarized zone (DMZ) boundary.
- Keep the number of external access points small so the boundary stays watchable.
- Monitor and log the traffic that crosses each boundary.
Framework mapping
- NIST CSF 2.0 — PR.IR-01 — Networks and environments are protected from unauthorized logical access and usage
- CIS Controls v8 — Control 13 — Network Monitoring and Defense (default-deny filtering and segmentation)
How to move it toward Implemented
- SC-7 is met on this asset: UFW (Uncomplicated Firewall) is default-deny incoming with a rate-limited Secure Shell (SSH) allowance, and only ports 22 (limited) and 8080 are reachable — a working managed boundary.
- Save the
ufw status verboseoutput as a dated evidence file so the enforced ruleset is on record. - Attach that as hardening evidence naming SC-7 in the Requirement field to move it from 'To assess' to 'Completed'.
- Optional tightening: the DVWA (Damn Vulnerable Web Application) :8080 port is world-open — scoping it to the management subnet (
ufw allow from 10.10.0.0/16 to any port 8080) would shrink the exposed surface further.