NIST 800-53 SC-7 Boundary Protection: What to Show an Auditor

SC-7 is one of the most cited controls in the catalog. It has three requirements. Monitor and control communications at the external managed interfaces of the system and at key internal managed interfaces. Implement subnetworks for publicly accessible components that are separated from internal networks. Connect to external networks or systems only through managed interfaces made of boundary protection devices, arranged according to your security architecture.

800-53 binds US federal systems and, through contracts, their suppliers. For a small or mid size company it is the reference a customer or auditor reaches for when asking, "Where are your network borders and who watches them?"

What it means in practice

NIST lists the usual managed interfaces: gateways, routers, firewalls, guards, network based malicious code analysis, virtualization systems and encrypted tunnels. Subnetworks that are physically or logically separated from internal networks are what most people call a DMZ.

The guidance gives concrete examples. Restrict external web traffic to designated web servers. Prohibit outside traffic that appears to spoof internal addresses, and internal traffic that appears to spoof external ones.

In a cloud company the same ideas translate directly. Your managed interfaces are load balancers, API gateways, security groups, network ACLs and web application firewalls. Your DMZ is the public subnet. Your key internal interfaces are the paths between production, staging, corporate and customer data stores.

The word "only" in the third requirement matters. Every connection to an outside network must pass through a device you manage. A forgotten public IP on a database is a direct failure.

The enhancements worth knowing

The record lists eight. Several are common in audits:

• SC-7(3) Access Points limits the number of external network connections.
• SC-7(4) External Telecommunications Services covers the providers you connect through.
• SC-7(5) Deny by Default and Allow by Exception is the rule most reviewers test first.
• SC-7(7) Split Tunneling for Remote Devices addresses remote devices that reach both the company network and the open internet at once.
• SC-7(8) Route Traffic to Authenticated Proxy Servers sends defined traffic through a proxy that checks who is asking.

The others are SC-7(1) Physically Separated Subnetworks, SC-7(2) Public Access, and SC-7(6) Response to Recognized Failures.

Evidence to collect

• A current network diagram showing the external boundary, the DMZ, and the internal segments, with owners.
• An export of firewall, security group and network ACL rules, dated.
• Proof of default deny: the final rule on each policy, or a configuration setting showing it.
• A list of every public endpoint, matched against what you expect to be public.
• Logs or alerts from boundary devices, and evidence someone reviews them.
• Change records for rule edits, with approvals.
• For remote access, the VPN or zero trust policy and its split tunneling setting.

Common gaps

Rules with source 0.0.0.0/0 on administrative ports. Security groups full of old exceptions with no owner. A diagram that was accurate two reorganizations ago. Public cloud storage and databases created by a developer outside the normal path. Logs collected and never read.

Another common gap is the internal side. Teams protect the edge well and let any internal host talk to any other. SC-7 says key internal managed interfaces too.

How to implement it

Start with discovery. You cannot control a boundary you cannot see, so build an inventory of every public address, domain and cloud resource. The asset discovery demo shows the idea.

Click through it at your own pace, or open it full screen.

Then work in this order:

1. Put public components in their own subnet. Nothing in it should hold sensitive data.
2. Set deny by default on every boundary policy and add allow rules one at a time, each with a ticket.
3. Route all inbound traffic through a load balancer or gateway you monitor. Route outbound traffic through controlled egress.
4. Segment production from everything else, and databases from the web tier.
5. Export rules weekly or on change, and compare them with the previous export. Alert on new open ports.
6. Review rules each quarter and delete exceptions nobody owns.

Keep the exports. An auditor wants a trail over time, not one screenshot taken the day before the visit.

Quick check

Sources

• NIST SP 800-53 Rev 5, SC-7 in the CPRT catalog
• NIST OSCAL catalog for Rev 5