CMMC Practice SC.1.176

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.


CMMC Version 1.02, pg. 247

Bold Coast Security Guidance

For Level 1 compliance, organizations that host services available to the public will need to have a DMZ defined at the firewall that creates a safe zone to serve public users without exposing or potentially compromising the internal network. At Level 2 define the need for a DMZ for all publically accessible systems, and the plan for LEvel 3 will note the same firewall defined in SC.1.175. The Plan should also note who is responsible for making and approving changes to the firewall which impact the DMZ. For measuring the effectiveness of this control, conduct regular penetration tests.

Discussion From Source

DRAFT NIST SP 800-171 R2 Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones (DMZs) . DMZs are typically implemented with boundary control devices and techniques that include routers, gateways, firewalls, virtualization, or cloud-based technologies. NIST SP 800-41 provides guidance on firewalls and firewall policy . SP 800-125B provides guidance on security for virtualization technologies.