Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 10 of 15 · SC.L1-b.1.x
SC.L1-3.13.1 · FAR 52.204-21 (b)(1)(x) · NIST SP 800-171 3.13.1
Boundary Protection
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
What it means
Put a firewall (or equivalent) between your network and the internet, and between sensitive and non-sensitive parts of your network.
Why it matters
The router your ISP gave you usually has a firewall, the question is whether it's configured and documented. Primes want to see that you know where your boundary is and that traffic is controlled at it.
How to do it, Microsoft Defender for Endpoint / Windows Firewall
- 1Go to Microsoft Defender portal → Endpoint security → Firewall
- 2Screenshot the firewall policy showing it is applied to all in-scope devices
- 3For a representative device, screenshot Windows Security → Firewall & network protection showing Domain/Private/Public profiles all enabled
Capture: Policy screenshot plus per-device firewall status.
The narrative on file
The Federal Programs tenant sits behind Microsoft 365 boundary protection, and the office network is protected by a managed firewall. The shop floor CNC network is separated from the office network and has no inbound internet path. Remote access is only through the company VPN.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- Network diagram showing internet → firewall/router → internal
- Router or firewall admin screenshot showing firewall is enabled and default password is changed
- Inbound/outbound rule list (or default-deny posture) visible
- For AWS path: security-group rules screenshot for the FCI VPC
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.