Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
SC.L1-3.13.1 · FAR 52.204-21 (b)(1)(x) · NIST SP 800-171 3.13.1
Boundary Protection
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Put a firewall (or equivalent) between your network and the internet, and between sensitive and non-sensitive parts of your network.
Why it matters
The router your ISP gave you usually has a firewall, the question is whether it's configured and documented. Primes want to see that you know where your boundary is and that traffic is controlled at it.
The proof on file
- office-firewall-rules-export.pdfUploaded, checked by Charlie · June 8, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
The Federal Programs tenant sits behind Microsoft 365 boundary protection, and the office network is protected by a managed firewall. The shop floor CNC network is separated from the office network and has no inbound internet path. Remote access is only through the company VPN.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Network diagram showing internet → firewall/router → internal
- Router or firewall admin screenshot showing firewall is enabled and default password is changed
- Inbound/outbound rule list (or default-deny posture) visible
- For AWS path: security-group rules screenshot for the FCI VPC
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft Defender for Endpoint / Windows Firewall, step by step
- 1Go to Microsoft Defender portal → Endpoint security → Firewall
- 2Screenshot the firewall policy showing it is applied to all in-scope devices
- 3For a representative device, screenshot Windows Security → Firewall & network protection showing Domain/Private/Public profiles all enabled
Capture: Policy screenshot plus per-device firewall status.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.