Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
SC.L1-3.13.5 · FAR 52.204-21 (b)(1)(xi) · NIST SP 800-171 3.13.5
Public-Access System Separation
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
If you run public-facing systems (a website, customer portal), keep them on a separate network segment from your internal/contract systems.
Why it matters
Small contractors usually don't run their own public systems, the marketing site lives at Squarespace, Wix, or GoDaddy. If that's true, say so explicitly; the separation is already met by the hosting architecture.
The proof on file
- guest-wifi-network-separation.pdfUploaded, checked by Charlie · June 8, 2026Sufficient
Every uploaded file is checked by Charlie the moment it arrives, so a gap is caught on the spot, not at the assessment. Pulls from Microsoft 365 and references to the Policy Center and registers come straight from where they live, so they skip that check.
The narrative on file
The office guest Wi Fi is a separate network with no route to the Federal Programs systems. Publicly reachable services are not hosted on the internal network; the company website is hosted externally and holds no FCI.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Inventory of every public-facing system the company runs (or 'all hosted SaaS, none self-run' stated explicitly)
- For each: where it is hosted, confirmation it is separate from internal FCI systems
- Signed separation memo or AWS VPC diagram showing public/private subnets are separate
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Any business, step by step
- 1List every public-facing system your company operates (website, contact form, customer portal)
- 2For each, note where it is hosted and confirm it is on infrastructure separate from internal FCI systems
- 3If all public systems are externally hosted SaaS (Squarespace, Wix, Shopify, etc.), state that plainly in a one-page memo
- 4Owner signs the inventory and separation memo
Capture: Signed inventory + separation memo (PDF or photo).
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.