3.13 System and Communications Protection: the NIST SP 800-171 requirements

Protect communications at the network boundary and key internal boundaries: a business-class firewall with default-deny inbound, an IDS/IPS capability (built into most NGFW licenses), and segmentation of the CUI environment from guest and general networks. Review the firewall ruleset and remove any-any rules as a first pass. Evidence: the network diagram, firewall rule export, and IPS enablement screenshots.

Bake security into how you design and change systems: document security architecture principles (segmentation, least privilege, encrypted transport) in your engineering/change standards and show they are applied when systems are added: a security review step in the change process covers this at small scale. Evidence: the architecture/engineering standard and change records showing the security review applied.

Separate user functionality from system management: administer systems through dedicated admin accounts and, ideally, a management VLAN or jump host rather than from the same context as email and browsing; do not expose management interfaces (firewall admin pages, iDRAC/iLO, switch consoles) to the user network. Evidence: management VLAN/jump host configuration and firewall rules restricting management interface access.

Prevent information leakage via shared system resources: keep operating systems patched and supported (this control is primarily met by modern OS memory protections), clear temp and spool files holding CUI on shared systems, and avoid shared local accounts on multi-user machines. Retire any end-of-life operating systems in the CUI boundary. Evidence: OS inventory showing supported versions and configuration of shared-resource protections.

Place public-facing systems (web servers, external portals) in a DMZ or separate cloud network segment so a compromise there cannot reach the internal CUI network: most business firewalls support a DMZ zone natively. If your only public presence is vendor-hosted (website at a hosting provider), document that separation instead. Evidence: network diagram showing the DMZ/subnetwork and firewall rules isolating it from internal segments.

Set firewall policy to deny-all by default and permit only documented, needed traffic: inbound and, importantly, outbound (egress filtering is commonly missing). Review the ruleset, remove permissive legacy rules, and record the business justification for each allow rule. Evidence: the firewall configuration export showing default-deny and the rule justification register.

Prevent split tunneling on remote clients: configure the VPN for full tunnel (or a carefully documented exception set), so remote devices cannot bridge your network and untrusted networks simultaneously. This is a VPN profile setting deployable in an afternoon. Evidence: the VPN client profile/configuration showing split tunneling disabled.

Encrypt CUI in transit outside the protected boundary: TLS 1.2+ for web and email connections, encrypted VPN or SFTP for file transfer, and a secure file transfer or email encryption solution (such as your GCC High tenant's encryption or a managed SFT service) instead of plain email attachments for CUI. Prefer FIPS-validated implementations. Evidence: TLS configuration scans, the approved transfer methods list, and encryption settings for email/file exchange.

Configure network connections to terminate after sessions end or after a defined idle period: firewall TCP session timeouts, VPN idle disconnects, and load balancer/server keep-alive limits. These are configuration values in devices you already own. Evidence: the timeout settings exported from the firewall and VPN with your documented values.

Manage cryptographic keys formally: document how keys and certificates are generated, stored, rotated, and revoked; escrow BitLocker recovery keys in AD/Entra; protect private keys in secure stores rather than files on disk; and calendar certificate expirations. A one-page key management standard covers a small environment. Evidence: the key management procedure, key escrow configuration, and the certificate inventory.

Use FIPS-validated cryptography wherever cryptography protects CUI confidentiality: enable FIPS mode where supported, and verify each product's cryptographic module has an active CMVP certificate: "uses AES" is not the same as FIPS-validated, and assessors check the certificate. Note the SPRS partial credit here: encryption employed everywhere but not FIPS-validated scores a 3-point deduction instead of the full 5, so encrypt everything first, then chase validation. Evidence: a table mapping each CUI encryption use to its CMVP certificate number, plus FIPS-mode configuration screenshots.

Prevent remote activation of cameras and microphones on collaborative devices: configure conferencing tools so meetings cannot auto-answer or activate devices without user action, provide an on-device indicator (built into modern OSes), and cover/disable devices in sensitive areas. Verify Teams/Zoom settings and endpoint privacy controls. Evidence: the collaboration platform settings and endpoint policy for camera/mic permissions.

Control mobile code (browser scripts, macros, plugins): block Office macros from the internet via policy (a top ransomware defense and a same-day GPO/Intune change), restrict browser extensions to an allowlist, and keep Java/legacy plugin runtimes off endpoints that do not need them. Evidence: the macro-blocking policy export and browser extension management configuration.

Control VoIP usage: put phones on their own VLAN, change default credentials on the PBX and handsets, encrypt call signaling/media where the platform supports it (Teams/cloud VoIP handles this natively), and patch the phone system with the rest of your infrastructure. If you have no on-prem VoIP, document that cloud telephony is in use and how it is secured. Evidence: VoIP VLAN configuration, platform security settings, and the patch record.

Protect the authenticity of communications sessions so parties cannot be impersonated mid-session: enforce current TLS with valid certificates on internal and external services, use IPsec/modern VPN protocols, and disable protocol versions vulnerable to session hijacking (SSLv3, TLS 1.0/1.1). Run an SSL configuration scan to find weak endpoints. Evidence: TLS scan results and certificate inventory showing valid, trusted certificates on services.

Encrypt CUI at rest: full-disk encryption on endpoints (BitLocker/FileVault), encryption on servers and NAS volumes holding CUI, and confirmed encryption-at-rest for cloud storage (default in GCC High/major clouds: capture the documentation). Sweep for CUI on unencrypted legacy storage and migrate it. Evidence: encryption status reports across endpoints and servers, plus the cloud provider's encryption documentation for your tenant.