NIST 800-171 Controls · System and Communications Protection

SC.1.001 — Monitor and Protect Communications at Boundaries

CMMC Level 1SPRS if unmet: -5CRITICAL priority~12h to implement

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

What SC.1.001 means in plain English

You need a firewall between your network and the internet, and it needs to be actually configured — not just plugged in with default settings. The firewall watches all traffic going in and out and blocks anything suspicious. If you have separate networks (like an office network and a shop floor network), put a firewall or at least managed switch rules between them too. Check your firewall logs periodically to see if anything sketchy is trying to get in.

The assessment question

“Do you have a properly configured firewall at your internet boundary that monitors and controls inbound and outbound network traffic, and do you review firewall logs for suspicious activity?”

How to implement SC.1.001

If you are using the basic router from your ISP, replace it with a proper firewall. A pfSense appliance (Netgate 1100 for ~$189) or a Ubiquiti Dream Machine (~$379) gives you real firewall capabilities with logging.
Configure your firewall with a "deny all inbound" default rule, then create specific allow rules only for traffic you actually need (e.g., inbound VPN, outbound web browsing, outbound email).
Enable firewall logging and review logs weekly for blocked connection attempts, especially from foreign IP addresses or unusual ports.
If you have different network segments (office, shop floor, guest WiFi), configure firewall rules between them so the guest WiFi cannot reach your CUI systems.
Document your firewall rules in a spreadsheet: rule number, source, destination, port, protocol, action (allow/deny), and business justification.

Evidence your assessor will ask for

Firewall configuration export showing rule set with deny-by-default policy
Network diagram showing firewall placement at external and key internal boundaries
Firewall log samples showing traffic is being monitored and suspicious traffic blocked
Documented firewall rule set with business justifications for each allow rule
Evidence of periodic firewall log review (review notes or screenshots)

Does AI prompt monitoring help with this control? Yes — directly.

SC.1.001 is one of the requirements a local AI prompt firewall concretely evidences. When employees send prompts to ChatGPT, Copilot, or Claude, that traffic crosses your external boundary — HoundShield inspects it on your own infrastructure (self-hosted Docker, Mode B), blocks CUI patterns before transmission, and writes every allowed/blocked event to a SHA-256 hash-chained log attributable to the user. Architecture diagram, active pattern set, and a log sample are the evidence an assessor tests this against for the AI data path.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Communications Protection controls

SC.1.005

Implement Subnetworks for Public Components

SC.2.002

Employ Effective Security Architecture

SC.2.003

Separate User and System Management Functionality

SC.2.004

Prevent Unauthorized Info Transfer via Shared Resources

SC.2.006

Deny Network Traffic by Default

SC.2.007

Prevent Remote Device Split Tunneling

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment