NIST 800-171 Controls · System and Communications Protection

SC.1.005 — Implement Subnetworks for Public Components

CMMC Level 1SPRS if unmet: -5CRITICAL priority~10h to implement

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

What SC.1.005 means in plain English

If you have anything connected to the internet that outsiders can reach — like a public website, a web server, or a guest WiFi network — it must be on a completely separate network segment from your internal computers that handle CUI. This is called a DMZ or a separate VLAN. If a hacker breaks into your website, they should not be able to hop over to your accounting server. Your guest WiFi should be on its own VLAN so visitors cannot see your internal network.

The assessment question

“Are publicly accessible systems (such as web servers or guest WiFi) on separate network segments (VLANs or DMZ) that are logically or physically isolated from internal networks containing CUI?”

How to implement SC.1.005

Identify all publicly accessible components: web servers, guest WiFi, any services exposed to the internet. These must be isolated from your internal CUI network.
Configure your firewall or managed switch to create separate VLANs: at minimum, a CUI/internal VLAN, a guest WiFi VLAN, and a DMZ VLAN for any public-facing servers.
Set firewall rules so the guest WiFi VLAN can only reach the internet — not your internal VLAN. The DMZ should only allow specific, necessary traffic to the internal network.
Test the segmentation: connect a device to the guest WiFi and try to ping or browse to an internal CUI system. It should fail. Document the test result.
Update your network diagram to show VLAN segmentation and firewall rules between segments.

Evidence your assessor will ask for

Network diagram showing VLAN or DMZ segmentation with publicly accessible components isolated
Firewall or switch VLAN configuration showing separate segments
Firewall rules between segments demonstrating traffic restrictions
Test results showing guest WiFi or DMZ cannot access internal CUI systems
Written network segmentation documentation or policy

Does AI prompt monitoring help with this control? Honestly, no.

SC.1.005 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Communications Protection controls

SC.1.001

Monitor and Protect Communications at Boundaries

SC.2.002

Employ Effective Security Architecture

SC.2.003

Separate User and System Management Functionality

SC.2.004

Prevent Unauthorized Info Transfer via Shared Resources

SC.2.006

Deny Network Traffic by Default

SC.2.007

Prevent Remote Device Split Tunneling

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment