Requirement
The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
Points of Focus
Restricts Access
Requirement: The types of activities that can occur through a communication channel (for example, FTP site, router port) are restricted.
Protects Identification and Authentication Credentials
Requirement: Identification and authentication credentials are protected during transmission outside its system boundaries.
Requires Additional Authentication or Credentials
Requirement: Additional authentication information or credentials are required when accessing the system from outside its boundaries.
Implements Boundary Protection Systems
Requirement: Boundary protection systems (for example, firewalls, demilitarized zones, intrusion detection or prevention systems, and endpoint detection and response systems) are configured, implemented, and maintained to protect external access points.
Explanation
Systems reachable from outside the entity's network face attackers who never pass through the front door. Auditors expect boundary defenses such as firewalls and intrusion detection, restrictions on what each communication channel can do, and stronger authentication for anyone connecting from beyond the system boundary.
