Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.13.01Boundary protectionITSP.10.171System and communications protection

Official Requirement

A. Monitor and control communications at the external managed interfaces to the system and key internal managed interfaces within the system. B. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. C. Connect to external systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Your organization must monitor and control network traffic at the boundary between your internal network and external networks, as well as at key internal boundaries. Publicly accessible components must be in separate subnetworks (DMZ) isolated from internal networks. External connections must only go through managed, protected interfaces.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Network boundary protection and segmentation

Implementation steps

  1. Deploy next-generation firewalls at all external network boundaries with IDS/IPS enabled
  2. Create a DMZ with physically or logically separated subnetworks for all publicly accessible systems
  3. Monitor traffic at external and key internal boundaries using SIEM-integrated firewall and IDS/IPS logs
  4. Ensure all external system connections traverse managed boundary protection devices; prohibit direct external connections to internal networks

Tools / systems

Evidence artifacts

Evidence frequency: Continuous monitoring; quarterly firewall rule review; annual architecture review