Control 3.13.1

★What This Means in Plain English

You must monitor and protect data flowing in and out of your network, and between key internal network segments. Firewalls, intrusion detection systems, and traffic monitoring must be deployed at these boundaries.

✓How Petronella Implements This Control

Petronella Technology Group implements this control through:

• FortiGate next-generation firewalls at all external network boundaries with IPS/IDS enabled
• Arctic Wolf SIEM monitoring boundary traffic for anomalous patterns and threats
• Cisco Meraki managing internal network segmentation boundaries
• DLP policies at email and web gateways monitoring for CUI in outbound traffic
• Network traffic analysis detecting unauthorized data exfiltration attempts
• ComplianceArmor documenting network boundary definitions and monitoring points

🔎Assessment Guidance

Assessors will review network boundary documentation, verify that firewalls and IDS/IPS are deployed at all external boundaries, check that key internal boundaries are monitored, and test that boundary protection mechanisms are functioning correctly.

⚠Common Implementation Gaps

• No firewall or only a basic firewall at the network boundary
• IDS/IPS not enabled or not monitored
• Internal network segments without boundary protection
• No monitoring of outbound traffic for data exfiltration
• Network boundaries not documented

⇄Cross-Framework Mapping