Example, read only. A sample account that shows what finished CMMC looks like.
Safeguard 11 of 15 · SC.L1-b.1.xi
SC.L1-3.13.5 · FAR 52.204-21 (b)(1)(xi) · NIST SP 800-171 3.13.5
Public-Access System Separation
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
What it means
If you run public-facing systems (a website, customer portal), keep them on a separate network segment from your internal/contract systems.
Why it matters
Small contractors usually don't run their own public systems, the marketing site lives at Squarespace, Wix, or GoDaddy. If that's true, say so explicitly; the separation is already met by the hosting architecture.
How to do it, Any business
- 1List every public-facing system your company operates (website, contact form, customer portal)
- 2For each, note where it is hosted and confirm it is on infrastructure separate from internal FCI systems
- 3If all public systems are externally hosted SaaS (Squarespace, Wix, Shopify, etc.), state that plainly in a one-page memo
- 4Owner signs the inventory and separation memo
Capture: Signed inventory + separation memo (PDF or photo).
The narrative on file
The office guest Wi Fi is a separate network with no route to the Federal Programs systems. Publicly reachable services are not hosted on the internal network; the company website is hosted externally and holds no FCI.
You answer in plain English; Charlie writes the official narrative for your System Security Plan.
What makes it pass
- Inventory of every public-facing system the company runs (or 'all hosted SaaS, none self-run' stated explicitly)
- For each: where it is hosted, confirmation it is separate from internal FCI systems
- Signed separation memo or AWS VPC diagram showing public/private subnets are separate
Assessment objectives, NIST SP 800-171A
This is one of 15
Answer in plain English, drop the proof, confirm it MET.
Cedar Ridge Machine Works, LLC walked all 15 the same way. The platform explains each one in plain English, tells you exactly what to grab, checks it, and writes the paperwork, and you confirm each one MET. The self assessment stays your act. Start free, or book a call.