cmmc-nist-800-171-ngfw-compliance

Assess a firewall for CMMC Level 2 by first establishing CUI scope and data flows, then mapping firewall controls to NIST SP 800-171 Rev. 2 requirements such as 3.1.3, 3.13.1, and 3.3.1. The Skill provides a nine-step workflow covering rulebase review, remote access validation, logging, and evidence collection.

A firewall can support requirements including 3.1.1 authorized access, 3.1.3 CUI flow control, 3.1.12 remote access monitoring, 3.3.1 audit logging, 3.13.1 boundary protection, and 3.13.6 deny-by-default. The control-mapping reference lists each requirement with the firewall capabilities and evidence to request.

No, an NGFW is not CMMC compliant by itself. CMMC and NIST SP 800-171 are assessed against the contractor environment and CUI protection program, including policies, procedures, evidence, and people. The firewall only supports compliance when configured, monitored, and tied to SSP and assessment evidence.

The Skill defaults to NIST SP 800-171 Rev. 2 requirement IDs for CMMC Level 2 work, since current DFARS assessments remain on Rev. 2. It notes that Rev. 3 exists and warns against mixing Rev. 2 and Rev. 3 IDs without labeling the assessment basis.

Collect the SSP boundary sections, CUI data-flow diagrams, network diagrams, firewall policy and NAT exports, change tickets, rule review records, MFA and VPN evidence, SIEM log samples, and POA&M entries. The assessment-workflow reference includes a complete evidence request checklist.

Firewall review alone cannot determine compliance because segmentation labels, zones, and VLANs are not evidence without policy, diagrams, access tests, and monitoring. Final determination belongs to the authorized assessor, and the Skill treats its output as research guidance, not legal or C3PAO advice.