You are part of an Assessment Team tasked with conducting a CMMC Assessment for an OSC. When assessing the contractor’s implementation of SC.L2-3.13.6 – Network Communication by Exception, objectives [a] and [b], the OSC’s system admin informs you that they use Fortinet Next-Generation Firewall (NGFW). Fortinet NGFWs are hardcoded to deny all traffic by default, and traffic is only allowed on an exception basis. While this is factual, the Lead Assessor asks you to test the NGFW to ascertain whether it meets the intent of Assessment Objectives in SC.L2-3.13.6 – Network Communication by Exception. What is the benefit of testing as an assessment method?
Submit