NIST 800-171 Controls · System and Communications Protection
SC.2.002 — Employ Effective Security Architecture
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
What SC.2.002 means in plain English
Design your network and systems with security baked in from the start — do not bolt it on later. This means things like defense in depth (multiple layers of protection), least privilege (give the minimum access needed), and keeping CUI systems separated from non-sensitive ones. If you are buying new equipment or setting up a new cloud service, think about how it fits into your security architecture before deploying it. A flat network where everything can talk to everything is a poor architecture.
The assessment question
“Is your network and system architecture designed with security principles such as defense in depth, network segmentation, and least privilege, rather than relying on a single point of protection?”
How to implement SC.2.002
- Document your current network architecture in a diagram showing all network segments, firewalls, servers, and key workstations. Identify any areas where segmentation is missing.
- Implement defense in depth: ensure you have protection at multiple layers — perimeter firewall, host-based firewall on each machine, endpoint antivirus, email filtering, and network monitoring.
- Segment your network so CUI systems are on a dedicated VLAN that only authorized users and services can reach. Do not mix CUI workstations with general-purpose devices on the same flat network.
- Apply least privilege to network services: disable unnecessary ports and services on all systems, remove default accounts, and ensure service accounts have minimum required permissions.
- Review architecture whenever you add new systems or services. Document any architectural decisions and their security rationale.
Evidence your assessor will ask for
- Network architecture diagram showing defense-in-depth layers and segmentation
- Documentation of security architecture design principles applied to the environment
- Evidence of multiple protection layers (firewall, endpoint, email, network)
- System hardening documentation or CIS Benchmark compliance evidence
- Architecture review records showing security was considered for new systems
Does AI prompt monitoring help with this control? Honestly, no.
SC.2.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More System and Communications Protection controls
Monitor and Protect Communications at Boundaries
SC.1.005Implement Subnetworks for Public Components
SC.2.003Separate User and System Management Functionality
SC.2.004Prevent Unauthorized Info Transfer via Shared Resources
SC.2.006Deny Network Traffic by Default
SC.2.007Prevent Remote Device Split Tunneling
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.