SFS 5: Networking and VPNs
Assess network boundaries, segmentation, remote connectivity, and traffic controls, including VPNs, security groups, and zero-trust access policies.
Scope and boundaries
This set covers how devices and services communicate within a system and across external boundaries. It includes network inventories, routing, firewall and security-group rules, protected remote access, VPN configuration, and review of allowed connections. Questions should identify the relevant network paths and the evidence that demonstrates an enforced restriction or approved connection. Identity decisions belong to SFS 3, application-level protocol behavior to SFS C, and detection and response to SFS 6.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0050 |
| 1 | SF 1 | 0051 |
| 2 | SF 2 | 0052 |
| 3 | SF 3 | 0053 |
| 4 | SF 4 | 0054 |
| 5 | SF 5 | 0055 |
| 6 | SF 6 | 0056 |
| 7 | SF 7 | 0057 |
| 8 | SF 8 | 0058 |
| 9 | SF 9 | 0059 |
| A | SF A | 005A |
| B | SF B | 005B |
| C | SF C | 005C |
| D | SF D | 005D |
| E | SF E | 005E |
| F | SF F | 005F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.