How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena adds the assessor-facing submission layer that almost none of them ship: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and cryptographic provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

What does CMMC 3.13.5 require?

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. In plain terms: anything reachable from the internet (web servers, public services) must sit in a separated subnetwork — a DMZ — not on the same internal LAN as your CUI and internal systems.

Do I need a DMZ if I don't host public servers?

If you have no publicly accessible system components, objective [a] (identifying them) results in 'none,' and there's nothing to separate. But be honest about what's public — a self-hosted web app, VPN concentrator, or mail relay can count. If anything is internet-facing, it belongs in a separated subnetwork.

How many SPRS points is 3.13.5 worth?

3.13.5 carries a weighted deduction under the DoD Assessment Methodology. Confirm the exact current weighting against the official methodology.

CMMC 3.13.5 (Public Subnetwork Separation): Evidence & What Assessors Actually Check

Control: NIST SP 800-171 Rev. 2 §3.13.5 · CMMC Practice: SC.L2-3.13.5 · Updated June 2026

Plain-English answer

3.13.5 requires you to put publicly accessible system components in subnetworks physically or logically separated from your internal networks — a DMZ. Two steps: identify what's internet-facing, then make sure it doesn't share a network segment with your internal systems and CUI.

Who this applies to

Every organization seeking CMMC Level 2 for a CUI environment — most directly anyone hosting internet-facing services (web, mail relay, VPN, remote-access gateways).

Why it matters

Public-facing systems get attacked first. Separating them means a compromised web server can't pivot straight onto the network holding your CUI. It carries a weighted SPRS deduction if unmet (verify the exact value against the DoD Assessment Methodology).

Control lineage

CMMC Practice: SC.L2-3.13.5
NIST 800-171 Rev. 2: §3.13.5 — implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
NIST 800-171A objectives: [a] publicly accessible system components are identified; [b] subnetworks for publicly accessible system components are physically or logically separated from internal networks.

What the assessor will EXAMINE

A list of publicly accessible system components (or a documented "none").
Network diagram showing those components in a separated subnetwork / DMZ.
Firewall/VLAN configuration enforcing the separation between the DMZ and internal networks.
SSP narrative for 3.13.5.

What the assessor will INTERVIEW & TEST

Interview: "What's publicly accessible, and how is it separated from your internal network?" — point to the inventory + diagram + segmentation rules.
Test: Confirm the DMZ segment can't freely initiate connections into the internal network.
Test: Reconcile the public-component list against what's actually internet-reachable (no surprise exposed hosts).

Evidence examples (produce these)

Inventory of publicly accessible components (or documented "none applicable" with rationale).
Network diagram showing DMZ separation from internal networks.
Firewall/VLAN/ACL config enforcing DMZ-to-internal restrictions.
SSP section 3.13.5 referencing the above.

Common failure patterns

A public web/mail server on the same flat LAN as internal systems — objective [b] fails.
Public components never inventoried, so exposure is unknown — objective [a] fails.
A "DMZ" that can still reach internal hosts at will — separation in name only.
Shadow internet-facing services (a forgotten port-forward) not in the inventory.

SPRS impact & POA&M

SPRS: 3.13.5 carries a weighted deduction (verify the exact value). POA&M: confirm 3.13.5's POA&M eligibility against current CMMC rules before assuming it can be deferred.

Assessor-ready summary

You're good on 3.13.5 when every publicly accessible component is identified and sits in a subnetwork physically or logically separated from internal networks, the separation is enforced by configuration (not just drawn on a diagram), and the SSP matches reality.

Is anything internet-facing sharing a segment with your CUI? Get a segmentation evidence map →

Athena prepares organizations for CMMC Level 2; certification rests with C3PAOs/DIBCAC. Verify all control facts against NIST SP 800-171 Rev. 2, NIST SP 800-171A, and current CMMC rules.