A CCA is asked to validate if an OSC has separated their systems containing CUI...

To validate separation of CUI systems from non-CUI systems on a local network, the assessor must evaluate the VLAN configuration. VLANs are a recognized logical segmentation method for separating enclaves, as defined in the CMMC Scoping Guide.

Exact Extracts:

CMMC Scoping Guide: “Isolation can be achieved by implementing subnetworks with firewalls, routers, and VLANs to ensure separation of CUI assets from out-of-scope assets.”

“CUI Assets must be isolated from non-CUI assets unless those non-CUI assets are designated as Security Protection Assets or Contractor Risk Managed Assets.”

Why other options are not correct:

A (WAN): Wide Area Networks describe external connectivity, not local separation.

B (VPN): VPN provides encrypted remote access but does not enforce local network segmentation.

D (NAT): NAT provides IP translation, not logical separation of traffic.