Logical separation refers to the use of technical and access control mechanisms (e.g., role-based access, IAM tools, VLANs) to enforce boundaries between different users, roles, or networks. In contrast, physical separation relies on distinct hardware or physical barriers. Role-based access control within an IAM solution is a textbook example of logical separation, and it is specifically called out in the CMMC/NIST context.
Exact extracts:
“Logical separation may be achieved through the use of virtualization, encryption, or access control mechanisms such as role-based access controls.”
“Assessment Objectives … Determine if: • separation of users and information types is enforced by physical or logical means.”
“Logical separation is implemented using technical solutions such as access control lists, firewalls configured by policy, or identity and access management solutions.”
Why the other options are incorrect:
A (Data loss alerting): This is monitoring, not separation.
B (Badge access): This is a physical access control, not logical separation.
D (Proxy-configured firewall): This is boundary protection/traffic control; depending on setup it may be physical or logical, but the scenario points to role-based IAM as the logical example.
References (CCA documents / Study Guide):
CMMC Assessment Guide – Level 2, SC.L2-3.13.6 “Network Separation.”
NIST SP 800-171 Rev. 2, 3.13.6.
