8.6

4.4.3.2 The organization shall develop and maintain a list of their information systems and assets. For any information systems and assets not included in their implementation of the baseline cyber security controls, the organization shall document all instances where they make the business decision not to do so.

5.7.3.1 The organization shall have a firewall placed between two perimeters that controls the amount and kinds of traffic that may pass between the two.