The scenario describes using a distinct IP subnet (192.168.50.0/24) to create a separate network segment for the engineering department. This practice is a form of logical separation. While the servers share a physical location, network controls like firewalls, Access Control Lists (ACLs), and Virtual Local Area Networks (VLANs) are configured to enforce boundaries. These configurations restrict traffic flow between the engineering segment and other parts of the network, thereby creating logical isolation for the engineering resources. This directly aligns with the CMMC practice of controlling information flow.

B. Physical barriers within the data center: This is incorrect because the question explicitly states the servers are in a shared data center and isolated logically, not through physical means like separate cages or rooms.

C. Encryption of engineering data at rest: This is incorrect because encryption protects the confidentiality of data on storage media. It does not create network-level isolation or control traffic flow between network segments.

D. Requirement of a security badge to access the data center: This is a physical access control for the entire facility. It does not segment the network or create logical isolation for a specific department's digital resources.

---

1. NIST Special Publication 800-171, Revision 2, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations."

Section 3.1, Access Control, Control 3.1.3: The discussion for this control, which requires controlling the flow of CUI, states that flow control is achieved by "separating CUI into separate subnets with firewalls or other boundary protection devices." This directly supports the concept of using network segmentation (subnets) for logical separation.

Section 3.13, System and Communications Protection, Control 3.13.1: The discussion mentions that access control policies can be implemented at "the operating system, and network levels (e.g., through the use of access control lists in routers and firewalls and separate subnets for CUI)." This explicitly links subnets to network-level access control and isolation.

2. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Control SC-7, Boundary Protection: The discussion section for this control states, "Boundaries can be physical (e.g., controlled physical perimeters) or logical (e.g., virtual private networks, VLANs, or network firewalls)." It further elaborates on establishing boundaries for "publicly accessible systems, demilitarized zones, and systems containing CUI." This source clearly defines the use of network configurations to create logical boundaries.

3. CMMC Model Version 2.0, "Cybersecurity Maturity Model Certification (CMMC) Model," December 2021.

Practice AC.L2-3.1.3 (Control the flow of CUI): The description for this practice involves implementing security mechanisms to manage and control how CUI flows through the network. The primary method for achieving this is through logical segmentation using tools like firewalls and routers to create isolated network segments, as described in the question's scenario.