A control boundary is the defined scope of a security assessment: the systems, users, applications, devices, and data flows that are included when evaluating whether controls are working. Anything inside the boundary must be managed, monitored, and evidenced; anything outside it is not part of that review.
This matters because security claims are only meaningful if the scope is clear. In CMMC, for example, a supplier may need to show exactly where Controlled Unclassified Information is stored, processed, or transmitted. If remote support tools, firmware update paths, subcontractor links, or cloud services are omitted from the boundary, attackers may exploit those gaps and auditors may reject the assessment. Defenders use control boundaries to reduce ambiguity, keep evidence consistent, and avoid “scope creep” that weakens compliance and hides risk.