03.13.06: Network Communications — Deny by Default — Allow by Exception
Control Family:
Threats Addressed:
Previous Version:
- NIST Special Publication 800-171 Revision 2:
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
Requirements
- Deny network communications traffic by default, and allow network communications traffic by exception.
Discussion
This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, allow-by-exception network communications traffic policy ensures that only essential and approved connections are allowed.