SC-7(5): Deny By Default / Allow By Exception
Control Family:
Parent Control:
Threats Addressed:
Baselines:
- Moderate
- High
Next Version:
- NIST Special Publication 800-53 Revision 5:
- SC-7(5): Deny by Default – Allow by Exception
Control Statement
The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
Supplemental Guidance
This control enhancement applies to both inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those connections which are essential and approved are allowed.