Requirement text: SC.3.183: Deny network communications traffic by default and allow network
communications traffic by exception (i.e., deny all, permit by exception).
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
This requirement applies to inbound and outbound network communications traffic at the
system boundary and at identified points within the system. A deny-all, permit-by-exception
network communications traffic policy ensures that only those connections which are
essential and approved are allowed.
CMMC CLARIFICATION
Block all traffic going into and coming out of the network, but permit specific traffic into and
coming out based on the organization’s policies, exceptions, or criteria. This process of
permitting only authorized traffic to the network is called whitelisting which limits the
number of unintentional connections to the network.
Example
You are the IT administrator setting up a new environment to house the company’s CUI. You
install firewalls between this environment and the other networks of the company with
firewall rules that deny all traffic. You go through each service and application that runs in
the new environment and only allow the required ports and network paths to be opened.
You test the functionality of the required services and applications to make sure they work.
You comment each firewall rule so there is documentation why it is required.
You review the firewall rules on a regular basis to make sure there were no unauthorized
changes made (e.g., during troubleshooting of networking issues).
References
• NIST SP 800-171 Rev 1 3.13.6
• NIST SP 800-53 Rev 4 SC-7(5)