03.13.06 Network Communications – Deny by Default – Allow by Exception

Statement

Deny network communications traffic by default, and allow network communications traffic by exception.

Guidance

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, allow-by-exception network communications traffic policy ensures that only essential and approved connections are allowed.

Assessment objective

network communications traffic is denied by default.

Assessment objective

network communications traffic is allowed by exception.

Assessment method

• system and communications protection policy and procedures procedures for boundary protection system design documentation system configuration settings system audit records system security plan other relevant documents or records

Assessment method

• personnel with boundary protection responsibilities personnel with information security responsibilities system developers system administrators

Assessment method

• mechanisms for implementing traffic management at managed interfaces

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

Свързани задачи

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final