3.13.6

Requirement

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Discussion

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, permit-by-exception network communications traffic policy ensures that only those connections which are essential and approved are allowed.

NIST 800-171A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing boundary protection; security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].
Interview

[SELECT FROM: System or network administrators; personnel with information security responsibilities; system developer; personnel with boundary protection responsibilities].
Test

[SELECT FROM: Mechanisms implementing traffic management at managed interfaces].

ID	Assessment Objectives
3.13.6[a]	Network communications traffic is denied by default.
3.13.6[b]	Network communications traffic is allowed by exception.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!