CCI-001108

The organization removes traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to remove traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as a sampling of existing exceptions to ensure the organization being inspected/assessed removes traffic flow policy exceptions that are no longer supported by an explicit mission/business need for each external telecommunication service.

Compelling Evidence

1.) Signed and dated traffic flow policy. 2.) Process documentation that reviews exceptions to the traffic flow policy.

The controls below (if any) were marked by NIST as being related to CCI-001108.