CCI-004872

Defines the systems that will deny network communications traffic by default and allow network communications traffic by exception.

Implementation Guidance

Determine if: - network communications traffic is denied by default [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}]. - network communications traffic is allowed by exception [SC-07(05)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {at managed interfaces; for [SC-07(05)_ODP[02]; systems for which network communications traffic is denied by default and network communications traffic is allowed by exception are defined (if selected)]}].

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; procedures addressing boundary protection; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with boundary protection responsibilities]. Test: [SELECT FROM: Mechanisms implementing traffic management at managed interfaces].

The controls below (if any) were marked by NIST as being related to CCI-004872.