The organization employs [one of "allow-all, deny-by-exception"/"deny-all, permit-by-exception"] policy for allowing [one of ] to connect to external information systems.
Supplemental
Organizations can constrain information system connectivity to external domains (e.g., websites) by employing one of two policies with regard to such connectivity: (i) allow-all, deny by exception, also known as blacklisting (the weaker of the two policies); or (ii) deny-all, allow by exception, also known as whitelisting (the stronger of the two policies). For either policy, organizations determine what exceptions, if any, are acceptable.