CMMC Practice SC.L2-3.13.6

Network Communication by Exception: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Monarch ISC Guidance

An organization must practice the "least functionality" posture to system and device configuration and deployment, require it by policy, and have a plan to implement consistently. Start with deny-all, and build the list of acceptable functionality. In the case of a firewall, a list of allowed traffic in BOTH directions is built according to business need, with a final DENY ALL which prevents traffic not previously allowed. It is not permissible to have an "any any" rule to allow all traffic outbound from your internal network to the internet.
Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Understand your gaps
Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Validate NIST SP 800-171
Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Build a plan of action
Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Build your policy
Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, permit-by-exception network communications traffic policy ensures that only those connections which are essential and approved are allowed.

References