What this control covers
This control mandates denying all network communications traffic by default and allowing traffic only by exception. It applies to both inbound and outbound traffic at the system boundary and within identified system points, ensuring that only essential and approved connections are permitted. This control supports the Traffic Control System capability within the Situational Awareness (3.13) family.
Why it matters
A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.
How to implement
AWS
Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.
Azure
Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.
GCP
Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Network Communications - Deny by Default - Allow by Exception.
Quick checklist
- Configuration — Management / Configuration
- System — Management / Configuration
- Security — Management / Configuration
- Boundary — Management / Configuration
- Network — Management / Configuration
Related articles on this site
- NIST 800-171 3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- CMMC 2.0 SC.3.183 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- NIST 800-171 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
- CMMC 2.0 SI.2.216 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.