# NIST800 171 3.13.6 — Network Communications - Deny by Default - Allow by Exception

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist800171_3136_263e8e5059-nist800-171-3136-network-communications-deny-by-default-allow-by-exception
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST SP 800-171 Readiness](https://support.icompaas.com/support/solutions/c_gen_nist800171) › [Situational Awareness](https://support.icompaas.com/support/solutions/folders/f_gen_cgennist800171_situationalawareness)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 171 · Control 3.13.6 · Priority: critical · Component: Situational Awareness

### What this control covers

This control mandates denying all network communications traffic by default and allowing traffic only by exception. It applies to both inbound and outbound traffic at the system boundary and within identified system points, ensuring that only essential and approved connections are permitted. This control supports the Traffic Control System capability within the Situational Awareness (3.13) family.

### Why it matters

A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.

### How to implement

#### AWS

Segment workloads into separate **VPCs/accounts per environment**. Use **security groups** as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and **VPC Flow Logs** to CloudWatch/S3. Front public services with **AWS WAF + Shield Advanced** and use **PrivateLink/VPC Endpoints** to keep service traffic off the internet.

#### Azure

Use **Network Security Groups** and **Application Security Groups** for east-west, and an **Azure Firewall** or NVA in a hub VNet for north-south. Enforce **Private Endpoints** for PaaS and turn on **Defender for Cloud — Network** for adaptive hardening recommendations.

#### GCP

Use **VPC Service Controls** to draw a perimeter around sensitive APIs and a hierarchical **Firewall policy** at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global **Cloud Load Balancer + Cloud Armor**.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Network Communications - Deny by Default - Allow by Exception.

### Quick checklist

-   Configuration — Management / Configuration
-   System — Management / Configuration
-   Security — Management / Configuration
-   Boundary — Management / Configuration
-   Network — Management / Configuration

### Related articles on this site

-   [NIST 800-171 3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).](https://support.icompaas.com/support/solutions/articles/62000229261-nist-800-171-3-13-6-deny-network-communications-traffic-by-default-and-allow-network-communications-t)
-   [CMMC 2.0 SC.3.183 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).](https://support.icompaas.com/support/solutions/articles/62000229744-cmmc-2-0-sc-3-183-deny-network-communications-traffic-by-default-and-allow-network-communications-tra)
-   [NIST 800-171 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.](https://support.icompaas.com/support/solutions/articles/62000229232-nist-800-171-3-14-6-monitor-organizational-systems-including-inbound-and-outbound-communications-tra)
-   [CMMC 2.0 SI.2.216 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.](https://support.icompaas.com/support/solutions/articles/62000229427-cmmc-2-0-si-2-216-monitor-organizational-systems-including-inbound-and-outbound-communications-traff)

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.