Network Communications – Deny by Default – Allow by Exception (03.13.06)_network-communications-deny-by-default-allow-by

Network Communications – Deny by Default – Allow by Exception (03.13.06) Network Communications – Deny by Default – Allow by Exception

High-Level Description

Family: System and Communications Protection Framework: NIST SP 800-171 Rev 3 Applicability: Systems processing, storing, or transmitting CUI

Network Communications – Deny by Default – Allow by Exception

What to Check

• Verify Network Communications – Deny by Default – Allow by Exception (03.13.06) Network Communications – Deny by Default – Allow by Exception is implemented for CUI systems
• Review SSP documentation for Network Communications – Deny by Default – Allow by Exception (03.13.06)
• Validate CMMC Level 2 assessment objective for Network Communications – Deny by Default – Allow by Exception (03.13.06)
• Confirm POA&M addresses any gaps for Network Communications – Deny by Default – Allow by Exception (03.13.06)

How to Test

Step 1: Review System Security Plan

Examine the SSP for Network Communications – Deny by Default – Allow by Exception (03.13.06) implementation description and responsible parties.

Step 2: Assess Implementation

# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable

# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null

# For cloud:
# Use cloud-audit-mcp tools to assess posture

Step 3: CMMC Assessment Validation

Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.

Tools

Remediation Guide

Requirement Statement

Implement Network Communications – Deny by Default – Allow by Exception per NIST SP 800-171 Rev 3.

Supplemental Guidance

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, allow-by-exception network communications traffic policy ensures that only essential and approved connections are allowed.

Risk Assessment

CWE Categories

References

• NIST SP 800-171 Rev 3
• NIST SP 800-171A Rev 3 (Assessment)
• CMMC Model Overview
• NIST OSCAL Content

Checklist

• SSP documents Network Communications – Deny by Default – Allow by Exception (03.13.06) implementation
• Evidence of operating effectiveness collected
• POA&M addresses any gaps
• CMMC assessment objective met
• Continuous monitoring active