Skip to content
ControlVerdict
Sign in
SC.L2-3.13.6CMMC Level 2Level 2

Network Communication By Exception

Submit your own example

Practice statement

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.13.6.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    network communications traffic is denied by default; and

    1 example covers this

  2. [b]

    network communications traffic is allowed by exception.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    SC.L2-3.13.6Network Communication By Exception
    Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

    • [a]

      network communications traffic is denied by default; and

    • [b]

      network communications traffic is allowed by exception.

    Default-deny rulebases north-south and east-west, with exceptions that expire

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Network Communication By Exception objectives: deny by default, allow by exception.

    Deny by default [a]. Every rulebase ends in an explicit deny-all-and-log rule, and the implicit deny is never relied on for evidence. This applies to inbound internet, outbound internet from the enclave, and east-west between segments. Cloud security groups start from an empty ingress set; a resource that gets no rule gets no traffic.

    Allow by exception [b]. A permit rule exists only if a ticket exists. The ticket records requester, business justification, source, destination, port, whether CUI traverses the path, approver (someone other than the requester), and an expiry date. Rules are named with the ticket ID so an auditor can walk from any line in the rulebase back to its authorization.

    Outbound is treated like inbound. Enclave egress is an FQDN and IP allow-list covering SaaS apps, OS and AV update services, and the two supplier SFTP hosts. Everything else is denied and logged, which is also how the organization notices unexpected software phoning home.

    Change discipline. Nightly config backup with a diff alert to the network channel. A rule that appears without a matching ticket generates a review item the next business morning, including rules added during an incident, which are reconciled within 24 hours.

    Maintenance. Monthly expiry sweep: rules past their date are disabled first and removed after a week's grace. Quarterly hit-count review; zero-hit rules over 90 days are proposed for removal. Semi-annual reconciliation of the rulebase against the exception register.

    Accepted gap. One legacy building-automation controller needs broad outbound access to a vendor cloud that publishes no stable address list. It sits on a non-CUI VLAN with no route to the enclave, and its traffic is logged even though it is not narrowly filtered.

    What the evidence looks like

    • Firewall and security group exports showing the terminal deny-all-and-log rule
    • Sample permit rules with ticket IDs in the rule names, matched to their tickets
    • Enclave egress allow-list with justification per destination
    • Config diff alert history and a reconciled emergency-change ticket
    • Monthly expiry sweep and quarterly hit-count review records

    Environment

    ~250-staff supplier with two sites, an edge firewall pair per site, and cloud security groups for the enclave spoke.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.