Back to catalog
NET-04.1NETNetwork Security
Deny Traffic by Default & Allow Traffic by Exception
Description
Mechanisms exist to configure firewall and router configurations to deny network traffic by default and allow network traffic by exception (e.g., deny all, permit by exception).
Cross-Mappings
378 paths across 4 frameworks
Cross-Mappings
NIST 800-532 mappings
NIST 800-1714 mappings
3.13.6
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.13.1
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.13.2
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.13.5
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI12 mappings
CCI-001109
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002401
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002402
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002403
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-004872
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001097
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-001098
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002395
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002398
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI-002399
0.13
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
+2 more (top 10 by confidence shown)
STIG261 mappings
SV-104277r1_ruleSymantec ProxySG must allow incoming communications only from organization-defined authorized sources routed to organization-defined authorized destinations.
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · V1R3 · disa_xccdf · related
SV-104281r1_ruleSymantec ProxySG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · V1R3 · disa_xccdf · related
SV-204954r1137551_ruleThe ALG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · V2R3 · disa_xccdf · related
SV-204954r395997_ruleThe ALG must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 2 · disa_xccdf · related
SV-205008r831385_ruleThe ALG must only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 2 · disa_xccdf · related
SV-206694r1137686_ruleThe firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · V3R3 · disa_xccdf · related
SV-206694r604133_ruleThe firewall must deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 3 · disa_xccdf · related
SV-206703r855865_ruleThe firewall must apply ingress filters to traffic that is inbound to the network through any active external interface.
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 3 · disa_xccdf · related
SV-206704r855866_ruleThe firewall must apply egress filters to traffic that is outbound from the network through any internal interface.
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 3 · disa_xccdf · related
SV-206707r855867_ruleThe premise firewall (located behind the premise router) must block all outbound management traffic.
0.50
- Secure Controls Framework · 2026.2 · scf_strm · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- DISA · 3 · disa_xccdf · related
+251 more (top 10 by confidence shown)
Control mappings provided by the Secure Controls Framework (SCF).
SCF
Powered by the Secure Controls Framework
The control catalog, cross-mappings, and STRM relationship data shown here are provided by the Secure Controls Framework (SCF), 2026.2. Every mapping is credited to SCF as the methodology, with the SCF reference and version stored alongside it.
© SCF Council, LLC. Secure Controls Framework content is free and shown here with attribution. securecontrolsframework.com · About SCF on STIGViewer