The IPS must enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-206864 | SRG-NET-000018-IDPS-00018 | SV-206864r1137714_rule | CCI-001368 | medium |
| Description | ||||
| Restricting the flow of communications traffic, also known as information flow control, helps prevent unauthorized access. Upon detecting malicious traffic or an anomaly, the IPS must be configured to drop, block, or redirect this traffic based on organization-defined actions in the site's security plan and the device's capabilities. This requirement also applies to Zero Trust initiatives. | ||||
| STIG | Date | |||
| Intrusion Detection and Prevention Systems Security Requirements Guide | 2025-09-22 | |||
Details
Check Text (C-206864r1137714_chk)
If the device being reviewed is an IDS, this is not applicable.
Verify the IPS enforces approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.
If the IPS does not enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network, this is a finding.
Fix Text (F-7118r1137713_fix)
Configure the IPS to enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.