SC.L2-3.13.6
Network Communication by Exception
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee SC.L2-3.13.6 in the reference catalog with its NIST cross-references
Official requirement
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Assessment objectives
a. network communications traffic is denied by default; and
b. network communications traffic is allowed by exception.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Deny network communications by default and allow them by exception.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are setting up a new environment to house CUI. To properly isolate the CUI network, you install a firewall between it and other networks and set the firewall rules to deny all traffic [a]. You review each service and application that runs in the new environment and determine that you only need to allow http and https traffic outbound [b]. You test the functionality of the required services and make some needed adjustments, then comment each firewall rule so there is documentation of why it is required. You review the firewall rules on a regular basis to make sure no unauthorized changes were made.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): System and communications protection policy; procedures addressing boundary protection; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records
Common mistakes
Maintaining broad allow rules without a documented and enforced business exception.