CA-3 (5)

CA-3 (5) H M

The organization employs [Selection: allow-all, deny-by-exception; deny-all, permit-by-exception] policy for allowing [Assignment: organization-defined information systems] to connect to external information systems.

  • H CA-3 (5) [deny-all, permit by exception] [any systems]
Supplemental Guidance

Organizations can constrain information system connectivity to external domains (e.g., websites) by employing one of two policies with regard to such connectivity: (i) allow-all, deny by exception, also known as blacklisting (the weaker of the two policies); or (ii) deny-all, allow by exception, also known as whitelisting (the stronger of the two policies). For either policy, organizations determine what exceptions, if any, are acceptable.

Further Guidance

CA-3 (5) Guidance: For JAB Authorization, CSPs shall include details of this control in their Architecture Briefing

Related Controls