NIST 800-171 Controls · System and Communications Protection

SC.2.006 — Deny Network Traffic by Default

CMMC Level 2SPRS if unmet: -3HIGH priority~6h to implement

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

What SC.2.006 means in plain English

Your firewall should start by blocking everything and then you open up only the specific traffic you need. Do not start with "allow all" and try to block the bad stuff — you will miss something. For example, allow outbound web traffic on ports 80 and 443, allow your VPN port, allow email ports, and block everything else. This applies to both your network firewall and the Windows firewall on each machine. If you cannot explain why a port is open, close it.

The assessment question

“Are your firewalls (network and host-based) configured with a default-deny policy that blocks all traffic except for specifically authorized and documented exceptions?”

How to implement SC.2.006

On your network firewall (pfSense, Ubiquiti, etc.), set the default rule on every interface to DENY ALL. Then add specific allow rules above it for traffic that is needed.
Document each firewall allow rule with a business justification: "Allow outbound TCP 443 from internal VLAN to any — required for web browsing and cloud services."
On Windows workstations, verify Windows Defender Firewall is set to block inbound connections by default: Windows Security > Firewall & Network Protection > verify all profiles show "Firewall is on" and inbound connections are blocked.
Audit your firewall rules quarterly: remove any rules that no longer have a valid business need. Stale rules are security holes.
Test your deny-default configuration by attempting to connect on a port you have not explicitly allowed — it should be blocked.

Evidence your assessor will ask for

Firewall configuration showing default-deny rule as the last rule on each interface
Documented firewall rule set with business justification for each allow rule
Windows Defender Firewall configuration screenshot showing inbound blocked by default
Quarterly firewall rule audit records
Port scan test results confirming unauthorized ports are blocked

Does AI prompt monitoring help with this control? Honestly, no.

SC.2.006 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More System and Communications Protection controls

SC.1.001

Monitor and Protect Communications at Boundaries

SC.1.005

Implement Subnetworks for Public Components

SC.2.002

Employ Effective Security Architecture

SC.2.003

Separate User and System Management Functionality

SC.2.004

Prevent Unauthorized Info Transfer via Shared Resources

SC.2.007

Prevent Remote Device Split Tunneling

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment