SC-07(11) Restrict Incoming Communications Traffic
All changes in this version
Title
Restrict Incoming Communications Traffic
Control
Only allow incoming communications from [Assignment: authorized sources] to be routed to [Assignment: authorized destinations].
Discussion
General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.
Parameters
sc-07.11_odp.01: authorized sources
sc-07.11_odp.02: authorized destinations
Related controls
ac-3
Assessment objective
SC-07(11) only incoming communications from [Assignment: authorized sources] are allowed to be routed to [Assignment: authorized destinations].
STIG rules that implement this control 0
No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).