The IPS must enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.

Restricting the flow of communications traffic, also known as information flow control, helps prevent unauthorized access. Upon detecting malicious traffic or an anomaly, the IPS must be configured to drop, block, or redirect this traffic based on organization-defined actions in the site's security plan and the device's capabilities. This requirement also applies to Zero Trust initiatives.

If the device being reviewed is an IDS, this is not applicable. Verify the IPS enforces approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network. If the IPS does not enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network, this is a finding.

Configure the IPS to enforce approved authorizations by restricting or blocking the flow of harmful or suspicious communications traffic within the network.