Allow List
What is Allow List?
A cybersecurity approach that permits only pre-approved applications, IP addresses, or entities to access a system while blocking all others by default.
Frameworks that govern allow list
What the standards actually require on allow list
Requirements naming allow list across 6 standards, quoted from the control text.
Agencies should apply allow listing to all HTTP traffic passing through their gateways.
new-zealand-information-security-manual-nzism::14.3.10.C.01 · 14.3.10.C.01 Allow listing for all gateway HTTP traffic →Discloses the device's ability to prevent, detect and remove malware: whether it can host executable software (MLDP-1); whether it supports anti-malware software or another mechanism, with any constraints on purchase, installation or configuration noted (MLDP-...
mds2-medical-device::MLDP · MLDP Malware detection and protection: disclose anti-malware support, its limits, compensating controls, allow-listing and host intrusion detection →Establish a program to harden servers, workstations, routers and other systems at levels matched to criticality, with policies and procedures for allow-listing (deny all, allow by exception).
awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::SC-10 · SC-10 Criticality-based hardening with allow-listing →As an alternative or supplement to signature anti malware, organisations may use application allow listing or sandboxing to prevent execution of unauthorised code.
CEP-MA-02 · Application Allow Listing or Sandboxing →Ensure only authorised software executes in virtual machines by maintaining an allow list and blocking unauthorised software from running.
ASBv3-AM-5 · Use only approved applications in virtual machine →An embedded device must provide protection from malicious code through means the supplier documents (such as allow-listing or signed code). No enhancement: the IIC list names RE 1 (report the protection version) only for the host device.
iec-62443::EDR 3.2 · Protection from malicious code (embedded device) →Questions people ask about allow list
What is Allow List?
Why is Allow List important for compliance?
Which compliance frameworks address Allow List?
Where can I learn more about Allow List?
See how Allow List applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.