Reference: CMMC 1.02
Level Introduced: 4
Utilize threat intelligence to proactively block DNS requests from reaching malicious domains.
As part of collecting threat intelligence from a variety of sources such as government, industry peer organizations, or commercial services, use the known, bad domain names to feed security mechanisms (e.g., DNS servers or firewalls). Implement checks in the organizationâ€™s system to ensure devices making DNS calls to malicious sites are blocked from getting to those sites. This practice explicitly requires the use of threat intelligence in its application. This differs from the DNS filtering in practice SC.3.192 that allows for other means of creating the filters.
You are responsible for network security for your organization and participate in the National Defense Information Sharing and Analysis Center (ND-ISAC) working groups. You subscribe to automated feeds from ND-ISAC and electronic sharing with your peers to learn about new malware sites and update your DNS server to black hole access to them.