Block List (Blacklist)
Also: Block list, Blocklist, Deny list
PCIComplianceHubLast updated
A list of entities, such as IP addresses, domains or applications, that are denied access to a system because they are known or suspected to be malicious. Block lists are reactive: anything not listed is permitted, so they cannot catch a threat that has not been seen before. Block list and allow list are the current terms; the older blacklist and whitelist wording is being retired across the industry and in PCI SSC documentation.
Applies to. PCI DSS v4.0.1 does not ask for block lists by name, and its own rule model runs the other way: network security controls under Requirement 1 must permit only the traffic that is necessary and deny everything else, and the services, protocols and ports in use must be identified, approved and justified. Where a block list does appear it is as a supporting layer, for example the anti-malware solution under Requirement 5 detecting all known types of malware, which in general terms is a block list of known-bad code.
Related. Whitelisting (Allow List), Anti-Malware, Network Security Control (NSC), Firewall Rule, Ingress Filtering
Sources. PCI DSS v4.0.1 (June 2024)