Whitelisting (Allow List)

Also: Allow list, Allowlist, Whitelist

PCIComplianceHub · Last updated 22 September 2026

The practice of permitting only explicitly approved entities, such as IP addresses, domains or applications, and denying everything else by default. An allow list is the stronger of the two models because an unknown threat is blocked rather than permitted, which is why PCI DSS requires services, protocols and ports to be justified and approved rather than merely screened. Allow list is the current term; whitelisting is the older wording.