Whitelisting (Allow List)
Also: Allow list, Allowlist, Whitelist
PCIComplianceHubLast updated
The practice of permitting only explicitly approved entities, such as IP addresses, domains or applications, and denying everything else by default. An allow list is the stronger of the two models because an unknown threat is blocked rather than permitted, which is why PCI DSS requires services, protocols and ports to be justified and approved rather than merely screened. Allow list is the current term; whitelisting is the older wording.
Applies to. Allow listing is the model PCI DSS v4.0.1 writes into Requirement 1: network security controls must restrict inbound and outbound traffic to what is necessary and specifically deny the rest, and each service, protocol and port in use must be identified, approved and given a business justification. The same model appears in the payment page script controls under Requirement 6, where every script that loads in the consumer's browser must be authorised, have its integrity assured and be recorded in an inventory with a justification.
Related. Block List (Blacklist), Network Security Control (NSC), Script Authorization, Script Inventory, Firewall Rule
Sources. PCI DSS v4.0.1 (June 2024)