Home NIST Guidelines SC-15(2)
SC-15(2) System and Communications Protection

Blocking Inbound and Outbound Communications Traffic

High Risk Moderate Medium Cost

SC-15(2) (Blocking Inbound and Outbound Communications Traffic) enhances base SC-15 within the NIST System and Communications Protection family. Base SC-15 sets the foundational expectation; this enhancement adds specificity: This enhancement strengthens SC-15 with requirements for blocking inbound and outbound communications traffic in environments that create, receive, maintain, or transmit ePHI. Covered entities and business associates apply it to boundary protection, cryptography, and communications safeguards for clinical networks and ePHI flows.

Control Objective

Implement Blocking Inbound and Outbound Communications Traffic so organization-defined system and communications protection safeguards operate consistently on systems and networks that handle ePHI, with measurable evidence for HIPAA and NIST assessments.

Implementation Guidance

  1. Map SC-15(2) to systems in scope (EHR, imaging, lab, pharmacy, billing, identity, backups, and BA connections).\n2. Translate “Blocking Inbound and Outbound Communications Traffic” into technical settings, procedures, or architecture patterns owned by named roles.\n3. Prefer enforceable controls (config, automation, mediation) over awareness-only measures where feasible.\n4. Integrate with change, incident, and downtime processes so clinical operations are not surprised.\n5. Log and retain evidence of operation (tickets, configs, test results) aligned to audit needs.\n6. Include vendors/BAs in contracts and connection standards when they touch the control surface.\n7. Test after major EHR, network, or cloud changes — upgrades often reset protections.\n8. Review exceptions at least quarterly; expire “temporary” holes that expose ePHI paths.

Real-World Use Cases

How this control shows up in healthcare and HIPAA-covered environments.

Real-world scenario

Clinical ops apply “Blocking Inbound and Outbound Communications Traffic” (SC-15(2))\nHospital implements Blocking Inbound and Outbound Communications Traffic so ePHI systems stay within approved boundary protection, cryptography, and communications safeguards for clinical networks and ePHI flows. Evidence labeled for SC-15(2).\n\n### BA / vendor touchpoint (SC-15(2))\nContracted support must follow Blocking Inbound and Outbound Communications Traffic when connecting to systems that store or process ePHI. Evidence labeled for SC-15(2).\n\n### Audit sample (SC-15(2))\nInternal audit samples evidence that Blocking Inbound and Outbound Communications Traffic operates in production — not only in a policy binder. Evidence labeled for SC-15(2).

Best Practices

  • Name an owner for SC-15(2) in the SSP control matrix.\n- Favor system enforcement on ePHI paths over informal email approval.\n- Measure coverage: percent of in-scope clinical systems where the enhancement operates.\n- Review exceptions quarterly with security and clinical informatics.\n- Feed relevant events to SIEM with a named use case.\n- Keep a one-page evidence pack (config + sample log + last test) ready for assessors.

Common Gaps & Violations

  • Policy cites SC-15(2) but production EHR/network paths show no enforcement of blocking inbound and outbound communications traffic.\n- Permanent exceptions with no expiry for vendors or “special” clinics.\n- Control implemented only on corporate IT — clinical devices and interfaces omitted.\n- No logs or test records; reliance on tribal knowledge.\n- Major upgrade silently disabled the enhancement.

Required Documentation

  • Procedure/standard for Blocking Inbound and Outbound Communications Traffic (SC-15(2))\n- Architecture or configuration baselines showing enforcement points\n- Exception register with owners and expiry\n- Sample logs, alerts, or test results\n- Training or runbook references for clinical/IT operators

How to Test & Validate

  1. Attempt a prohibited or out-of-policy action related to blocking inbound and outbound communications traffic; confirm block, alert, or required workflow.\n2. Complete an authorized clinical/IT path; confirm success and logging.\n3. Sample open exceptions for approval and expiry.\n4. Verify at least one EHR-adjacent and one BA/vendor path are in scope.\n5. Confirm evidence retained for the last 90 days (or per policy).

Audit Considerations

Assessors look for operating evidence of Blocking Inbound and Outbound Communications Traffic on systems touching ePHI — configs, logs, restore/DR artifacts, or failed-test results — not only a policy paragraph referencing SC-15(2).

HIPAA Mapping

How this NIST control supports HIPAA Security Rule expectations.

  • 164.312(e)(1) Transmission Security — guard against unauthorized access to ePHI in transit.\n- 164.312(a)(1) Access Control — technical policies that limit system access to ePHI.\n- 164.312(c)(1) Integrity — protect ePHI from improper alteration or destruction.\n- 164.308(a)(1)(ii)(B) Risk Management — network and crypto controls reduce residual risk to ePHI.

Compliance Tips

  • List SC-15(2) explicitly in the system security plan with system inventory references.\n- Prioritize emergency department, inpatient EHR, and remote access paths first.\n- Bundle evidence with related HIPAA contingency or transmission-security narratives where they overlap.

References & Resources

  • NIST SP 800-53 Rev. 5 — SC-15(2)\n- Related controls: SC-15

Related Guidelines

Related controls that commonly accompany SC-15(2).

SC-15 Medium

Collaborative Computing Devices

SC-15 requires prohibiting or restricting remote activation of collaborative computing devices and providing physical/logical indicators of…
SC-1 High

System and Communications Protection Policy and Procedures

SC-1 requires system and communications protection policy and procedures addressing purpose, scope, roles, management commitment…
SC-10 Medium

Network Disconnect

SC-10 requires terminating the network connection associated with a communications session at the end of the session or after…

Need Help Implementing SC-15(2)?

Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.

Contact Our Experts View All Guidelines