Requirement 7.2.3

Default “deny-all” setting