SC4: Outbound traffic from servers must be limited to that required to properly operate the service, whether the system is managed directly by Harvard or via contract with a third-party service provider for Harvard's use (e.g. IaaS, SaaS).
The firewall between the Level 4 server and networks that include user computers must be configured to only permit outbound traffic that is required properly operate the service provided by the Level 4 server
