With all due respect, it’s from NIST’s guidance

BTW, it might be more inclusive language to use “allow list” and “block list”