anchor.diff:  $ cf bind-security-group SECURITY-GROUP ORG SPACE
   </pre>
   
  +To bind an ASG to all of an organization’s existing spaces, run the command below. The `cf bind-security-group` command requires cf CLI 6.20.0 or higher.
  +
   <pre class="terminal">
   $ cf bind-security-group SECURITY-GROUP ORG
   </pre>
   
  -To apply staging-level network access to space-scoped ASGs, use the following CloudController (CC) API commands:
  -
  -<pre>
  -GET /v2/security_groups/:guid/staging_spaces
  -PUT /v2/spaces/:guid/staging_security_groups/:security_group_guid data
  -PUT /v2/security_groups/:guid/staging_spaces/:space_guid
  -DELETE /v2/spaces/:guid/staging_security_groups/:security_group_guid  data
  -DELETE /v2/security_groups/:guid/staging_spaces/:space_guid
  -</pre>
  -
  -These API calls require administrator access. 
  -
  -Additionally, the payload returned from API `GET` calls to
  -`/v2/spaces/` and `/v2/spaces/:guid` includes a link to the 
  -`staging_security_groups_url`.
  -
  -For more information on using these CC API commands, see the [Cloud Foundry API](https://apidocs.cloudfoundry.org/) documentation.
  -
  -### <a id='unbinding-groups'></a>Unbind ASGs 
  -
  -<p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started apps until you restart them. 
  -To restart all of the apps in an org or a space, 
  -use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  +## <a id='unbinding-groups'></a>Unbinding ASGs ##
  +
  +<p class='note'><strong>Note</strong>: Unbinding an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
   
   To unbind an ASG from the `default-staging` set, run the following command:
   
  
positive.code: private network ASGs as appropriate. It may be helpful to use a naming
  convention with `private_networks` as part of the ASG name, such as `private_networks_databases`.
  
  <p class='note'><strong>Note</strong>: Be sure to exclude any private networks and IP addresses 
  that containers should not have access to. </p>
  
  Example `private_networks` ASG:
  
  
negative.code: | `description`   |An optional text field for operators managing security group rules. <%= vars.asg_desc %>
  
  
  Follow the instructions in the sections below to create [individual ASGs](#asg-individual) and [baseline ASGs](#asg-baseline).
  
  ###<a id='asg-individual'></a>Create Individual ASGs
  
  To create individual ASGs, perform the following steps:
  
  1. Create a **rules** file: a JSON-formatted single array containing objects that describe the rules. Refer to the example below, which allows ICMP traffic of code `1` and type `0` to all destinations, and TCP traffic to `10.0.11.0/24` on ports `80` and `443`:
  
      <pre>
      [
  