ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > Discussion

AC-4 Information Flow Enforcement - Discussion
Family: Access Control (AC)

Information flow control regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include blocking external traffic that claims to be from within the organization, keeping export-controlled information from being transmitted in the clear to the Internet, restricting web requests that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between organizations may require an agreement specifying how the information flow is enforced (see [CA-3](#ca-3) ). Transferring information between systems in different security or privacy domains with different security or privacy policies introduces the risk that such transfers violate one or more domain security or privacy policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between connected systems. Organizations consider mandating specific architectural solutions to enforce specific security and privacy policies. Enforcement includes prohibiting information transfers between connected systems (i.e., allowing access only), verifying write permissions before accepting information from another security or privacy domain or connected system, employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels.

Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Organizations also consider the trustworthiness of filtering and/or inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 32 primarily address cross-domain solution needs that focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, such as high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf products. Information flow enforcement also applies to control plane traffic (e.g., routing and DNS).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(1) > Discussion

AC-4(1) Object Security and Privacy Attributes - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Information flow enforcement mechanisms compare security and privacy attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. A dataset of personally identifiable information may be tagged with restrictions against combining with other types of datasets and, thus, would not be allowed to flow to the restricted dataset. Security and privacy attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security or privacy attributes can be used, for example, to control the release of certain types of information.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(1)

AC-4(1) Information Flow Enforcement | Object Security and Privacy Attributes
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Use [Assignment: organization-defined organization-defined security and privacy attributes] associated with [Assignment: organization-defined organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(2) > Discussion

AC-4(2) Processing Domains - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Protected processing domains within systems are processing spaces that have controlled interactions with other processing spaces, enabling control of information flows between these spaces and to/from information objects. A protected processing domain can be provided, for example, by implementing domain and type enforcement. In domain and type enforcement, system processes are assigned to domains, information is identified by types, and information flows are controlled based on allowed information accesses (i.e., determined by domain and type), allowed signaling among domains, and allowed process transitions to other domains.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(2)

AC-4(2) Information Flow Enforcement | Processing Domains
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(3) > Discussion

AC-4(3) Dynamic Information Flow Control - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Organizational policies regarding dynamic information flow control include allowing or disallowing information flows based on changing conditions or mission or operational considerations. Changing conditions include changes in risk tolerance due to changes in the immediacy of mission or business needs, changes in the threat environment, and detection of potentially harmful or adverse events.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(3)

AC-4(3) Information Flow Enforcement | Dynamic Information Flow Control
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Enforce [Assignment: organization-defined information flow control policies].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(4) > Discussion

AC-4(4) Flow Control of Encrypted Information - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Flow control mechanisms include content checking, security policy filters, and data type identifiers. The term encryption is extended to cover encoded data not recognized by filtering mechanisms.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(4)

AC-4(4) Information Flow Enforcement | Flow Control of Encrypted Information
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection; one or more: decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined organization-defined procedure or method] ].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(5) > Discussion

AC-4(5) Embedded Data Types - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Embedding data types within other data types may result in reduced flow control effectiveness. Data type embedding includes inserting files as objects within other files and using compressed or archived data types that may include multiple embedded data types. Limitations on data type embedding consider the levels of embedding and prohibit levels of data type embedding that are beyond the capability of the inspection tools.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(5)

AC-4(5) Information Flow Enforcement | Embedded Data Types
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Enforce [Assignment: organization-defined limitations] on embedding data types within other data types.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(6) > Discussion

AC-4(6) Metadata - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Metadata is information that describes the characteristics of data. Metadata can include structural metadata describing data structures or descriptive metadata describing data content. Enforcement of allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata regarding data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., employing sufficiently strong binding techniques with appropriate assurance).
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(6)

AC-4(6) Information Flow Enforcement | Metadata
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Enforce information flow control based on [Assignment: organization-defined metadata].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(7) > Discussion

AC-4(7) One-way Flow Mechanisms - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

One-way flow mechanisms may also be referred to as a unidirectional network, unidirectional security gateway, or data diode. One-way flow mechanisms can be used to prevent data from being exported from a higher impact or classified domain or system while permitting data from a lower impact or unclassified domain or system to be imported.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(7)

AC-4(7) Information Flow Enforcement | One-way Flow Mechanisms
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Enforce one-way information flows through hardware-based flow control mechanisms.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(8) > Discussion

AC-4(8) Security and Privacy Policy Filters - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Organization-defined security or privacy policy filters can address data structures and content. For example, security or privacy policy filters for data structures can check for maximum file lengths, maximum field sizes, and data/file types (for structured and unstructured data). Security or privacy policy filters for data content can check for specific words, enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data refers to digital information without a data structure or with a data structure that does not facilitate the development of rule sets to address the impact or classification level of the information conveyed by the data or the flow enforcement decisions. Unstructured data consists of bitmap objects that are inherently non-language-based (i.e., image, video, or audio files) and textual objects that are based on written or printed languages. Organizations can implement more than one security or privacy policy filter to meet information flow control objectives.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(8)

AC-4(8) Information Flow Enforcement | Security and Privacy Policy Filters
Family: Access Control (AC) > AC-4 Information Flow Enforcement

(a) Enforce information flow control using [Assignment: organization-defined organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined organization-defined information flows] ; and
(b) [Selection; one or more: block; strip; modify; quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined organization-defined security or privacy policy].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(9) > Discussion

AC-4(9) Human Reviews - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Organizations define security or privacy policy filters for all situations where automated flow control decisions are possible. When a fully automated flow control decision is not possible, then a human review may be employed in lieu of or as a complement to automated security or privacy policy filtering. Human reviews may also be employed as deemed necessary by organizations.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(9)

AC-4(9) Information Flow Enforcement | Human Reviews
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Enforce the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(10) > Discussion

AC-4(10) Enable and Disable Security or Privacy Policy Filters - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

For example, as allowed by the system authorization, administrators can enable security or privacy policy filters to accommodate approved data types. Administrators also have the capability to select the filters that are executed on a specific data flow based on the type of data that is being transferred, the source and destination security domains, and other security or privacy relevant features, as needed.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(10)

AC-4(10) Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined organization-defined conditions].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(11) > Discussion

AC-4(11) Configuration of Security or Privacy Policy Filters - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Documentation contains detailed information for configuring security or privacy policy filters. For example, administrators can configure security or privacy policy filters to include the list of inappropriate words that security or privacy policy mechanisms check in accordance with the definitions provided by organizations.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(11)

AC-4(11) Information Flow Enforcement | Configuration of Security or Privacy Policy Filters
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Provide the capability for privileged administrators to configure [Assignment: organization-defined organization-defined security or privacy policy filters] to support different security or privacy policies.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(12) > Discussion

AC-4(12) Data Type Identifiers - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Data type identifiers include filenames, file types, file signatures or tokens, and multiple internal file signatures or tokens. Systems only allow transfer of data that is compliant with data type format specifications. Identification and validation of data types is based on defined specifications associated with each allowed data format. The filename and number alone are not used for data type identification. Content is validated syntactically and semantically against its specification to ensure that it is the proper data type.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(12)

AC-4(12) Information Flow Enforcement | Data Type Identifiers
Family: Access Control (AC) > AC-4 Information Flow Enforcement

When transferring information between different security domains, use [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(13) > Discussion

AC-4(13) Decomposition into Policy-relevant Subcomponents - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Decomposing information into policy-relevant subcomponents prior to information transfer facilitates policy decisions on source, destination, certificates, classification, attachments, and other security- or privacy-related component differentiators. Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(13)

AC-4(13) Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents
Family: Access Control (AC) > AC-4 Information Flow Enforcement

When transferring information between different security domains, decompose information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(14) > Discussion

AC-4(14) Security or Privacy Policy Filter Constraints - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Data structure and content restrictions reduce the range of potential malicious or unsanctioned content in cross-domain transactions. Security or privacy policy filters that restrict data structures include restricting file sizes and field lengths. Data content policy filters include encoding formats for character sets, restricting character data fields to only contain alpha-numeric characters, prohibiting special characters, and validating schema structures.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(14)

AC-4(14) Information Flow Enforcement | Security or Privacy Policy Filter Constraints
Family: Access Control (AC) > AC-4 Information Flow Enforcement

When transferring information between different security domains, implement [Assignment: organization-defined organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(15) > Discussion

AC-4(15) Detection of Unsanctioned Information - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Unsanctioned information includes malicious code, information that is inappropriate for release from the source network, or executable code that could disrupt or harm the services or systems on the destination network.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(15)

AC-4(15) Information Flow Enforcement | Detection of Unsanctioned Information
Family: Access Control (AC) > AC-4 Information Flow Enforcement

When transferring information between different security domains, examine the information for the presence of [Assignment: organization-defined unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organization-defined organization-defined security or privacy policy].
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(17) > Discussion

AC-4(17) Domain Authentication - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Attribution is a critical component of a security and privacy concept of operations. The ability to identify source and destination points for information flowing within systems allows the forensic reconstruction of events and encourages policy compliance by attributing policy violations to specific organizations or individuals. Successful domain authentication requires that system labels distinguish among systems, organizations, and individuals involved in preparing, sending, receiving, or disseminating information. Attribution also allows organizations to better maintain the lineage of personally identifiable information processing as it flows through systems and can facilitate consent tracking, as well as correction, deletion, or access requests from individuals.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(17)

AC-4(17) Information Flow Enforcement | Domain Authentication
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Uniquely identify and authenticate source and destination points by [Selection; one or more: organization, system, application, service, individual] for information transfer.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(19) > Discussion

AC-4(19) Validation of Metadata - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

All information (including metadata and the data to which the metadata applies) is subject to filtering and inspection. Some organizations distinguish between metadata and data payloads (i.e., only the data to which the metadata is bound). Other organizations do not make such distinctions and consider metadata and the data to which the metadata applies to be part of the payload.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(19)

AC-4(19) Information Flow Enforcement | Validation of Metadata
Family: Access Control (AC) > AC-4 Information Flow Enforcement

When transferring information between different security domains, implement [Assignment: organization-defined organization-defined security or privacy policy filters] on metadata.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(20) > Discussion

AC-4(20) Approved Solutions - Discussion
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Organizations define approved solutions and configurations in cross-domain policies and guidance in accordance with the types of information flows across classification boundaries. The National Security Agency (NSA) National Cross Domain Strategy and Management Office provides a listing of approved cross-domain solutions. Contact [ncdsmo@nsa.gov](mailto:ncdsmo@nsa.gov) for more information.
Security and Privacy Controls for Information Systems and Organizations
AC > AC-4 > AC-4(20)

AC-4(20) Information Flow Enforcement | Approved Solutions
Family: Access Control (AC) > AC-4 Information Flow Enforcement

Employ [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains.