information flow control policy
A security or privacy policy construct that specifies the authorized paths and directions along which data may move—within a system, between systems, or across security/privacy domains—based on the characteristics of the information itself or its path rather than on who holds access rights to it. It is distinct from access control policy in that it governs *where* information may travel rather than *who* may read it, and it is typically enforced at boundary devices (firewalls, guards, proxies, data-loss-prevention tools) through rule sets keyed to data classification labels, content, or network attributes. In practice, organizations define organization-specific information flow control policies and then implement enforcement mechanisms—such as one-way data diodes, content filters, or export restrictions—to ensure transfers never violate those policies.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
A rule set or named security requirement that specifies which subjects, information objects, and operations are permitted to move data between security domains, classification levels, or trust boundaries — governing *where* information may travel rather than merely *who* may access a container. It regulates where information can travel within a system and between systems, in contrast to who is allowed to access the information, and without regard to subsequent accesses to that information. In the Common Criteria framework, an information flow control policy controls access to the information, independent of its container, and its scope of control is characterised by three sets: the subjects under control of the policy, the information under control of the policy, and the operations which cause controlled information to flow to and from controlled subjects. In practice, organizations use such policies as the basis for enforcement mechanisms — firewalls, content filters, cross-domain guards, and label-based routing rules — to control the flow of information between designated sources and destinations within systems and between connected systems, with flow control based on the characteristics of the information and/or the information path.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- information flow control policies
- possessive
- information flow control policy's
- pluralpossessive
- information flow control policies'