information flow enforcement

A security control category that governs whether and how data may move between subjects, objects, systems, or trust domains — distinct from access control, which concerns *who* may read or write information. Information flow enforcement regulates *where* information is allowed to travel within a system and between systems, as opposed to who is allowed to access the information, and without explicit regard to subsequent accesses to that information. Organizations employ information flow control policies and enforcement mechanisms to control flows between designated sources and destinations; flow control is based on the characteristics of the information and/or the information path, and enforcement occurs in boundary protection devices that use rule sets, packet-filtering on header information, or message-filtering based on content. Enforcement techniques include prohibiting transfers between connected systems, verifying write permissions before accepting information from another security or privacy domain, employing hardware mechanisms to enforce one-way flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels.