external communications traffic
163534·updated Aug 30, 2026Network data flows—packets, sessions, and protocol exchanges—that cross an organizational boundary, moving between an internal network and an external one (typically the public internet or a third-party network). It is distinguished from purely internal traffic by its traversal of a managed interface such as a firewall, gateway, or proxy, where boundary-protection controls are applied: enforcing traffic-flow policies, blocking spoofed-source packets, filtering unauthorized protocols, and preventing cleartext transmission of sensitive data. In NIST SP 800-53 (SC-7), boundary protection is framed around monitoring and controlling communications at the external boundary through managed interfaces—gateways, routers, firewalls, and similar devices—that sit between internal organizational networks and external networks. NIST SP 800-171 (§ 3.13.1) uses the concept operationally, for example by restricting external web communications traffic to designated web servers and prohibiting traffic that appears to spoof internal addresses. CIS Control 12 (Boundary Defense) similarly directs organizations to control the flow of traffic through network borders using firewalls, proxies, DMZ perimeter
Source
from being transmitted in the clear to the internet, blocking external communications traffic that claims to be sourced from within the organization, restricting requests to the internet that are not from the internal webthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- SC-7: Boundary Protection - CSF Tools
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational syst
- CIS Control 12: Boundary Defense — CIS Controls Assessment Specification for Controls v7.1 2025 Q1 documentation
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
Network data flows — packets, sessions, or data streams — that cross or purport to cross an organization's perimeter boundary between its internal systems and external, untrusted networks such as the internet. The distinguishing characteristic is directionality plus trust-domain context: the traffic either originates inside and is destined for external systems, originates outside and enters internal systems, or claims one of those origins (as in address-spoofed packets). Authority documents such as NIST SP 800-171 use the concept when specifying that boundary controls must restrict such traffic to designated servers and block traffic that appears to be spoofing internal addresses. In practice the expression serves as the object of boundary-protection controls — filtering, monitoring, denying by default, and extrusion detection — including the detection and denial of outgoing communications traffic that poses a threat to external systems, an activity NIST SP 800-53 calls extrusion detection.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- external communications traffics
- possessive
- external communications traffic's
- pluralpossessive
- external communications traffics'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- Network data flows—packets, sessions, and protocol exchanges—that cross an organizational boundary, moving between an internal network and an external one (typically the public internet or a third-party network). It is distinguished from purely internal traffic by its traversal of a managed interface such as a firewall, gateway, or proxy, where boundary-protection controls are applied: enforcing traffic-flow policies, blocking spoofed-source packets, filtering unauthorized protocols, and preventing cleartext transmission of sensitive data. In NIST SP 800-53 (SC-7), boundary protection is framed around monitoring and controlling communications at the external boundary through managed interfaces—gateways, routers, firewalls, and similar devices—that sit between internal organizational networks and external networks. NIST SP 800-171 (§ 3.13.1) uses the concept operationally, for example by restricting external web communications traffic to designated web servers and prohibiting traffic that appears to spoof internal addresses. CIS Control 12 (Boundary Defense) similarly directs organizations to control the flow of traffic through network borders using firewalls, proxies, DMZ perimeterDR-088 backfill from the noun definition column