flow control
163548·updated Aug 30, 2026A security control mechanism — specifically a set of policies and their enforcement — that governs *where* information is permitted to travel within a system or between interconnected systems, as distinct from *who* is permitted to access it. It "regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information." Organizations employ flow control policies and enforcement mechanisms to control information movement between designated sources and destinations; enforcement is based on characteristics of the information and/or the information path, and is implemented in boundary protection devices — such as firewalls, gateways, and routers — using rule sets, packet-filtering on header information, or message-filtering on content. In practice it covers a wide range of restrictions: blocking external traffic that claims internal origin, preventing export-controlled data from being transmitted in the clear, restricting web requests to those from an authorized proxy, and limiting inter-organizational transfers based on data structures and content.
Source
. Flow control is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., encrypted tunnels, routers, gateways, and firewalls) that use rule sets or establishthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A security control mechanism that governs where information is permitted to travel within a system and between interconnected systems, independently of who is authorized to access it. It regulates where information is allowed to travel within an information system and between information systems, as opposed to who is allowed to access the information, and without explicit regard to subsequent accesses to that information. It operates on the characteristics of the information and/or the information path, with enforcement occurring in boundary protection devices that employ rule sets or configuration settings — such as packet-filtering or message-filtering capabilities. In practice, organizations employ flow control policies and enforcement mechanisms to manage information movement between designated sources and destinations, with enforcement mechanisms comparing security attributes on data content and data structure, and responding — by blocking, quarantining, or alerting — when a transfer is not explicitly permitted by policy.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- flow controls
- possessive
- flow control's
- pluralpossessive
- flow controls'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 5 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A security control mechanism — specifically a set of policies and their enforcement — that governs *where* information is permitted to travel within a system or between interconnected systems, as distinct from *who* is permitted to access it. It "regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information." Organizations employ flow control policies and enforcement mechanisms to control information movement between designated sources and destinations; enforcement is based on characteristics of the information and/or the information path, and is implemented in boundary protection devices — such as firewalls, gateways, and routers — using rule sets, packet-filtering on header information, or message-filtering on content. In practice it covers a wide range of restrictions: blocking external traffic that claims internal origin, preventing export-controlled data from being transmitted in the clear, restricting web requests to those from an authorized proxy, and limiting inter-organizational transfers based on data structures and content.DR-088 backfill from the noun definition column