information flow control policy

A security policy rule set—defined at the organizational or system level—that specifies which subjects, operations, and information attributes govern whether data is permitted to move between designated sources and destinations, independent of who owns or holds the data at any given moment. Information flow control regulates *where* information can travel within a system and between systems, in contrast to who is allowed to access the information. An information flow control policy controls access to the information itself, independent of its container; the attributes of the information stay with it as it flows. In practice the field uses it in two complementary ways: organizations employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems, with flow control based on the characteristics of the information and/or the information path; and in formal evaluation frameworks such as the Common Criteria (ISO/IEC 15408), FDP_IFC covers the identification of information flow control Security Function Policies (SFPs) and the scope of their control, going beyond

Advisory only. A term this product ships is defined by an authority document, not by a search result.