information flow control policy

A rule set or named security requirement that specifies which subjects, information objects, and operations are permitted to move data between security domains, classification levels, or trust boundaries — governing *where* information may travel rather than merely *who* may access a container. It regulates where information can travel within a system and between systems, in contrast to who is allowed to access the information, and without regard to subsequent accesses to that information. In the Common Criteria framework, an information flow control policy controls access to the information, independent of its container, and its scope of control is characterised by three sets: the subjects under control of the policy, the information under control of the policy, and the operations which cause controlled information to flow to and from controlled subjects. In practice, organizations use such policies as the basis for enforcement mechanisms — firewalls, content filters, cross-domain guards, and label-based routing rules — to control the flow of information between designated sources and destinations within systems and between connected systems, with flow control based on the characteristics of the information and/or the information path.

Advisory only. A term this product ships is defined by an authority document, not by a search result.