information path
163549·updated Aug 30, 2026** A property of a data flow used as a basis for access-control decisions about where information is permitted to travel within or between systems. It is distinguished from the *content* of the information itself: information flow control regulates where information is allowed to travel within an information system and between information systems, as opposed to who is allowed to access the information. Specifically, organizations use information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations — such as networks, individuals, and devices — within systems and between interconnected systems, with flow control based on characteristics of the information or the information path. In practice, the information path serves as one of two alternative criteria (the other being content characteristics) against which boundary protection devices such as encrypted tunnels, routers, gateways, and firewalls apply rule sets or configuration settings to restrict system services, provide packet-filtering based on header information, or provide message-filtering based on message content. **VERDICT:** TERM_OF_ART --- **Sou
Source
is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., encrypted tunnels, routers, gateways, and firewalls) that use rule sets or establishthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time
- AC-4: Information Flow Enforcement - CSF Tools
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A property of the route or channel through which data moves between sources and destinations within or between systems — defined by attributes such as the network segment traversed, the boundary devices crossed, the protocol used, or the security/privacy domain boundaries involved. It is one of the two recognized bases (the other being the content or classification of the information itself) on which information flow control policies are evaluated and enforced. Organizations employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems, and flow control is based on the characteristics of the information and/or the information path. Enforcement occurs in boundary protection devices such as gateways, routers, guards, encrypted tunnels, and firewalls that employ rule sets or establish configuration settings that restrict services, provide packet-filtering based on header information, or provide message-filtering based on message content.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- information paths
- possessive
- information path's
- pluralpossessive
- information paths'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- ** A property of a data flow used as a basis for access-control decisions about where information is permitted to travel within or between systems. It is distinguished from the *content* of the information itself: information flow control regulates where information is allowed to travel within an information system and between information systems, as opposed to who is allowed to access the information. Specifically, organizations use information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations — such as networks, individuals, and devices — within systems and between interconnected systems, with flow control based on characteristics of the information or the information path. In practice, the information path serves as one of two alternative criteria (the other being content characteristics) against which boundary protection devices such as encrypted tunnels, routers, gateways, and firewalls apply rule sets or configuration settings to restrict system services, provide packet-filtering based on header information, or provide message-filtering based on message content. **VERDICT:** TERM_OF_ART --- **SouDR-088 backfill from the noun definition column