3.1.3—Access Control - Derived
>Control Description
>Discussion
Information flow control regulates where information can travel within a system and between systems (versus who can access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include the following: keeping export-controlled information from being transmitted in the clear to the Internet; blocking outside traffic that claims to be from within the organization; restricting requests to the Internet that are not from the internal web proxy server; and limiting information transfers between organizations based on data structures and content. Organizations commonly use information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within systems and between interconnected systems.
Flow control is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering and inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement.
Transferring information between systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners or stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies.
Enforcement includes: prohibiting information transfers between interconnected systems (i.e., allowing access only); employing hardware mechanisms to enforce one-way information flows; and implementing trustworthy regrading mechanisms to reassign security attributes and security labels.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies require network access control for CUI systems?
- •How do you define and maintain network access authorization requirements?
- •What processes govern firewall rule changes and approvals?
- •How often are network access controls reviewed and updated?
- •Who is responsible for authorizing network connections to CUI systems?
Technical Implementation:
- •What network access controls are implemented (firewalls, ACLs, VPNs)?
- •How do you enforce network segmentation for CUI systems?
- •What controls prevent unauthorized external network access?
- •How are internal network boundaries protected?
- •What intrusion prevention systems monitor network access?
Evidence & Documentation:
- •Can you provide current firewall rules and ACL configurations?
- •What network diagrams show CUI system boundaries and controls?
- •What logs demonstrate network access control enforcement?
- •Can you show recent network access control reviews?
- •What evidence exists of blocked unauthorized network access attempts?
Ask AI
Configure your API key to use AI features.