AC-4 Information flow enforcement
Requires information flows within the system and between connected systems to be controlled against approved authorizations, using flow control policies the organization defines, so that data cannot move between domains
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Firewall, proxy or data loss prevention rule sets that implement the approved flows · Identity provider / directory
periodic reviewEvidence produced at each review
- Rule review records confirming permissive or stale flows were removed · Identity provider / directory
governing documentDocuments that govern the control
- Documented information flow control policy and approved flow matrix · Policy repository / GRC workspace
- Network diagram showing enforcement points between security domains · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Flow matrix exists on paper while the rule base carries broad any to any allowances
- Egress flows unmanaged even where ingress is tightly controlled
- Cloud to cloud and service to service traffic is outside the flow model entirely
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet