Back to Control Explorer
AC.2.016
Content
Control Acronym
AC
Family
Access Control
CMMC Level
2
800-171 Control #
3.1.3
CMMC Description
Control the flow of CUI in accordance with approved authorizations.
CMMC Clarification
Flow control regulates where and how information can flow. Firewalls and proxy servers can be used to control traffic flow. Typically, organizations will have a firewall between the internal network and the internet. Often multiple firewalls are used inside a network to create zones to separate sensitive data, business units or user groups. Proxy servers can be used to break the connection between multiple networks. All traffic entering or leaving a network is intercepted by the proxy, preventing direct access between networks. This can have security and performance benefits. Additionally, organizations should ensure that all sensitive information is encrypted before being transmitted over the internet. Example You configure a proxy device on your company’s network. Your goal is to better mask and protect the devices inside your network. After you configure the device, information does not flow directly from the internal network to the internet. The proxy system intercepts the traffic. Then, the proxy analyzes it to determine if it is legitimate. If it is, the system allows it on the network and sends it to its destination.
800-171 Description
Control the flow of CUI in accordance with approved authorizations.
800-171 Discussion
Information flow control regulates where information can travel within a system and between systems (versus who can access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include the following: keeping export- controlled information from being transmitted in the clear to the Internet; blocking outside traffic that claims to be from within the organization; restricting requests to the Internet that are not from the internal web proxy server; and limiting information transfers between organizations based on data structures and content. Organizations commonly use information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations (e.g., networks, individuals, and devices) within systems and between interconnected systems. Flow control is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., gateways, routers, guards, encrypted tunnels, firewalls) that employ rule sets or establish configuration settings that restrict system services, provide a packet- filtering capability based on header information, or message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering and inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Transferring information between systems representing different security domains with different security policies introduces risk that such transfers violate one or more domain security policies. In such situations, information owners or stewards provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes: prohibiting information transfers between interconnected systems (i.e., allowing access only); employing hardware mechanisms to enforce one-way information flows; and implementing trustworthy regrading mechanisms to reassign security attributes and security labels.
Other Source Discussion
N/A
CIS Control References
CIS Controls v7.1 12.1, 12.2, 12.5, 12.8, 13.3, 14.1, 14.6, 14.7
NIST 800-53 Control Ref.
NIST SP 800-53 Rev 4 AC-4
CMMC Derived
NIST CSF Control References
NIST 800-171 References
NIST SP 800-171 Rev 1 3.1.3
Applicable FAR Clause
NIST CSF Control Reference
NIST CSF v1.1 ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4
CERT RMM Reference
CERT RMM v1.2 TM:SG4.SP1
Modification of NIST 800-171B Reference
NIST 800-171B Reference
UK NCSCCyber Reference
UK NCSC Cyber Essentials
AS ACSC Reference
Sub-Criterias
Assessment Sub-Criteria 1
AC.2.016.[a] information flow control policies are defined;
Assessment Sub-Criteria 2
AC.2.016.[b] methods and enforcement mechanisms for controlling the flow of CUI are defined;
Assessment Sub-Criteria 3
AC.2.016.[c] designated sources and destinations (e.g., networks, individuals, and devices) for CUI within the system and between interconnected systems are identified;
Assessment Sub-Criteria 4
AC.2.016.[d] authorizations for controlling the flow of CUI are defined; and
Assessment Sub-Criteria 5
AC.2.016.[e] approved authorizations for controlling the flow of CUI are enforced.