+AC-04(21) Physical or Logical Separation of Information Flows

AC-04(21) Physical or Logical Separation of Information Flows

Control

Separate information flows logically or physically using [Assignement: organization-defined mechanisms and/or techniques] to accomplish [Assignement: required separations].

Discussion

Enforcing the separation of information flows associated with defined types of data can enhance protection by ensuring that information is not commingled while in transit and by enabling flow control by transmission paths that are not otherwise achievable. Types of separable information include inbound and outbound communications traffic, service requests and responses, and information of differing security impact or classification levels.

Assessment Objective

  1. information flows are separated logically using [Assignement: mechanisms and/or techniques] to accomplish [Assignement: required separations];
  2. information flows are separated physically using [Assignement: mechanisms and/or techniques] to accomplish [Assignement: required separations].

Assessment Method

Examine

Information flow enforcement policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of required separation of information flows by information types list of mechanisms and/or techniques used to logically or physically separate information flows system audit records system security plan other relevant documents or records

Interview

Organizational personnel with information flow enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by AC-04(21) Physical or Logical Separation of Information Flows – Assessment Procedure
is blocked by Network Segmentation (macrosegmentation)