[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fac-4":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ac-4","AC-4","Information Flow Enforcement",116,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must enforce approved authorisations for controlling how information flows within the system and between connected systems.\n\n**In practice.** Doing this well means defining which data may move where, then enforcing it with network segmentation, firewalls, proxies, data loss prevention and application-level controls. Examples include blocking sensitive data from leaving through unsanctioned channels and restricting flows between security zones. Auditors look for flow policies, rule sets and evidence that they are tested and reviewed. Cloud environments add flows between accounts, virtual networks and managed services, which should be covered by the same policy.\n\n**Common gaps.** Organisations often control network traffic but not flows of data through SaaS integrations, APIs or file sharing. Information flow policies are frequently undocumented, so enforcement cannot be checked against intent. Rules allowing any traffic between internal zones are also common.","Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].\nDiscussion: Information flow control regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include blocking external traffic that claims to be from within the organization, keeping export-controlled information from being transmitted in the clear to the Internet, restricting web requests that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between organizations may require an agreement specifying how the information flow is enforced (see [CA-3](#ca-3) ). Transferring information between systems in different security or privacy domains with different security or privacy policies introduces the risk that such transfers violate one or more domain security or privacy policies. In such situations, information owners\u002Fstewards provide guidance at designated policy enforcement points between connected systems. Organizations consider mandating specific architectural solutions to enforce specific security and privacy policies. Enforcement includes prohibiting information transfers between connected systems (i.e., allowing access only), verifying write permissions before accepting information from another security or privacy domain or connected system, employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels.\n\nOrganizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and\u002For the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Organizations also consider the trustworthiness of filtering and\u002For inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 32 primarily address cross-domain solution needs that focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, such as high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf products. Information flow enforcement also applies to control plane traffic (e.g., routing and DNS).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","2026-10-16T08:21:33.492+00:00",{"slug":25,"title":26,"published_at":27},"tfg-london-cyberattack-hits-multiple-retail-brands-across-shared-it-infrastructure","TFG London Cyberattack Hits Multiple Retail Brands Across Shared IT Infrastructure","2026-10-13T18:21:02.732+00:00",{"slug":29,"title":30,"published_at":31},"ai-self-replication-on-iot-devices-a-looming-worm-threat","AI Self-Replication on IoT Devices: A Looming Worm Threat","2026-10-13T14:21:07.191+00:00",{"slug":33,"title":34,"published_at":35},"shadow-ai-on-endpoints-creates-hidden-risk-and-data-exposure","Shadow AI on Endpoints Creates Hidden Risk and Data Exposure","2026-10-13T12:22:02.053+00:00",{"slug":37,"title":38,"published_at":39},"anthropic-ai-models-exploit-government-sites-during-testing","Anthropic AI Models Exploit Government Sites During Testing","2026-10-12T20:20:33.279+00:00",{"slug":41,"title":42,"published_at":43},"ashvein-rat-targets-ukrainian-officials-via-html-concealed-commands-and-institutional-impersonation","ASHVEIN RAT Targets Ukrainian Officials via HTML-Concealed Commands and Institutional Impersonation","2026-10-08T17:20:25.103+00:00",{"slug":45,"title":46,"published_at":47},"ai-pentesting-tool-artex-weaponized-against-south-korean-financial-firms","AI Pentesting Tool ARTEX Weaponized Against South Korean Financial Firms","2026-10-08T16:22:00.204+00:00",{"slug":49,"title":50,"published_at":51},"fake-zoom-installer-delivers-macos-cloudsyncd-backdoor-to-steal-passwords","Fake Zoom Installer Delivers macOS CloudSyncD Backdoor to Steal Passwords","2026-10-01T16:20:21.111+00:00",{"slug":53,"title":54,"published_at":55},"ai-agent-bypasses-sandbox-controls-via-dns-loophole","AI Agent Bypasses Sandbox Controls via DNS Loophole","2026-09-29T08:21:38.931+00:00",{"slug":57,"title":58,"published_at":59},"needymantis-malware-enables-stealthy-long-term-persistence-via-dll-sideloading","NeedyMantis Malware Enables Stealthy Long-Term Persistence via DLL Sideloading","2026-09-28T22:21:46.583+00:00",{"slug":61,"title":62,"published_at":63},"openai-ai-agents-leaked-user-images-to-third-party-hosts","OpenAI AI Agents Leaked User Images to Third-Party Hosts","2026-09-26T20:21:57.994+00:00",{"slug":65,"title":66,"published_at":67},"shinyhunters-exploit-oracle-peoplesoft-flaw-by-bypassing-waf-defenses","ShinyHunters Exploit Oracle PeopleSoft Flaw by Bypassing WAF Defenses","2026-09-26T20:21:42.897+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",50,{"slug":75,"name":76,"problem":77,"stories":78},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",31,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",23,{"slug":85,"name":86,"problem":87,"stories":88},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",22,{"slug":90,"name":91,"problem":92,"stories":93},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",21,{"slug":95,"name":96,"problem":97,"stories":98},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",17,[100,106,111,116,121,126,130,136],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","12","Control 12","Network Infrastructure Management",67,{"family":101,"item":107,"code":108,"title":109,"together":110},"13","Control 13","Network Monitoring and Defense",60,{"family":5,"item":112,"code":113,"title":114,"together":115},"sc-7","SC-7","Boundary Protection",35,{"family":101,"item":117,"code":118,"title":119,"together":120},"7","Control 7","Continuous Vulnerability Management",34,{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",33,{"family":101,"item":127,"code":128,"title":129,"together":78},"3","Control 3","Data Protection",{"family":131,"item":132,"code":133,"title":134,"together":135},"gdpr","32","Article 32","Security of processing",30,{"family":5,"item":137,"code":138,"title":139,"together":140},"si-4","SI-4","System Monitoring",27]