CMMC & SOC 2 READINESS • AUSTIN & HOUSTON
Being allowed to open a file does not mean being allowed to send it anywhere.
Information flow control defines the approved destinations, transfer methods, and safeguards for business information—and verifies that other paths are restricted.
What is information flow control?
Information flow control governs how information moves within and between systems, users, applications, and security boundaries. A useful policy explains what may move, where it may go, who may initiate the transfer, which method is permitted, and what protection is required.
For a defense contractor, this might mean keeping CUI in approved repositories, allowing delivery to an authorized customer through an approved service, and restricting personal email, unmanaged devices, and unapproved removable media.
Access control vs. information flow control
| Question | Access control | Information flow control |
|---|---|---|
| Primary concern | May this user or process access the resource? | May this information move along this path to this destination? |
| Example | Alice may open an engineering drawing; Bob may not. | Alice may submit the drawing through an approved customer portal, but may not upload it to personal storage. |
| Possible enforcement | Identity, permissions, and application authorization. | Network rules, sharing restrictions, DLP, session restrictions, and approved transfer workflows. |
These controls work together. Folder permissions do not automatically govern every copy created after authorized access, while a network rule does not determine whether a recipient is authorized to receive a particular document.
A practical CUI transfer example
Illustrative workflow: An engineer uses an approved device to open a CUI drawing in a restricted project repository. The business authorizes delivery to a named customer through an approved portal. Personal email, personal cloud storage, and unapproved USB transfers are prohibited.
Implementation could combine repository permissions, device-based access decisions, restricted sharing, supported DLP rules, and network controls. Test the legitimate submission and the prohibited alternatives. An encrypted personal USB drive remains unauthorized if company policy does not permit that destination.
Which controls help enforce approved information flows?
1. Network segmentation and boundary rules
Map the necessary connections between workstations, servers, cloud services, backup systems, and outside parties. Restrict unnecessary paths and review routing, IPv6, remote access, and alternate gateways. A VLAN name or failed ping does not establish complete separation.
A firewall can restrict a connection without understanding the document inside it. An approved HTTPS connection may still carry an unauthorized upload, so evaluate application and data controls too. Read our CRMA versus Out-of-Scope Asset comparison.
2. Endpoint and cloud DLP
Data loss prevention can identify selected sensitive content and restrict supported activities. Depending on the product and configuration, these can include clipboard use, printing, removable-media copies, external sharing, and uploads to specified cloud destinations.
Coverage varies by platform, file type, application, browser, and policy mode. Audit-only records activity without blocking it; an override policy may permit a user to continue. Labels can help classification and enforcement, but a label alone does not guarantee transfer protection. See Microsoft Endpoint DLP documentation and our Microsoft Purview setup and support.
3. Conditional Access and tenant restrictions
Conditional Access can require specified identity or device conditions before access to supported company resources. It does not automatically prevent every sign-in to an unrelated tenant.
Microsoft distinguishes cross-tenant access settings from tenant restrictions, including scenarios involving externally issued accounts. Evaluate the exact identities and applications involved, enforcement prerequisites, licensing, and bypass paths. Microsoft tenant controls should not be assumed to control an unrelated Google Workspace environment. Reference: Microsoft cross-tenant access overview.
4. Restricted VDI and remote application sessions
Review clipboard transfer, redirected drives, printing, USB devices, local downloads, and exports initiated inside the remote session. Disabling drive redirection does not stop a user from uploading through a browser running inside that session.
Do not describe VDI as preventing every possible capture. Screen photography and other capture risks need consideration. Our secure enclave, VDI, and virtual data room guide explains the distinctions.
5. Approved sharing and release procedures
Define recipient verification, approved delivery services, permissions, expiration, and exception approval. If information is reviewed or redacted before release, establish who authorizes the result and how residual content is checked. Inspection, decryption, or redaction does not automatically make CUI public or authorize its release.
How does this map to CMMC, NIST, and SOC 2?
| Reference | Relationship |
|---|---|
| CMMC AC.L2-3.1.3 | The direct requirement for authorized CUI flow. |
| CMMC SC.L2-3.13.1 | Communications protection at external and key internal boundaries. |
| CMMC SC.L2-3.13.3 | User functionality and system-management separation; distinct from boundary protection. |
| NIST SP 800-53 AC-4 | Information Flow Enforcement; mapped to 3.1.3 in SP 800-171 Revision 2. |
| SOC 2 CC6.6 / CC6.7 | External threats and authorized information movement, with protection during movement. |
These relationships do not mean a single DLP rule satisfies an entire requirement or criterion. Sources: NIST SP 800-171 Revision 2 and AICPA Trust Services Criteria. SOC 2 does not prescribe a universal product stack.
Where do Bell–LaPadula and Biba fit?
These formal models help explain why information movement can be constrained. Bell–LaPadula emphasizes confidentiality, commonly taught as “no read up” and “no write down.” The strict Biba integrity model is commonly taught as “no read down” and “no write up.”
They are teaching models, not automatic descriptions of a firewall or Purview deployment. A CUI enclave does not become a formal multilevel-security system by using VLANs or labels. CUI is unclassified information requiring safeguards, not a classified clearance level such as Secret.
What evidence shows information flow controls work?
- Approved flow records: source, destination, information type, permitted users, transfer method, protection, owner, and approval.
- Diagrams: relevant network and cloud paths, trust boundaries, repositories, backup copies, and providers.
- Enforcement settings: applicable network, sharing, DLP, identity, and session policies.
- Authorized testing: successful approved transfers and blocked prohibited transfers, including representative alternate clients and devices.
- Operational records: alerts, reviews, exception decisions, remediation, and retests after changes.
Use synthetic or otherwise approved test content rather than sending real CUI to an unauthorized destination to test a block. Define who investigates failed controls and who approves changes.
Information flow control support in Austin and Houston
Business Communication Solutions helps businesses map sensitive workflows, review access and transfer paths, implement agreed safeguards, and organize readiness evidence. We can work with your internal IT team and existing providers.
Explore CMMC gap assessment and implementation support, SOC 2 readiness services, and secure device baselines. Readiness support does not replace an independent assessment or guarantee certification.
Austin: 512-257-1433 Houston: 281-815-8784
Discuss your information flow controls with BCS.