AC-4(14)

Requirement

When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.

Discussion

Data structure and content restrictions reduce the range of potential malicious or unsanctioned content in cross-domain transactions. Security or privacy policy filters that restrict data structures include restricting file sizes and field lengths. Data content policy filters include encoding formats for character sets, restricting character data fields to only contain alpha-numeric characters, prohibiting special characters, and validating schema structures.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Access control policy; information flow control policies; procedures addressing information flow enforcement; system design documentation; system configuration settings and associated documentation; list of security and privacy policy filters; list of data structure policy filters; list of data content policy filters; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; system developers].

Test

[SELECT FROM: Mechanisms implementing information flow enforcement policy; security and privacy policy filters].

ID	Assessment Objectives
AC-04(14)[02]	when transferring information between different security domains, implemented <AC-04(14)_ODP[02] privacy policy filters> require fully enumerated formats that restrict data structure and content.
AC-04(14)[01]	when transferring information between different security domains, implemented <AC-04(14)_ODP[01] security policy filters> require fully enumerated formats that restrict data structure and content;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!