The ALG that is part of a CDS must enforce organization-defined one-way information flows using hardware mechanisms.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-204917	SRG-NET-000032-ALG-000082	SV-204917r987728_rule	CCI-000031	medium
Description
Information flow control regulates where information is allowed to travel within a network and between interconnected networks. The flow of all network traffic must be monitored and controlled so it does not introduce any unacceptable risk to the network infrastructure or data. For cross domain solutions, use of hardware enforced flow direction is preferable in high risk environments but is not mandatory. Do not enable any connections between security domains beyond the specified one-way flow. Organization-defined one-way information flows using hardware mechanisms used as part of a CDS system depends on the environment, data, and security boundaries. Organizations implementing CDS must follow the DoD-required process of testing, baselining, and risk assessment to ensure the rigor and accuracy necessary to rely upon a CDS for cross domain security.
STIG			Date
Application Layer Gateway Security Requirements Guide			2025-09-15

Related Frameworks

1 mapping across 2 frameworks

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-4(7)One-way Flow Mechanisms

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)
DISA STIG Benchmark (XCCDF)2our copyintersects(normalised)DISA STIG Benchmark (XCCDF)V2R4our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)2intersects(normalised)DISA STIG Benchmark (XCCDF)V2R4intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-000031

1.00

DISA STIG Benchmark (XCCDF)V2R3intersects(normalised)

Details

Check Text (C-204917r987728_chk)

If the ALG is not part of a CDS, this is not applicable. Verify the ALG is configured to enforce organization-defined one-way information flows using hardware mechanisms. If the ALG is not configured to enforce organization-defined one-way information flows using hardware mechanisms, this is a finding.

Fix Text (F-5185r395885_fix)

If the ALG is part of a CDS, configure the ALG to enforce organization-defined one-way information flows using hardware mechanisms.