Transfer Authorization

Go to Terms and Definitions

Transfer Authorization grants permission to transfer identified information or Artifacts under defined conditions.

Transfer Authorization may identify:

• The authorized transfer subject
• The source environment
• The destination environment
• The applicable Transfer Boundary
• The authorized actor or process
• The permitted transfer method
• The permitted transfer medium
• The effective period
• Required inspections
• Required protection measures
• Required records
• The authorizing authority

The transfer subject may include:

• A file
• A collection of files
• A transfer bundle
• A Machine Image
• An Infrastructure Configuration
• A software package
• A data set
• A report
• Evidence

Transfer Authorization differs from general access authorization:

• Access authorization permits an actor or process to access a resource
• Transfer Authorization permits movement of an identified transfer subject between defined source and destination domains

Permission to access, read, or copy an Artifact does not necessarily include permission to transfer it across a Transfer Boundary.

authorization that permits identified information or artifacts to be transferred from a defined source to a defined destination under specified conditions

Dido Solutions, Inc. and Jackrabbit Consulting, Inc.

Transfer Authorization may apply to:

• A single transfer
• A defined set of transfers
• A specified class of transfer subjects
• A recurring transfer process
• A defined authorization period

Transfer Authorization does not by itself establish that the transfer subject:

• Satisfies applicable content restrictions
• Has preserved integrity
• Is free from malicious content
• Is suitable for use in the destination environment
• Was successfully transferred

Separate controls verify those conditions.

A transfer performed outside the conditions of its Transfer Authorization is unauthorized even when the transferred content was otherwise accessible to the actor or process.

A security officer authorizes an identified Machine Image revision to move from a build environment to an Air-Gapped Environment using encrypted removable media during a specified period and subject to integrity verification and malware scanning.