public:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:i:information_handling_rules [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Information Handling Rules ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +Information Handling Rules are requirements and constraints governing how information is marked, accessed, used, stored, processed, reproduced, transmitted, transferred, retained, archived, downgraded, declassified, or destroyed.
 +
 +Information Handling Rules can derive from:
 +
 +  * A [[public:99_annexes:annex-b-terms-and-definitions:s:security_classification|Security Classification]]
 +  * A [[public:99_annexes:annex-b-terms-and-definitions:c:classification_authority|Classification Authority]]
 +  * Compartments
 +  * Handling caveats
 +  * Dissemination restrictions
 +  * Legal obligations
 +  * Regulatory obligations
 +  * Contractual obligations
 +  * Organizational policy
 +  * Privacy requirements
 +  * Export-control requirements
 +  * Intellectual-property restrictions
 +  * Mission policy
 +  * Records-management requirements
 +
 +Information Handling Rules can govern:
 +
 +  * Classification and control markings
 +  * Identity requirements
 +  * Authentication requirements
 +  * Authorization requirements
 +  * Need-to-know requirements
 +  * Permitted roles
 +  * Permitted recipients
 +  * Permitted [[public:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]]
 +  * Permitted Infrastructure Environments
 +  * Permitted Deployment Targets
 +  * Storage protections
 +  * Processing restrictions
 +  * Transmission protections
 +  * Cryptographic requirements
 +  * Media controls
 +  * Reproduction restrictions
 +  * Printing restrictions
 +  * Import controls
 +  * Export controls
 +  * Release conditions
 +  * Transfer approval
 +  * Retention periods
 +  * Archival requirements
 +  * Downgrading requirements
 +  * Declassification requirements
 +  * Sanitization requirements
 +  * Destruction requirements
 +  * Audit and Evidence requirements
 +
 +Information Handling Rules can apply to:
 +
 +  * Individual information objects
 +  * Collections of information
 +  * Artifacts
 +  * Machine Images
 +  * Infrastructure Baselines
 +  * Configuration records
 +  * Deployment records
 +  * Dependency records
 +  * Evidence
 +  * Metadata
 +  * Aggregated information
 +
 +Information Handling Rules can depend on both the information and its context.
 +
 +For example, the rules governing an Artifact can depend on:
 +
 +  * Its Security Classification
 +  * Its compartments and caveats
 +  * Its origin
 +  * Its intended recipient
 +  * Its current Security Domain
 +  * Its destination Security Domain
 +  * Its transfer mechanism
 +  * Its retention status
 +  * Its release authorization
 +
 +A [[public:99_annexes:annex-b-terms-and-definitions:c:cross-domain_transfer|Cross-Domain Transfer]] must enforce the Information Handling Rules governing the information, source Security Domain, destination Security Domain, and transfer mechanism.
 +
 +===== Definition =====
 +
 +//requirements and constraints governing the permitted handling of information throughout its lifecycle//
 +
 +===== Source =====
 +
 +  * [[https://www.archives.gov/isoo/policy-documents/cnsi-eo.html|Executive Order 13526, Classified National Security Information]]
 +  * [[https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2001|32 CFR Part 2001, Classified National Security Information]]
 +  * [[https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002|32 CFR Part 2002, Controlled Unclassified Information]]
 +  * NIST Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations
 +  * Dido Solutions, Crucible architecture and requirements terminology
 +
 +===== Note =====
 +
 +Information Handling Rules are not limited to classified information.
 +
 +Unclassified information can require handling controls because of:
 +
 +  * Controlled Unclassified Information requirements
 +  * Privacy obligations
 +  * Export controls
 +  * Contract restrictions
 +  * Proprietary-information protections
 +  * Records-management obligations
 +  * Mission restrictions
 +
 +Information Handling Rules differ from a Security Classification:
 +
 +  * A Security Classification identifies a protection level or classification designation
 +  * Information Handling Rules identify the actions, restrictions, and controls required for the information
 +
 +Information assigned the same Security Classification can have different Information Handling Rules because of different compartments, caveats, release restrictions, origins, or mission constraints.
 +
 +===== Example =====
 +
 +Information classified as Secret has handling rules requiring:
 +
 +  * Secret markings
 +  * Access only by authorized personnel with a need to know
 +  * Storage within an authorized Classified Environment
 +  * Encryption during authorized electronic transmission
 +  * Transfer only through an approved Cross-Domain Transfer mechanism
 +  * Preservation of transfer Evidence
 +  * Destruction through an approved destruction process
 +
 +Additional compartment restrictions can further limit the permitted recipients and destination Security Domains.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>