documentation_complete: true

title: 'Identify and Document Application Data Flows'

description: |-
    It is recommended to identify and document
    application data flows. This will allow insight into what paths
    sensitive information takes through the application environment
    and what data source connections need to be encrypted.

rationale: |-
    Failure to document an application's data flows reduces security,
    increases the chance for architectural and configuration errors,
    and can impede performance. Many applications use network services
    that are not immediately apparent.

severity: medium

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: SC-8,SC-9,SC-23

ocil_clause: 'no application data flow documentation exists'
