A cross-domain solution, or CDS, is a controlled mechanism for moving information between networks that sit at different security or trust levels. The classic example is moving data between a classified and an unclassified network, but the same problem appears wherever a high-trust environment must exchange data with a lower-trust one.
The challenge is not just to move data but to do so without letting anything cross that should not: no leakage the wrong way, no malicious content riding along, no covert channel. A CDS combines enforced direction with inspection and assurance to make that exchange safe.
01Key takeaways
- 01
A cross-domain solution moves data between networks of different trust levels under strict, assured control.
- 02
Transfer CDS move data between domains; access CDS let a user reach multiple domains from one place.
- 03
Data diodes often provide the directional enforcement, while guards add content inspection and filtering.
- 04
Assurance matters: CDS are typically subject to formal evaluation and strict design rules.
- 05
The pattern is increasingly relevant beyond government, wherever OT or critical data crosses trust boundaries.
02What a cross-domain solution is
A cross-domain solution is a system designed to transfer or access information across a boundary between security domains while enforcing the policy that governs that boundary. It exists because connecting two domains of different trust directly would let the risk of the lower domain reach the higher one.
Rather than a simple connection, a CDS is a controlled chokepoint: data passes only in approved directions, only after inspection, and only in approved forms. Everything else is blocked by design.
A CDS is not a connection between domains; it is an enforced, inspected, one-way-or-tightly-controlled bridge.
03Transfer CDS versus access CDS
- Transfer CDS
- Moves data between domains, for example exporting reports from a high domain to a low one or importing validated updates the other way, under strict filtering.
- Access CDS
- Lets a user interact with multiple domains from a single point without bridging the domains themselves, keeping the data separated even as the user works across them.
Most discussions of one-way hardware concern transfer CDS, where the question is how data crosses safely. Access CDS solve a related but distinct problem of user-level separation.
04How CDS relate to data diodes and guards
A cross-domain solution is usually built from recognizable parts. A data diode can provide the hardware enforcement of direction, ensuring data can only flow the approved way. A guard adds the intelligence: inspecting, filtering and validating the content that crosses.
In a typical export scenario, a diode ensures nothing can travel back into the high domain, while a guard ensures that what leaves is only the approved data, in the approved format, with nothing hidden inside it. Together they enforce both direction and content.
05Content inspection and filtering
Direction alone is not enough for a true cross-domain problem, because even one-way data can carry the wrong thing: sensitive information leaking out, or malicious content coming in. Inspection is what closes that gap.
- Validate that data matches an approved type and schema before it crosses.
- Strip or block content that could carry hidden data or code.
- Enforce that only specified fields or files are released, not whole datasets.
- Check for and prevent covert channels that could smuggle information.
- Log what crossed so the transfer can be reviewed and proven.
06Assurance and evaluation
Because a CDS guards the boundary between trust levels, the bar for trusting the CDS itself is high. These systems are typically subject to formal evaluation, strict design requirements and rigorous testing, especially in government and defense contexts.
The principle is general even outside formal regimes: the more consequential the boundary, the more the mechanism that bridges it must be assured, simple enough to reason about, and provable in its behavior.
07Where CDS fit beyond government
Cross-domain thinking is increasingly relevant in industry. OT environments, critical infrastructure and high-value enterprise systems all face the same shape of problem: data must cross between a protected domain and a less-trusted one without opening the protected side to risk.
Not every industrial boundary needs a full formal CDS, but the pattern is instructive. For an OT-to-IT export, an AIRGAPNET controlled connectivity pattern combined with directional enforcement and validation captures the same idea: data crosses in the approved direction, in an approved form, and the protected domain is never reachable back through the boundary.
08Closing thought
A cross-domain solution is the disciplined answer to a hard question: how do you connect two networks that should not fully trust each other? The answer is to refuse a simple connection and instead build an enforced, inspected, assured bridge that allows only what policy permits.
Whether the context is classified networks or an industrial plant, the lesson holds. Define the trust boundary, enforce the direction, inspect the content, and assure the mechanism. The bridge should be as trustworthy as the domains it joins.
FAQFrequently asked questions
What is a cross-domain solution?
A cross-domain solution (CDS) is a controlled mechanism for transferring or accessing information between networks at different security or trust levels, enforcing the policy that governs the boundary so only approved data crosses in approved directions.
What is the difference between a transfer CDS and an access CDS?
A transfer CDS moves data between domains under strict filtering, such as exporting reports from a high domain to a low one. An access CDS lets a user work with multiple domains from one point without bridging the domains themselves.
How does a cross-domain solution relate to a data diode?
A data diode often provides the hardware enforcement of direction within a CDS, ensuring data flows only the approved way. A guard adds content inspection and filtering. Together they enforce both direction and what is allowed to cross.
Why do cross-domain solutions need content inspection?
Direction alone does not stop the wrong content from crossing, such as sensitive data leaking out or malicious content coming in. Inspection validates data types, strips hidden content, releases only approved fields and prevents covert channels.
Are cross-domain solutions only used by governments?
They originated in government and defense, but cross-domain thinking applies wherever data crosses between a protected domain and a less-trusted one, including OT, critical infrastructure and high-value enterprise systems.
SRCSources of record
Bridge trust boundaries safely
Cross the boundary in one direction, in an approved form.
Apply cross-domain thinking to OT: enforce direction, validate what leaves, and keep the protected domain unreachable through the boundary.