Overview
The goal of the Information System/Data Flow Diagram is to capture the main components of an Information System, how data moves within the system, user-interaction points, and the Authorization Boundary.
What is a Data Flow Diagram?
A data flow diagram illustrates how data flows throughout the system. It answers the following questions:
- How does data enter the system?
- How and where does data travel within the system?
- How does data exit the system?
- How is data changed or transformed throughout the system?
- Where is data stored?
Follow the data. A flowchart shows the order of tasks and decisions. A data flow diagram shows the information passed between people, tools, and storage.
Example
In this example, a person send survey answers to a survey tool. The tool saves the responses. An analysis tools reads the saved responses and creates a summary for the project team.
| Symbol |
Meaning |
What to Write |
| Rectangle |
A person, group, or outside system that sends or gets data. |
Survey participant; project team |
| Rounded rectangle |
A task that collects, uses, or changes data. This is called a process. |
Collect responses; create summary |
| Two parallel lines |
A place where data is kept. This is called data storage. |
Survey records; shared folder. |
| Arrow |
Data moving from one place to another. |
Survey answers; summary results |
Instructions for Asset Administrators:
- Open Visio for the web. Sign into Microsoft 365 with your university account. Open the app launcher, select All apps, and choose Visio. Available to everyone at https://m365.cloud.microsoft/launch/Visio. Choose Basic Diagram or Blank Drawing.
- Add the shapes. Drag shapes from the Shapes panel onto the page. Use the four symbols described above. You can build the storage symbol with two straight lines and a text box. If needed, choose Add Shapes to see more choices.
- Name each shape. Select a shape and type its name. Name people and storage with short labels, such as Student or Grade records. Name tasks with action words, such as Collect answers. Add the real tool name below the task. Click outside the shape when done.
- Connect the shapes. Point at the edge of the shape that sends data. When a connection point appears, click and drag to the shape that gets it. Release when the target shows a green connection mark. Select the connector. Choose Shape > Shape Outline > Arrows to add an arrowhead at the receiving end.
- Label every arrow. Select the connector and type the data being sent, such as Student ID and assignment or survey answers. Press Esc when done. Use two arrows if different data moves both ways. Move a shape to check that its connectors stay attached.
- Add useful notes. Use Insert > Text Box to add the map title, owner, and date. Note the data types and any known OU data category. Label tools or storage hosted by a vendor. Include email, downloads, shared files, and AI tools if they receive or keep data.
Need More Help?
Visit this short LinkedIn Learning course to learn more about Data Flow Diagrams with Trust Boundaries.
Control References
- NIST Cybersecurity Framework: ID.AM-3
- NIST SP800-53: AC-4, CA-3, CA-9, PL-8
- HIPAA Security Rule: 164.308(a)(1)(ii)(A), 164.308(a)(3)(ii)(A), 164.308(a)(8), 164.310(d)
- PCI DSS 3.2.1: 1.1.2, 1.1.3
- FERPA PTAC Data Security Checklist: Policy and governance
- CJIS: 5.10
- NIST SP800-171: 3.1.3