Root ACDFFC

MP-AC-iDF-VFC

Finds a data flow not encrypted by a key from a vault, flowing from a client to or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access, any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsFrom or Client) in control strategies.