03.12.05 Information Exchange

Statement

• a. Approve and manage the exchange of CUI between the system and other systems using {{ insert: param, A.03.12.05.ODP.01 }}.

• b. Document interface characteristics, security requirements, and responsibilities for each system as part of the exchange agreements.

• c. Review and update the exchange agreements {{ insert: param, A.03.12.05.ODP.02 }}.

Guidance

Information exchange applies to information exchanges between two or more systems, both internal and external to the organization. Organizations consider the risks related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security requirements or policies. The types of agreements selected are based on factors such as the relationship between the organizations exchanging information (e.g., government to government, business to business, government to business, government or business, or government or business to individual) and the level of access to the organizational system by users of the other system. The types of agreements can include information exchange security agreements, interconnection security agreements, memoranda of understanding or agreement, service-level agreements, or other types of agreements. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (e.g., service providers, contractors, system developers, and system integrators). The types of information contained in exchange agreements include the interface characteristics, security requirements, controls, and responsibilities for each system.

Assessment objective

the exchange of CUI between the system and other systems is approved using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

the exchange of CUI between the system and other systems is managed using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

interface characteristics for each system are documented as part of the exchange agreements.

Assessment objective

security requirements for each system are documented as part of the exchange agreements.

Assessment objective

responsibilities for each system are documented as part of the exchange agreements.

Assessment objective

exchange agreements are reviewed {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment objective

exchange agreements are updated {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment method

• access control policy and procedures procedures for system connections system and communications protection policy and procedures system interconnection security agreements information exchange security agreements service-level agreements memoranda of understanding or agreements non-disclosure agreements system design documentation enterprise architecture security architecture system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with development, implementation, and approval responsibilities for system interconnection agreements personnel who manage systems to which the exchange agreements apply personnel with information security responsibilities

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.