03.12.05 Information Exchange

Statement

• a. Approve and manage the exchange of CUI between the system and other systems using {{ insert: param, A.03.12.05.ODP.01 }}.

• b. Document interface characteristics, security requirements, and responsibilities for each system as part of the exchange agreements.

• c. Review and update the exchange agreements {{ insert: param, A.03.12.05.ODP.02 }}.

Guidance

Information exchange applies to information exchanges between two or more systems, both internal and external to the organization. Organizations consider the risks related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security requirements or policies. The types of agreements selected are based on factors such as the relationship between the organizations exchanging information (e.g., government to government, business to business, government to business, government or business, or government or business to individual) and the level of access to the organizational system by users of the other system. The types of agreements can include information exchange security agreements, interconnection security agreements, memoranda of understanding or agreement, service-level agreements, or other types of agreements. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (e.g., service providers, contractors, system developers, and system integrators). The types of information contained in exchange agreements include the interface characteristics, security requirements, controls, and responsibilities for each system.

Assessment objective

the exchange of CUI between the system and other systems is approved using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

the exchange of CUI between the system and other systems is managed using {{ insert: param, A.03.12.05.ODP.01 }}.

Assessment objective

interface characteristics for each system are documented as part of the exchange agreements.

Assessment objective

security requirements for each system are documented as part of the exchange agreements.

Assessment objective

responsibilities for each system are documented as part of the exchange agreements.

Assessment objective

exchange agreements are reviewed {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment objective

exchange agreements are updated {{ insert: param, A.03.12.05.ODP.02 }} .

Assessment method

• access control policy and procedures procedures for system connections system and communications protection policy and procedures system interconnection security agreements information exchange security agreements service-level agreements memoranda of understanding or agreements non-disclosure agreements system design documentation enterprise architecture security architecture system configuration settings system security plan other relevant documents or records

Assessment method

• personnel with development, implementation, and approval responsibilities for system interconnection agreements personnel who manage systems to which the exchange agreements apply personnel with information security responsibilities

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final