Assessment Objective
Determine if:
- CA-03a. the exchange of information between the system and other systems is approved and managed using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: type of agreement] ];
- CA-03b.
- CA-03b.[01] the interface characteristics are documented as part of each exchange agreement;
- CA-03b.[02] security requirements are documented as part of each exchange agreement;
- CA-03b.[03] privacy requirements are documented as part of each exchange agreement;
- CA-03b.[04] controls are documented as part of each exchange agreement;
- CA-03b.[05] responsibilities for each system are documented as part of each exchange agreement;
- CA-03b.[06] the impact level of the information communicated is documented as part of each exchange agreement;
- CA-03c. agreements are reviewed and updated [Assignment: frequency].
Assessment Methods
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection security agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- enterprise architecture
- system architecture
- system configuration settings and associated documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements
- organizational personnel with information security and privacy responsibilities
- personnel managing the system(s) to which the interconnection security agreement applies
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | CA-03 [L] Information Exchange |