CA-3: System Interconnections

CSF v1.1 References:

Baselines:

  • Low
    • CA-3
  • Moderate
  • High

Next Version:

Control Statement

The organization:

  1. Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements;
  2. Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and
  3. Reviews and updates Interconnection Security Agreements [Assignment: organization-defined frequency].

Supplemental Guidance

This control applies to dedicated connections between information systems (i.e., system interconnections) and does not apply to transitory, user-controlled connections such as email and website browsing. Organizations carefully consider the risks that may be introduced when information systems are connected to other systems with different security requirements and security controls, both within organizations and external to organizations. Authorizing officials determine the risk associated with information system connections and the appropriate controls employed. If interconnecting systems have the same authorizing official, organizations do not need to develop Interconnection Security Agreements. Instead, organizations can describe the interface characteristics between those interconnecting systems in their respective security plans. If interconnecting systems have different authorizing officials within the same organization, organizations can either develop Interconnection Security Agreements or describe the interface characteristics between systems in the security plans for the respective systems. Organizations may also incorporate Interconnection Security Agreement information into formal contracts, especially for interconnections established between federal agencies and nonfederal (i.e., private sector) organizations. Risk considerations also include information systems sharing the same networks. For certain technologies (e.g., space, unmanned aerial vehicles, and medical devices), there may be specialized connections in place during preoperational testing. Such connections may require Interconnection Security Agreements and be subject to additional security controls.

Control Enhancements

CA-3(1): Unclassified National Security System Connections

Baseline(s):

(Not part of any baseline)

The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].

CA-3(2): Classified National Security System Connections

Baseline(s):

(Not part of any baseline)

The organization prohibits the direct connection of a classified, national security system to an external network without the use of [Assignment: organization-defined boundary protection device].

CA-3(3): Unclassified Non-National Security System Connections

Baseline(s):

(Not part of any baseline)

The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [Assignment; organization-defined boundary protection device].

CA-3(4): Connections To Public Networks

Baseline(s):

(Not part of any baseline)

The organization prohibits the direct connection of an [Assignment: organization-defined information system] to a public network.

CA-3(5): Restrictions On External System Connections

Baseline(s):

  • Moderate
  • High

The organization employs [Selection: allow-all, deny-by-exception; deny-all, permit-by-exception] policy for allowing [Assignment: organization-defined information systems] to connect to external information systems.