MOU ISA Intake Form Instructions.pdf

REMEDIATION SERVICES

SUPPORT (RSS) RISK

MANAGEMENT (RM)

BUSINESS REQUIREMENTS

DIVISION (BRD)

Intake Form Instructions MOU-ISA:

How to submit a MOU/ISA or Air- Gapped MOU for BRD Review and Approval Version 1.0

9/27/18

Department of Veterans Affairs: CRISP 9/27/18

Intake Form Instructions: MOU-ISA Page | 2

Revision History

Date Version Description Author

9/12/18 1.0 Initial draft Danial LaBrecque

Intake Form Instructions: MOU-ISA Page | 3

Contents 1 Overview

2 Purpose

3 Objective

4 Procedure

4.1 Existing MOU/ISAs

4.2 New Documents

4.3 Published Documents

4.4 Inactive Agreements

Intake Form Instructions: MOU-ISA Page | 4

Intake Form Instructions: MOU-ISA

1 Overview

Federal security regulations require documentation of security controls for interconnecting systems to ensure the confidentiality, integrity, and availability of networks and data. A Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) are required for the authorization of connections to information systems that do not share the same Authorizing Official.

Department of Veteran Affairs (VA) Handbook 6500, Risk Management Framework for VA Information Systems-Tier 3: VA Information Security Program, states that the MOU/ISA is required to document security controls for external information systems that process, store, or transmit VA information.

In 2013, the VA created an Air-Gapped MOU template in response to findings by the Office of Inspector General (OIG). Although these “Air-Gapped” connections do not physically connect to the VA network, they were found to share telecommunication closets and other space within VA facilities. Due to the proximity of the two networks, the Air-Gapped MOU template was created to document the physical security controls and ongoing monitoring that are in place to prevent the networks from being connected. The Air-Gapped MOU defines the business purpose of the air-gapped equipment; identifies the VA Business Owner, VA managerial staff, and the Business partner/affiliate’s technical POC for the air-gapped equipment; and documents the location of the Business partner/affiliate’s equipment.

2 Purpose

To provide detailed step-by-step instructions on how to submit an MOU document, using the intake form, to the BRD internal VA Review team for reviewal and approval.

3 Objective

To create accurate and complaint MOU/ISA documents for external connections.

Intake Form Instructions: MOU-ISA Page | 5

4 Procedure

Navigate to the MOU-ISA Intake Form Website:

https://vaww.portal2.va.gov/sites/infosecurity/FY15CRISPAudit/CRISPRemediationContract/Work Site/SitePages/MOU-ISA_Version2.aspx https://vaww.portal2.va.gov/sites/infosecurity/FY15CRISPAudit/CRISPRemediationContract/WorkSite/SitePages/MOU-ISA_Version2.aspx https://vaww.portal2.va.gov/sites/infosecurity/FY15CRISPAudit/CRISPRemediationContract/WorkSite/SitePages/MOU-ISA_Version2.aspx

Intake Form Instructions: MOU-ISA Page | 6

4.1 Existing MOU/ISAs

Check to see if there is an existing MOU-ISA document in place.

a. Click on Find Existing Agreement.

b. Search for Existing MOUs by Local or National level of agreement. Click on the triangle to show the list of Parent VA Facilities or National MOU-ISA documents.

c. Search for MOUs by VA Facility. MOUs will be listed under the Parent Site’s GRC Code.

Intake Form Instructions: MOU-ISA Page | 7

4.2 New Documents

Submit a new document for BRD Review and Approval.

a. Click on Submit a New Request.

b. Attach the drafted MOU document as a Microsoft Word formatted file (.doc) by clicking Click here to attach a file.

The latest MOU templates can be found using the link template. The attached document is required.

c. After attaching the MOU-ISA document (or Air-Gapped or other MOU), identify which VA Parent facility this MOU supports in the FACILITY SELECTION FILTERS section of the Intake form. You can narrow down the search for the facility by District, State, Type, and RiskVision code. (Note:

You don’t need to select an entry for each filter, but, for them to work, you need to start at the top and work your way down the filter.)

d. Required Field: Facility: You must select which Parent facility this MOU-ISA document supports.

Intake Form Instructions: MOU-ISA Page | 8

e. Optional Field: GRC System Name: Identify the System name as it appears in GRC.

f. Identify the VA Contacts and the Business Partner

Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

g. Identify the Connection Type from the drop-down menu.

h. If possible, identify the Connection Category of the external connection.

i. Click the SUBMIT button to submit the request. If nothing happens, there are required fields that still need to be addressed.

Intake Form Instructions: MOU-ISA Page | 9

j. Once the request has been successfully submitted, the

MOU-ISA Intake Form page will load, showing the new request has been added.

4.3 Published Documents

Submit a published document for BRD Master Record publication.

a. From the Main page, select Publish a Signed Agreement.

b. This will bring up the Enterprise MOU-ISA Intake Form to publish a signed Document view. Attach the BRD Approved MOU document as a Portable Document Format (PDF) formatted file (.pdf) by clicking Click here to attach a file.

The attached document is required.

c. After attaching the MOU-ISA document (or Air-Gapped or other MOU), identify which VA Parent facility this MOU supports in the FACILITY SELECTION FILTERS section of the Intake form. You can narrow down the search for the facility by District, State, Type, and Risk Vision code. (Note: You don’t need to select an entry for

Intake Form Instructions: MOU-ISA Page | 10 each filter, but, for them to work, you need to start at the top and work your way down the filter.)

d. Required Field: Facility: You must select which

Parent facility this MOU-ISA document supports.

e. Optional Field: GRC System Name: Identify the System name as it appears in GRC.

f. Identify the VA Contacts and the Business Partner Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

g. Identify the Connection Type from the drop-down menu.

Intake Form Instructions: MOU-ISA Page | 11

h. If possible, identify the Connection Category of the external connection.

i. Click the SUBMIT button to submit the request. If nothing

j. Once the request has been successfully submitted, the

4.4 Inactive Agreements

Inform BRD that an existing agreement has become inactive.

a. Click on Agreement No Longer Needed.

Intake Form Instructions: MOU-ISA Page | 12

b. Under the Work Request

Summary section, provide justification as to why this agreement is no longer needed, and whether the Connection has been decommissioned.

c. Optional Field: GRC System Name: Identify the System name as it appears in GRC.

d. Identify which VA Parent facility this MOU supports in the FACILITY SELECTION FILTERS section of the Intake form. You can narrow down the search for the facility by District, State, Type, and Risk Vision code. (Note: You don’t need to select an entry for each filter, but, for them to work, you need to start at the top and work your way down the filter.)

e. Required Field: Facility: You must select which Parent facility this MOU-ISA document supports.

Intake Form Instructions: MOU-ISA Page | 13

f. Identify the VA Contacts and the Business Partner Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

g. Identify the Connection Type from the drop-down menu.

h. Click the SUBMIT button to submit the request. If nothing

i. Once the request has been successfully submitted, the