Exhibit E Payroll Interconnection Service Agreement.docx

Interconnection Security Agreement & Memorandum of Understanding Between [System A Name] & NFC Enterprise Infrastructure and Platforms (NFC-EIP) [Agency A] USDA/OCIO/Digital Infrastructure Services Center (DISC) Revision: 1.0 Date: Month, Year

United States Department of Agriculture 1400 Independence Ave., SW Washington, DC 20250

Sensitive But Unclassified/Sensitive Security Information – Disseminate on a Need-To-Know Basis Only

Template Release January 2020 Document Information [System A] Point of Contact

Name

Contact Number

E-mail Address

NFC Enterprise Infrastructure and Platforms Point of Contact

Name

Contact Number

E-mail Address

Document Review

<System A>

David Ireland

Distribution List

<System A>

OCIO DISC

OCIO DISC

Document Template Change Control Log

11/11/2020

04/05/2021

Nondisclosure Statements All interconnected systems, including those operated by contractor and cloud service providers, shall contain nondisclosure language in the Interconnection Security Agreement (ISA) and Memorandum of Understanding/Agreement (MOU/A) and require a nondisclosure agreement to be signed by all contractors who will access USDA information or information systems. The Whistleblower Protection Enhancement Act (WPEA) of 2012, 5 United States Code (U.S.C.) § 2301 et seq. (June 11, 2014) makes it a prohibited personnel practice for Federal agencies to enter into any “nondisclosure policy, form, or agreement” that does not include the following specific language:

“These provisions are consistent with, and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or executive order relating to:

(1) Classified information;

(2) Communications to Congress;

(3) The reporting to the Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety; or

(4) Any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling.”

ISA & MOU Between [System A Name] & NFC-EIP

Page 7 Date: [Month Year]

Sensitive But Unclassified/Sensitive Security Information – Disseminate on a Need-To-Know Basis Only

Template Release January 2020 Interconnection Security Agreement Authorization We have carefully reviewed the Interconnection Security Agreement (ISA) between [System A Name (System Acronym)] and NFC Enterprise Infrastructure and Platforms (NFC-EIP). This document has been completed in accordance with the requirements set forth in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems. This agreement will be reviewed annually and will be re-signed by all parties every third year. Note that systems designated as an HVA must have two authorizing official signatures.

[System A Name (System Acronym)]

x

Information System Owner

x

[Agency] Information System Security Manager

x

[System] Authorizing Official

x

[System] Authorizing Official (Second Authorizing Official signature, for HVA system, if applicable. If not, delete this signature box)

OCIO DISC NFC Enterprise Infrastructure and Platforms (NFC-EIP)

Date x

DISC Information System Owner

Date

X

DISC Information System Security Manager

Date x

DISC Authorizing Official

Date x

DISC Authorizing Official

Table of Contents

NOTE TO AUTHOR: Highlighted, italicized text throughout this template is provided solely to assist you in creating this document. Please delete all such text prior to submitting this document. In addition, replace all items enclosed in square brackets [ ] with actual information and remove the highlighting.

Introduction A system interconnection is defined as the direct connection of two or more information technology (IT) systems for the purpose of sharing data and other information resources. The NIST SP 800-53, Revision 4 Security Assessment and Authorization - Control 3 (CA-3) primarily refers to connections but uses the terms connections and interconnections interchangeably. An interconnection security agreement (ISA) is used to document connections between systems. The ISA is much more than a contract or service agreement between two agencies/departments/divisions/external entities; the ISA is a security agreement that protects both interconnected systems. NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems states the intent behind an ISA is to detail some basic system information and then to document and agree on how the security of the two systems will be maintained. Significant benefits that can be realized through a system connection include: reduced operating costs, greater functionality, improved efficiency, and centralized access to data. Interconnecting IT systems may also strengthen ties among participating organizations by promoting communication and cooperation.

This document supersedes the previous Interconnection Security Agreement, established on Month Date, Year [former ISA date of last signature] (If Applicable) Connection Purpose

2.1 System Identification

System A:

[Department, Agency, Division, External Entity System Name (System Acronym)]

System B:

USDA, OCIO, DISC NFC Enterprise Infrastructure and Platforms (NFC-EIP)

Describe the purpose of the interconnection. If the purpose is to provide connectivity (such as an application residing on a general support system (GSS) then explain that. If the connection purpose is to share or pass information, generally what information is passed? Is the information PII and if so, exactly what PII is passed. Include description of data exchanged, direction of data exchange, and frequency of transfers. For external support services, include the service description, expected availability (uptime) of the service, technical points of contacts, incident response contacts at both organizations, importance of the external service. Describe the acceptable uses of the information exchanged, restrictions on sharing the information, and at what level the information is to be protected. Reduction of the data set exchanged to the minimum data elements necessary for the receiving organization to perform their function should be considered. A risk assessment is performed on the reduced data elements to determine if the information impact level has changed The NFC Enterprise Infrastructure and Platforms (NFC-EIP) System is a general support system (GSS) operated by the Digital Infrastructure Services Center.

The system is designed following the Platform-as-a-Service (PaaS) cloud computing model. This private cloud allows multiple NFC systems to provision services on shared infrastructure. NFC-EIP provides the underlying operating systems, storage and networking connectivity and security for all NFC systems.

2.3 Information Sensitivity

Describe the sensitive nature of the information. If there is privacy data on the system, please make sure that is identified in Section 2.2.

[System A] has a security classification of [Low, Moderate, or High]. NFC Enterprise Infrastructure and Platforms (NFC-EIP) has a security classification of Moderate.

The interconnecting systems consider the following control overlays:

System A

Connection Specifics

3.1 Connection Method

How are the two systems connected? Direct connect? Virtual Private Network? Over the Internet? FIPS-140-2 compliant encryption? Include IP addresses, DNS names, protocols, ports, frequency of transfers The connection method between NFC Enterprise Infrastructure and Platforms (NFC-EIP) and [System A] is confined to a one-way Secure File Transfer Protocol (SFTP) transaction to the NFC-EIP boundary.

NFC-EIP is hosted at USDA, OCIO, Digital Infrastructure Services Center (DISC) in Kansas City, MO. NFC-EIP is managed by DISC Information Technology Services Division technical network subject matter experts.

SFTP Server-to-Server

System A DNS Name

DNS Name

IP Address

Joseph Weaver Quentin Lewis

3.2 Connection Segregation

If the two systems being connected have different FIPS 199 categorizations, how are the systems going to be segregated to ensure that a vulnerability that could be exploited on the lower categorized system cannot be used to compromise the higher categorized system. If there is no difference in the FIPS 199 categorization, state “If there were a difference in categorization, this section would detail how the systems are segregated to ensure that a vulnerability in a lower categorized system cannot be used to compromise the higher categorized system.

The design and implementation for each connected application will determine the specifics of what controls can be inherited or shared. The infrastructure and applications are sufficiently segregated to ensure that vulnerability could not be exploited between NFC-EIP and [System A]. The extent of the system interactions is file transfer.

All users and administrators are expected to protect the information transmitted in accordance with all required laws, regulations, and NIST guidance.

System Vulnerabilities One system's vulnerabilities can have an adverse impact on the security of another system, especially when the two systems are connected and sharing information. Because of this, the system owners and the security officers must be aware of the identified vulnerabilities of all the systems that are connected to their system.

At the time of entering into this ISA, the current Plan Of Action and Milestones (POA&M) for [System A] can be found in Appendix A. The POA&M for NFC-EIP can be found in Appendix B. Special attention should be paid to any moderate, high and critical vulnerabilities. For these levels of vulnerabilities, the system owners for both systems agree to work with each other and USDA/OCIO Information Security Center, who is responsible for reporting vulnerabilities and oversight of the vulnerability process, per DR3530-006_Scan-Patch-Vuln (current version).

Common/Hybrid Controls Some connected systems rely heavily on the other connected systems for control implementations that are common across the two (or more) systems that are connected. This occurs often when an application resides on a GSS. The GSS provides a certain number of controls to all applications (and possibly other GSSs) that reside on it. For these circumstances, the owner of the system that is inheriting the controls specifies all the controls that are inherited from the other system in the template in Appendix C. Note that the template also contains hybrid controls where the common portion of the control is provided by the GSS. For systems that just share data, this section and the appendix are not applicable. Please see Section 2.2 for the direction of the information shared between the systems.

The system owner of the system that is inheriting controls from the GSS, must check off all inherited/hybrid controls in Appendix C.

Incident Reporting Document the process each system owner will follow in the event of an incident. Include Incident Response Contact at both organizations. (Ex: An incident identified with either system will immediately be reported to the other system's owner/security officer.)

Each organization will report incidents in accordance with USDA directives, policies, and procedures.

Each organization will keep the other organization informed in writing through their respective ISSM when incidents occur which might have any impact on the other organization’s systems. These information exchanges will take place as soon as practical to ensure that appropriate steps are taken as soon as possible to mitigate any potential loss/compromise of data or denial of service.

[System A’s] Incident Reporting Procedure

NFC’s Incident Reporting Procedure Report incidents or violations of this agreement and supporting policies identified above, which potentially represent a risk to any of the systems covered under this ISA, within 1 hour to the NFC’s Operations and Security Center (OSC) by calling (800) 767-9641 or by email to: osc.etix@usda.gov.

NFC security incident contact information is attached to the applicable ISA. OSC is staffed 24 hours per day, 7 days per week.

The DISC ISSM is David Ireland who can be contacted at xxxxx and by reporting any security incident to the DISC Service Desk at the service portal, DISC.Service.Desk@usda.gov, or by calling 888-873-6482. The Service desk is staffed 24 hours a day, 7 days a week.

Backups/Updates/Changes Document who is responsible for performing backups of the data. Who must be notified if any changes are going to be made to either system? How significant does the change need to be to warrant such notification? What notification is required when maintenance will be performed on the system? Any proposed environmental or operational changes are communicated to both parties and a risk assessment is performed to determine the impact to both organizations due to the change prior to implementation.

Backups and system changes will be handled per the procedures documented for the system SLA or MOU.

Planned technical updates and changes to the system architecture expected to impact customer agencies will be reported and approved by both parties before such changes are implemented. If any of the technical changes significantly affect the security of the systems, the initiating party agrees to conduct a risk assessment based on the new system architecture and to modify and re-sign the ISA within one month of implementation. If a new unapproved interconnection, interface, and/or service is detected, it will be refused and documented as a possible intrusion until authorized.

User Community Describe the “user community” that will be served by the interconnection, including their approved access levels and the lowest approval level of any individual who will have access to the interconnection. Also, discuss requirements for background investigations and security clearances, if appropriate.

All NFC-EIP users with access to the data received from [System A] are U.S. citizens with a valid and current NFC-EIP background investigation. All [System A] users with access to the data received from NFC-EIP are U.S. citizens with a valid and current [System A] background investigation.

[System A] User community description Rules of Behavior Summarize the aspects of behavior expected from users who will have access to the interconnection. Each system is expected to protect information belonging to the other through the implementation of security controls that protect against intrusion, tampering, and viruses, among others. Do not enter statements of law or policy. If the systems are from different departments or external entities, consider appending both department's/entities rules of behavior to this agreement.

All users of the NFC-EIP system are required to obtain security awareness training on a regular basis. This policy is enforced through USDA AgLearn.

There are no new or additional security awareness or training requirements needed because of the interconnections between the systems identified in this agreement.

All users and administrators are expected to protect the information transmitted in accordance with all required laws, regulations, and NIST guidance.

Both parties agree to work together to ensure the joint security of the connected systems and the data they store, process, and transmit. Each party certifies that its respective system is designed, managed, and operated in compliance with all relevant agency regulations, official guidance, and policies. As part of assuring this compliance for the security and benefit of each partner organization, thorough review of each system’s System Security Plans (SSPs), has been performed.

<<SYSTEM A>> users and NFC-EIP system users are expected to protect the integrity of each agencies data and systems, in accordance with the Privacy Act of 1974 (5 United States Code (U.S.C.) 552a), and Trade Secrets Act (18 U.S.C. 1905), and the Unauthorized Access Act (18 U.S.C. 2701 and 2710).

Controls This section is for the documenting of any specific controls that must be maintained in order to ensure the connection is secure.

There are no special considerations specific to the interconnectivity.

Cost Considerations Briefly describe any cost issues/considerations that need to be identified. If different departments/agencies/external entities are involved, or if the method of interconnection is expensive, the following example may be used:

An initial implementation of a connection or changes to an existing connection to the services described herein will be agreed upon at the time of the connection request. The ongoing operations and maintenance for the connection will be included in annual fees to the Agency that are documented separate from this Interconnection Security Agreement.

Both parties agree to equally share the costs of the interconnecting mechanism and/or media, but no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owners’ organization.

Audit Trail Responsibilities Describe how the audit trail responsibility will be shared by the organizations and what events each organization will log. Specify the length of time that audit logs will be retained. If no audit trail is performed, so state.

The organizations agree to implement audit and accountability policies and procedures as required by USDA and Federal guidance (i.e., FIPS 200) for proactive and post-incident response efforts.

Where agreed upon in writing, each organization through their respective ISSM, will provide relevant audit and accountability data to support incident response efforts. Currently, USDA OCIO policy is to retain audit logs for 1 year, unless there is jurisdiction to require longer retention.

Topological/Informational Flow Drawing Provide a topological and/or information flow drawing that clearly shows the systems and their interconnection. Please include as much detail as possible including, but not limited to connection methods and the following info if applicable:

· Topology date

· CCSD (preferably near premise router)

· IP addresses for all devices within the enclave, and the following devices must

· include additional information specific to them:

· Firewalls: manufacturer, model, and software/firmware version

· IDS: manufacturer, model, and software/firmware version

· Servers: server function (i.e., OWA, Web Server, etc.) and operating system

· (including most updated Service Pack installed on system)

· Workstations: operating system (including most updated Service Pack installed on system) See example below:

USDA-DISC-NFC-EIP Network Topology Diagram Timeline This agreement will remain in effect for one (1) year after the last date on either Authorizing Official's signature, unless events occur to terminate the agreement such as Authority to Operate becoming expired or unaccredited or the cessation and decommission of either of the systems. After one (1) year, this agreement can be continued for an additional two years with concurrence from the ISSMs for the systems involved. If the parties wish to extend this agreement beyond the three years, they may do so by reviewing, updating, and reauthorizing this agreement. The newly signed agreement should explicitly supersede this agreement, which should be referenced by title and date. If one or both of the parties wish to terminate this agreement prematurely, they may do so with 30 days advanced notice or in the event of a security incident that necessitates an immediate response.

Connection Termination Describe information disposition at the termination of the interconnection. Please consult NARA guidelines USDA directives for records retention requirements, and actions required at the end of retention periods.

[System A Name] Plan of Action and Milestones Please list Open POA&Ms or remediation items related to unfavorable assessment results.

Below is a complete listing of open items from this system's POA&M.

NFC-EIP Plan of Action and Milestones Due to the dynamic nature of the POA&M lifecycle, timely information about POA&Ms associated with any of the DISC System Security Boundaries can be obtained by contacting the DISC Service Desk at 1-888-873-6482 or DISC.Servicedesk@usda.gov .

Page 9 Date: [Month, Year]

Sensitive but Unclassified/Sensitive Security Information – Disseminate on a Need-To-Know Basis Only

Template Release January 2020 Inherited controls Below is a complete listing NIST SP 800-53 Rev. 4 Controls. Any controls [System A] inherits from the host system, NFC-EIP, will be checked below. Hybrid controls, due to their dual nature, are also listed. This listing helps the system owners by explicitly listing those controls that are specifically needed. If there is an existing RACI lining out inherited controls, you may use that in place of the table provided.

NIST SP 800-53 Revision 4

AC-1

AC-2

AC-3

AC-4

AC-5

AC-6

AC-7

AC-8

AC-10

AC-11

AC-12

AC-14

AC-17

AC-18

AC-19

AC-20

AC-21

AC-22

AT-1

AT-2

AT-3

AT-4

AU-1

AU-2

AU-3

AU-4

AU-5

AU-6

AU-7

AU-8

AU-9

AU-10

AU-11

AU-12

AU-16

HVA

CA-1

CA-2

CA-3

CA-5

CA-6

CA-7

CA-8

CA-9

CM-1

CM-2

CM-3

CM-4

CM-5

CM-6

CM-7

CM-8

CM-9

CM-10

CM-11

CP-1

CP-2

CP-3

CP-4

CP-6

CP-7

CP-8

CP-9

CP-10

IA-1

IA-2

IA-3

IA-4

IA-5

IA-6

IA-7

IA-8

IR-1

IR-2

IR-3

IR-4

IR-5

IR-6

IR-7

IR-8

MA-1

MA-2

MA-3

MA-4

MA-5

MA-6

MP-1

MP-2

MP-3

MP-4

MP-5

MP-6

MP-7

PE-1

PE-2

PE-3

PE-4

PE-5

PE-6

PE-8

PE-9

PE-10

PE-11

PE-12

PE-13

PE-14

PE-15

PE-16

PE-17

PE-18

PL-1

PL-2

PL-4

PL-8

PL-10

HVA

PS-1

PS-2

PS-3

PS-4

PS-5

PS-6

PS-7

PS-8

RA-1

RA-2

RA-3

RA-5

SA-1

SA-2

SA-3

SA-4

SA-5

SA-8

SA-9

SA-10

SA-11

SA-12

SA-15

SA-16

SA-17

SC-1

SC-2

SC-3

SC-4

SC-5

SC-7

SC-8

SC-10

SC-12

SC-13

SC-15

SC-17

SC-18

SC-19

SC-20

(Authoritative Source)

SC-21

(Recursive or Caching Resolver)

SC-22

Name/Address Resolution Service

SC-23

SC-24

SC-28

SC-39

SI-1

SI-2

SI-3

SI-4

SI-5

SI-6

SI-7

SI-8

SI-10

SI-11

SI-12

SI-16

image1.jpeg image3.jpeg image2.jpeg