Attachment-G6-ACF_Interconnection Security Agreement_V1.0.docx

Enter System Name ACF

Interconnection Security Agreement Enter System Name

Between Enter staff Div. name and Enter Other Internal/External Organization Name

Version 1.0 Dated: 6/26/25

Table of Contents

1. Interconnection Statement of Requirements This interconnection security agreement pertains to the specified technical and security requirements regarding the interconnection between the two systems. The standard benefits that can be obtained between the interconnected systems can range, but not be limited to:

· The exchange of data and information between specific users

· Customized levels of access to proprietary databases

· Potential 24×7 communications

Specify the information or data exchanged between the two systems:

Enter information or data

Specify the purpose of the exchange of information or data:

Enter purpose

Please reference the Interconnections section in the System Security Plan (SSP) for further details.

2. System Security Considerations

2.1 General Information/Data Description

Document the information & data that will be exchanged, as well as the location of the systems involved.

2.2 Services Offered

Specify whether the services offered are user services or not. If there are user services, summarize what they are and how data is exchanged (e.g., email, file transfer protocol, database query, file query) between the systems. List all services.

2.3 Data Sensitivity

This categorization should be based on FIPS 199 Standards for Security Categorization of Federal Information and Information Systems and NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories. The data categorization should match the overall system security categorization in the System Security Plan.

What is the data categorization?

Select an answer

2.4 User Community

List users’ access authorizations, the rights associated with each authorization type, and any required characteristics of the user community based on data sensitivity (e.g., employment status, nationality, or whether background checks or security clearances).

2.5 Information Exchange Security

Describe the technical services for secure system communication. Specify if a VPN tunnel is used and list any encryption types employed.

Enter description

2.6 Rules of Behavior

Provide each system’s Rules of Behavior governing users in compliance with the Privacy Act, OMB A-130.

Enter Rules of Behavior

2.7 Formal Security Plans

Provide the names of the formal security plans that govern each system and link to the documents. Include other relevant documents if applicable.

2.8 Incident Reporting

Note that if either party discovers a security incident, that party is responsible for reporting it in accordance with agency-specific incident reporting procedures.

2.9 Audit Trail Responsibilities

Detail the activities that will be recorded by each or both agencies in the course of auditing application processes and user activities involving this interconnection.

Enter activities

2.10 Security Parameters

Provide the authentication security parameters being exchanged.

Enter security parameters

2.11 Operational Security Mode

Provide each system’s security categorization (confidentiality, integrity, and availability):

2.12 Training and Awareness

Describe any security training and awareness required due to the interconnection and assign responsibility for the tasks performed.

Enter training and awareness details

2.13 Specific Equipment Restrictions

Describe any revised or new restrictions on terminals.

Enter revised information

2.14 System Connectivity

Describe special considerations for dial-up and broadband connections to systems involved in the interconnection agreement.

Enter special considerations

3. Topology Drawing Include a one-page topological drawing depicting the interconnectivity from endpoint to endpoint. Include the following:

All communications paths, circuits, and other features used for the interconnection.

All logical locations of components (e.g., mainframe computers, host processors, hubs, firewalls, encryption devices, routers, etc.)

Insert diagram:

4. Approval and Authorization This ISA is valid for Enter specific time frame after the latest date on either signature below if the technology documented herein does not change or if there are no other intervening requirements for update. At that time, it must be reviewed, updated, and reauthorized. Either party may terminate this agreement with 30 days advance notice. Noncompliance on the part of the party and/or its employees or contractors concerning security policies, standards, and procedures explained herein may result in immediate termination of this agreement.

Digital Signature for System Owner – Date

Digital Signature for ACF CISO or Deputy CISO – Date

Digital Signature for Partner – Date

Document Revision History

Version 1.0 Interconnection Security Agreement 1 image1.png image2.png image3.png