ATTACHMENT 4 MOU ISA Intake Form Instructions.pdf

Enterprise Cybersecurity Support Division

OFFICE OF

INFORMATION

SECURITY

Intake Form Instructions MOU-ISA:

How to Submit an MOU/ISA for ECSD Review and Approval May 5, 2022 | Version 3.0

OFFICE OF INFORMATION AND TECHNOLOGY

OFFICE OF INFORMATION SECURITY Page | 2

Revision History

Date Version Description Author

9/12/18 1.0 Initial draft Daniel LaBrecque

9/28/21 2.0 Updated Images Dallas Donovan

05/05/22 3.0 Updated Links and instructions Daniel LaBrecque

OFFICE OF INFORMATION SECURITY Page | 3

Table of Contents 1 Overview

2 Purpose

3 Objective

4 Procedure

4.1 Existing MOU/ISAs

4.2 New Documents

4.3 Published Documents

4.4 Inactive Agreements

OFFICE OF INFORMATION SECURITY Page | 4

Intake Form Instructions: MOU-ISA

1 Overview

Federal security regulations require documentation of security controls for interconnecting systems to ensure the confidentiality, integrity, and availability of networks and data. A Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) are required for the authorization of connections to information systems that do not share the same Authorizing Official.

Department of Veteran Affairs (VA) Handbook 6500, Risk Management Framework for VA Information Systems-Tier 3: VA Information Security Program, states that the MOU/ISA is required to document security controls for external information systems that process, store, or transmit VA information.

2 Purpose

To provide detailed step-by-step instructions on how to submit an MOU/ISA document, using the intake form, to the Enterprise Cybersecurity Support Division (ECSD) (formally Business Requirements Division (BRD)) internal VA Review team for reviewal and approval.

3 Objective

To create accurate and complaint MOU/ISA documents for external connections.

OFFICE OF INFORMATION SECURITY Page | 5

4 Procedure Navigate to the MOU-ISA Intake Form Website:

https://dvagov.sharepoint.com/sites/OITSSPPlatform/SitePages/MOU-ISA_Version2.aspx https://dvagov.sharepoint.com/sites/OITSSPPlatform/SitePages/MOU-ISA_Version2.aspx

OFFICE OF INFORMATION SECURITY Page | 6

Existing MOU/ISAs Check to see if there is an existing MOU-ISA document in place.

Click on Find Existing Agreement.

a. Search for Existing MOUs by Local (and System) or National level of agreement. Click on the triangle to show the list of Parent VA Facilities or National MOU-ISA documents.

b. Search for MOUs by VA Facility. MOUs will be listed under the Parent Site’s Facility Code (GRC Code).

OFFICE OF INFORMATION SECURITY Page | 7

5 New Documents

Submit a new document for ECSD Review and Approval.

5.1 Click on Submit a New Request.

5.2 Attach the drafted MOU/ISA document as a Microsoft Word

formatted file (.doc) (or LAN Extension) by clicking Click here to attach a file. The latest MOU templates can be found using the link template. The attached document is required.

5.3 Required Field: Facility: You must select which

Parent facility this MOU-ISA document supports.

5.4 GRC System Name: Identify the System name as it

appears in GRC.

5.5 Optionally, identify additional Facility options

this MOU supports in the FACILITY SELECTION FILTERS section of the Intake form. You can narrow down the search for the facility by District, State, Type, and GRC code. (Note: You don’t need to select an entry for each filter, but, for them to work, you need to start at the top and work your way down the filter.)

5.6 If the External Connection is for a VA System that

isn't facility specific, or is hosted at a VA Data center or VA Cloud Environment; select "System ()" from the FACILITY SELECTION FILTER, and do no select any options for Distric, State, Type or GRC Code.

OFFICE OF INFORMATION SECURITY Page | 8

5.7 Identify the VA Contacts and the Business Partner

Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

5.8 Identify the Connection Type from the drop-down

menu.

5.9 Identify the Connection Category

of the external connection.

5.10 Click the SAVE & CLOSE button to submit the request. If nothing happens, there are required fields that still need to be addressed.

OFFICE OF INFORMATION SECURITY Page | 9

5.11 Once the request has been successfully submitted, the MOU- ISA Intake Form page will load, showing the new request has been added.

6 Published Documents

Submit a published document for ECSD Master Record publication.

From the Main page, select Publish a Signed Agreement.

This will bring up the Enterprise MOU-ISA Intake Form to publish a signed Document view. Attach the ECSD Approved MOU document as a Portable Document Format (PDF) formatted file (.pdf) by clicking Click here to attach a file. The attached document is required.

• After attaching the MOU-ISA document (or other MOU), identify which VA Parent facility this MOU supports in the FACILITY SELECTION FILTERS section of the Intake form. You can narrow down the search for the facility by District, State, Type, and Risk Vision code. (Note: You don’t need to select an entry for

OFFICE OF INFORMATION SECURITY Page | 10 each filter, but, for them to work, you need to start at the top and work your way down the filter.)

• Required Field:

Facility: You must select which Parent facility this MOU-ISA document supports.

• Field: GRC System Name: Identify the System name as it appears in GRC.

• Identify the VA Contacts and the Business Partner Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

• Identify the Connection Type from the drop-down menu.

OFFICE OF INFORMATION SECURITY Page | 11

• Identify the Connection Category of the external connection.

• Click the SAVE & CLOSE button to submit the request.

If nothing happens, there are required fields that still need to be addressed.

• Once the request has been successfully submitted, the MOU-ISA Intake Form page will load, showing the new request has been added.

4.5 Inactive Agreements

Inform ECSD that an existing agreement has become inactive.

• Click on Agreement No Longer Needed.

OFFICE OF INFORMATION SECURITY Page | 12

• Under the Work

Reque st Summ ary section provid e justific ation as to why this agree ment is no longer neede d, and wheth er the Conne ction has been decom missio ned.

OFFICE OF INFORMATION SECURITY Page | 13

• Optional Field: GRC System Name: Identify the System name as it appears in

GRC.

• Identify which VA Parent facility this MOU supports in the FACILITY

SELECTION FILTERS

section of the Intake form. You can narrow down the search for the facility by District, State, Type, and Risk Vision code. (Note: You don’t need to select an entry for each filter, but, for them to work, you need to start at the top and work your way down the filter.)

• Required Field:

Facility: You must select which Parent facility this MOU-ISA document supports.

OFFICE OF INFORMATION SECURITY Page | 14

• Identify the VA Contacts and the Business Partner Contacts. The Business Partner name field should document the name of the Organization or Business that the external connection supports.

• Identify the Connection Type from the drop-down menu.

• Click the SAVE & CLOSE button to submit the request.

If nothing happens, there are required fields that still need to be addressed.

• Once the request has been successfully submitted, the MOU-ISA Intake Form page will load, showing the new request has been added.