Task 2 RMF_Security Assessment and Authorization Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Security Assessment and Authorization Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information Technology (IT)"

ii. DoD Instruction 8500.01, "Cybersecurity", as amended

iii. Committee on National Security Systems (CNSS) Instruction No. 1253, " Security Categorization and Control Selection for National Security Systems"

iv. NIST Special Publication 800-53A Revision 4, " Assessing Security and Privacy Controls in Federal Information Systems and Organizations"

v. NIST Special Publication 800-47, "Security Guide for Interconnecting Information Technology Systems"

Table of Contents

Table 1 - SP-800-53v4 Compliance Matrix 1

FOR OFFICIAL USE ONLY

{ACRONYM} {DATE}

SECURITY ASSESSMENT AND AUTHORIZATION PLAN

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

The objective of security assessment and authorization is to provide guidelines for building effective security assessment plans and a comprehensive set of procedures for assessing the effectiveness of security controls.

The DoD has established an integrated enterprise-wide decision structure for cybersecurity risk management (the Risk Management Framework (RMF)) that includes cybersecurity requirements for DoD information technologies will be managed through the RMF consistent with the principals established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37.

This plan ensures that {ACRONYM} follows the established guidelines and requirements for security assessment and authorization. The formal System Security Plan is documented separately. The purpose of this document is to consolidate information and provide traceability to security control requirements.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

2.0 SECURITY ASSESSMENT AND AUTHORIZATION POLICY AND PROCEDURES

It is {ACRONYM} policy that {ACRONYM} will follow the guidance provided in NIST Special Publication 800-53A Revision 4, " Assessing Security and Privacy Controls in Federal Information Systems and Organizations" for the establishment of security assessment and authorization procedures.

The applicable security assessment and authorization procedures are derived from the System Categorization performed in RMF Step 1, which identifies the applicable requirements and tailoring.

The {ACRONYM} Security Assessment Plan (SAP) contains the scope, roles, responsibilities and coordination activities that are required for successful security assessment. The SAP is required to be updated yearly, or when significant changes occur to {ACRONYM}.

All personnel are required to register with the DTIC website to receive update notifications.

Have all {ACRONYM} registered with the DTIC website?

☐ No

☐ Yes

3.0 SECURITY ASSESSMENTS

{ACRONYM} security assessments will be performed to ensure that information security is built into the system; identify weaknesses and deficiencies; provide essential information needed to make risk-based decisions as part of security authorization processes; and ensure compliance to vulnerability mitigation procedures. {ACRONYM} assess security controls as part of:

· initial and ongoing security authorizations;

· FISMA annual assessments;

· continuous monitoring; and

· system life cycle activities

{ACRONYM} security assessment will be conducted on the implemented security controls as documented in System Security Plan.

During RMF Step 4 “Assess Security Controls”, an independent Validator is required to perform testing. While the program office may fund the Validator, the Validator will not report directly to the program manager.

Does the Validator report directly to the {ACRONYM} program manager?

☐ No

☐ Yes

The {ACRONYM} SAP will identify the security controls and those control enhancements under assessment.

Within the {ACRONYM} SAP, is the following information defined:

The {ACRONYM} Security Assessment Report (SAR) will identify the evaluation status of all security controls.

Within the {ACRONYM} SAR, is the following information defined:

4.0 SYSTEM INTERCONNECTIONS

This section applies to dedicated connections between information systems (i.e., system interconnections) and does not apply to transitory, user-controlled connections such as email and website browsing.

{ACRONYM} will carefully consider the risks that may be introduced when information systems are connected to other systems with different security requirements and security controls, both within {ACRONYM} and external to {ACRONYM}. If {ACRONYM} has an interconnection to another system with the same authorizing official, {ACRONYM} do not need to develop an Interconnection Security Agreement. Instead, {ACRONYM} will describe the interface characteristics between those interconnecting systems in the System Security Plan (SSP). If {ACRONYM} has an interconnection to another system with a different authorizing officials, an Interconnection Security Agreements is required.

In the event an Interconnection Security Agreement is required, {ACRONYM} will follow the template found in Enclosure 1 - Interconnection Security Agreement Template, which includes the following information:

· Interface characteristics

· Security requirements

· Nature of information communicated Does the {ACRONYM} require Interconnection Security Agreements?

☐ No

☐ Yes

If Yes, are they reviewed annually?

☐ No

☐ Yes

5.0 SECURITY CERTIFICATION

NIST and DoD have not allocated requirements for this subject area.

6.0 PLAN OF ACTION AND MILESTONES

The Plan of Action and Milestones (POA&M) is a key document in the {ACRONYM} information security program and is subject to federal reporting requirements established by OMB. With the increasing emphasis on organization-wide risk management across all three tiers in the risk management hierarchy (i.e., organization, mission/business process, and information system), organizations view POA&Ms from an organizational perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. POA&M updates are based on findings from security control assessments and continuous monitoring activities.

The following process is used by {ACRONYM} to ensure compliance with POA&M requirements:

1. The POA&M is required and will be maintained in eMASS

2. The POA&M will be updated based on assessment and continuous monitoring activities. At a minimum, the eMASS PO&AM will be updated every 90 days

3. All ongoing findings in the POA&M will contain an adequate risk mitigation

4. PO&AM reporting will be executed in accordance with higher-level guidance

5. All {ACRONYM} stakeholders will review the POA&M annually to ensure consistency

7.0 SECURITY AUTHORIZATION

Security authorizations are official management decisions, conveyed through authorization decision documents, by senior organizational officials or executives (i.e., authorizing officials) to authorize operation of information systems and to explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of agreed-upon security controls.

Has an Authorizing Official been appointed for {ACRONYM}?

☐ No

☒ Yes

Has {ACRONYM} been authorized prior to being placed in service?

☐ No

☐ Yes

If Yes, has the security authorization has been updated within the last three years, when there was a significant change to the system, or if there was a change to the environment in which the system operates?

☐ No

☐ Yes

8.0 CONTINUOUS MONITORING

Continuous monitoring facilitates ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The terms continuous and ongoing imply that organizations assess/analyze security controls and information security-related risks at a frequency sufficient to support organizational risk-based decisions.

The {ACRONYM} Continuous Monitoring Strategy implements the process for the required security testing, training, and monitoring activities Future DoD-wide CM guidance to be published.

9.0 PENETRATION TESTING

{ACRONYM} is not considered a High Impact level, therefore penetration testing is not required.

10.0 INTERNAL SYSTEM CONNECTIONS

This section applies to connections between {ACRONYM} and (separate) constituent system components (i.e., intra-system connections) including, for example, system connections with mobile devices, notebook/desktop computers, printers, copiers, facsimile machines, scanners, sensors, and servers. Instead of authorizing each individual internal connection, {ACRONYM} will authorize internal connections for a class of components with common characteristics and/or configurations, for example, all digital printers, scanners, and copiers with a specified processing, storage, and transmission capability or all smart phones with a specific baseline configuration.

Does {ACRONYM} have any internal system connections?

☐ No

☐ Yes

If Yes,

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as all personnel.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the personnel or roles as all personnel.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the AUP (Acceptable Use Policy), appointment orders, or written policy requiring that all personnel register at the DTIC website to receive update notifications.

DoD has defined the personnel or roles as all personnel.

Section 2

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as every 5 years.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDI 8510.01 meets the DoD requirement for security assessment authorization policy and procedures.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDI 8510.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented level of independence to ensure the organization being inspected/assessed defines the level of independence for assessors or assessment teams to conduct security control assessments of organizational information systems.

DoD has determined the level of independence is not appropriate to define at the Enterprise level.

Section 3

DoD has defined the frequency as annually.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has determined the other forms of security assessments are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

DoD has defined the frequency as at least annually.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the information systems are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the external organizations are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the requirements are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low DoD components are automatically compliant with this control if using the implementation guidance and validation procedures on the Knowledge Service.

If the organization being inspected/assessed is using alternative implementation guidance and validation procedures, the organization conducting the inspection/assessment will obtain and examine those procedures.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the organization's authorization boundary.

Authorization boundary can be described via one or more of the following: network diagrams, data flow diagrams, system design documents, or a list of information system components.

Section 3

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low See CA-2 c "The organization conducting the inspection/assessment obtains and examines the security assessment report to verify that it includes the compliance/non-compliance status of all controls and specific deficiencies for all non-compliant controls."

Section 3

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually for technical controls, annually for a portion of management and operation controls such that all are reviewed in a 3-year period except for those requiring more frequent review as defined in other site or overarching policy. NOTE: Technical, Management and Operational is IAW NIST SP 800-53 Table 1-1.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment interviews at a minimum, the ISSO and ISSM to ensure the SAR has been received.

DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.

Section 3

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the individuals or roles as at a minimum, the ISSO and ISSM.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented boundary protection device to ensure the organization being inspected/assessed defines the boundary protection device to be used to connect organization-defined unclassified, national security systems to an external network.

DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.

Section 4

The organization conducting the inspection/assessment obtains and examines policy document prohibiting direct connection of all unclassified NSS to external networks without the use of a boundary protection device defined in CA-3 (1), CCI 262.

DoD has defined the unclassified, national security systems as all unclassified NSS.

Section 4

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the unclassified, national security systems as all unclassified NSS.

Automatically compliant with this CCI because they are covered at the DoD level

DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the unclassified, non-national security system is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the boundary protection device is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the information system is not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed selects deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.

DoD has defined the information systems as any systems requiring external connectivity.

Section 4

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the information systems as any systems requiring external connectivity.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low

The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to employ a deny-all, permit by exception policy for allowing any systems requiring external connectivity to connect to external information systems.

For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2080.

DoD has defined the information systems as any systems requiring external connectivity.

Section 4

Moderate Low High Moderate

The organization conducting the inspection/assessment obtains and examines documentation of the Interconnection Security Agreements to include appropriate signatures.

Policy Note:

Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices. Connections can include both DoD enclaves or non DoD enclaves.

Section 4

Moderate Low High Moderate

The organization conducting the inspection/assessment obtains and examines interconnection security agreement documentation.

Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices. Connections can include both DoD enclaves or non DoD enclaves.

Section 4

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines interconnection security agreement documentation, specifically looking at any additional security controls identified for implementation.

Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices. Connections can include both DoD enclaves or non DoD enclaves.

Section 4

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the interconnection security agreement documentation, specifically to identify the type of information being transferred/transmitted.

Characteristics will include but are not limited to: classification, information type (e.g. PII, HIPAA, FOUO, financial data, etc.)

Interconnection security agreements are required for systems connecting between enclaves that require the hosting enclave to enable PPS outside of their already established and approved business practices. Connections can include both DoD enclaves or non DoD enclaves.

Section 4

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the audit trail of reviews and updates to ensure the organization being inspected/assessed reviews and updates Interconnection Security Agreements at least annually.

DoD has defined the frequency as at least annually.

Section 4

Moderate Low High Moderate Low

The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as at least annually.

Automatically compliant with this CCI because they are covered at the DoD level

The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.

NIST has not allocated this AP. Therefore, this AP is not applicable.

The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.

NIST has not allocated this AP. Therefore, this AP is not applicable.

The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines current POA&M. The objective is to validate the organization is providing updates to the POA&M at least every 90 days. Review of POA&M without change must be documented (i.e., adding review date to the POA&M header information).

DoD has defined the frequency as at least every 90 days.

Section 6

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as at least every 90 days.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the security authorization documentation to confirm the security authorization has been updated within the last three years, when there was a significant change to the system, or if there was a change to the environment in which the system operates.

DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.

Section 5

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as at least every three years, whenever there is a significant change to the system, or if there is a change to the environment in which the system operates.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate High Moderate High Moderate

Moderate High Moderate High Moderate

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

High

The organization conducting the inspection/assessment obtains and examines the documented frequency to ensure the organization being inspected/assessed defines the frequency for conducting penetration testing on organization-defined information systems or system components.

DoD has determined the frequency is not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

High

The organization conducting the inspection/assessment obtains and examines the documented information systems or system components to ensure the organization being inspected/assessed defines the information systems or system components on which penetration testing will be conducted.

DoD has determined the information systems or system components are not appropriate to define at the Enterprise level.

The system is not considered a HIGH level. Therefore, this AP is not applicable.

High

DoD has determined the red team exercises are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the rules of engagement are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

Moderate Low High Moderate Low

Moderate Low High Moderate Low

The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines the information system components or classes of components that that are authorized internal connections to the information system.

DoD has determined the information system components are not appropriate to define at the Enterprise level.

Section 8

Moderate Low High Moderate Low

Moderate Low High Moderate Low

Moderate Low High Moderate Low

ENCLOSURE 1 – INTERCONNECTION SECURITY AGREEMENT TEMPLATE

1.0 Interconnection Statement of Requirements

Use this section to document the formal requirement for connecting the two systems. Explain the rationale for the interconnection to the two DAAs. Enter a one- or two-paragraph statement justifying the interconnection. Within the information presented, include the following information:

1) The requirement for the interconnection, including the benefits derived.

2) The names of the systems being interconnected.

3) The agency name or organization that initiated the requirement.

4) If the requirement is generated by a higher level agency or organization, indicate the name of the organization and the individual, if appropriate, that requested the interconnection.

2.0 System Security Considerations

Use this section to document the security features that are in place to protect the confidentiality, integrity, and availability of the data and the systems being interconnected. The technical representative from each organization should discuss the contents on this section to come to a mutual agreement as to which items will be included. Both organizations should answer each item, even if only one party is affected by the item in question.

The following items should be addressed:

General Information/Data Description. Describe the information and data that will be made available, exchanged, or passed one-way only by the interconnection of the two systems Services Offered. Describe the nature of the information services (e.g., e-mail, file transfer protocol [FTP], database query, file query, general computational services) offered over the interconnection by each organization.

Data Sensitivity. Enter the sensitivity level of the information that will be handled through the interconnection, including the highest level of sensitivity involved (e.g., Privacy Act, Trade Secret Act, Law Enforcement Sensitive, Sensitive-But-Unclassified) and the most restrictive protection measures required.

User Community. Describe the “user community” that will be served by the interconnection, including their approved access levels and the lowest approval level of any individual who will have access to the interconnection. Also, discuss requirements for background investigations and security clearances, if appropriate.

Information Exchange Security. Describe all system security technical services pertinent to the secure exchange of data between the connected systems.

Rules of Behavior. Summarize the aspects of behavior expected from users who will have access to the interconnection. Each system is expected to protect information belonging to the other through the implementation of security controls that protect against intrusion, tampering, and viruses, among others. Do not enter statements of law or policy. Such statements typically are addressed in the MOU/A.

Formal Security Policy. Enter the titles of the formal security policy(ies) that govern each system (e.g., “Information Systems Policy and Procedures, Number xxxx” for “Organization A”).

Incident Reporting. Describe the agreements made regarding the reporting of and response to information security incidents for both organizations. For example, “Each organization will report incidents in accordance to its own (procedure name) procedures.” If no incident reporting is performed, so state.

Audit Trail Responsibilities. Describe how the audit trail responsibility will be shared by the organizations and what events each organization will log. Specify the length of time that audit logs will be retained. If no audit trail is performed, so state.

3.0 Topological Drawing

Include a topological drawing illustrating the interconnectivity from one system to the other system (end-point to end-point). The drawing should include the following:

· All communications paths, circuits, and other components used for the interconnection, from “Organization A’s” system to “Organization B’s” system.

· The drawing should depict the logical location of all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer workstations).

· If required, mark the top and bottom of each page with an appropriate handling requirement, such as “FOR OFFICIAL USE ONLY” or “FOR INTERNAL USE ONLY”.

4.0 Signatory Authority

Include a signature line. Optionally, this section may include any statements that the two DAAs desire in order to finalize the ISA. This section should include the following:

· The expiration date of the agreement

· Periodic review requirements, such as the date of the next review

· Other statements as required by the DAAs, if any

· The signatures of the DAAs from each organization, and the date of the signatures

FOR OFFICIAL USE ONLY 18

image1.gif