Att 9_Vendor GEX Interface Control Agr.doc

INTERFACE CONTROL AGREEMENT

between Global EXchange (GEX) Services and

XXXX (XXXX)

TABLE OF CONTENTS

Executive Summary .......………………….……………………………………………..ii

1.0 Purpose of the Interface Control Agreement ...……………..………..…………...1

2.0 Interface Partner System Description ………………………….………..………..1

3.0 Interface Partner Responsibilities ……………………………….……………..…2

4.0 System Security Considerations ………………………………………………

5.0 General Information……………………………………………………………….6

6.0 ICA Points of Contact ……………………………………………………….…

7.0 Signatory Authority………….………………………………………….………...9

Appendix A – Interface Data Flow Diagram ……...…………………………….……...10 Executive Summary

This Interface Control Agreement (ICA) for the Global EXchange (GEX) Services describes the responsibilities and the data flow between the GEX and the XXXX (XXXX) system(s). Details of the types and specifications of the data to be transferred, along with the communication protocols are given. The details of this ICA have been agreed upon and are overseen by GEX Program Office and XXXX Program Office.

GEX Interface Control Agreement

1.0 Purpose of the Interface Control Agreement

The requirements for interconnection between GEX and XXXX are for the express purpose of fulfilling a requirement to transfer data via routing and/or mediation between GEX and XXXX.

2.0 Interface Partner System Description

2.1 GEX System. The Global EXchange (GEX) Services provides broker and mediation service between government agencies, commercial industry, and government systems. This service includes the translation application for the any-to-any conversion of electronic data transactions to and from a variety of message formats including (but not limited to): the User-Defined File (UDF), Accredited Standards Committee (ASC) X12, or eXtensible Markup Language (XML) formats. GEX acts as an electronic business gateway for the DoD and its many trading partners. It provides delivery services using TCP/IP protocols SFTP, SMTP, HTTPS, and MQ Series. GEX validates, archives, secures, translates, routes, and delivers mass volumes of transactions and provides end-to-end accountability in the form of acknowledgement messages.

2.2 XXXX System. To be filled out by Interface Partner 3.0 Interface Partner Responsibilities

3.1 GEX System Responsibilities 3.1.1 Provide oversight and configuration management for all aspects of the GEX connection to XXXX system.

3.1.2 Maintain documentation related to this connection.

3.1.3 Provide requirements validation of system functionality and security in accordance with applicable DoD and Federal standards.

3.1.4 Provide advance notification of testing on GEX Test system.

3.1.5 Coordinate interface testing between GEX and XXXX prior to implementation of any changes to XXXX. Provide planning, coordination, and monitoring for end-to-end testing.

3.1.6 Coordinate resolution of connection issues discovered during testing.

3.1.7 GEX PMO will support test efforts including support of test planning, interface testing, exchange of sample data, evaluation of results, issue solution, and acceptance. Support XXXX in testing for Point to Point (P2P) and End to End (E2E) testing.

3.1.8 Notify the XXXX PMO of any system problems, incidents, or events that may affect the operation of the GEX. GEX PMO technical staff will immediately notify the XXXX PMO when a security incident(s) is detected, so the XXXX system may take steps to determine whether the system has been compromised and to take appropriate security precautions. Incidents include outages, intrusions, virus attacks, etc. that adversely affect the security posture of the system.

3.1.9 Disasters and Other Contingencies: Technical staff will notify XXXX PMO in the event of a disaster or other contingency that disrupts the normal operation of the connected systems.

3.1.10 Material Changes to System Configuration: The systems are dependent on each other for mission operation and success. Planned technical changes to the system will be reported to XXXX PMO before such changes are implemented.

3.2 XXXX System Responsibilities

3.2.1 Notify the EB OST GEX Helpdesk of any system problems, incidents, or events that may affect the operation of the GEX. XXXX technical staff will immediately notify the EB OST GEX Helpdesk by telephone and e-mail when a security incident(s) is detected, so the GEX Operational system may take steps to determine whether the system has been compromised and to take appropriate security precautions. Incidents include outages, intrusions, virus attacks, etc. that adversely affect the security posture of the system.

3.2.2 Disasters and Other Contingencies: Technical staff will immediately notify EB OST GEX Helpdesk by telephone and e-mail in the event of a disaster or other contingency that disrupts the normal operation of the connected systems.

3.2.3 Material Changes to System Configuration: The systems are dependant on each other for mission operation and success. Planned technical changes to the system interface will be reported to the GEX PMO before such changes are implemented.

3.2.4 Data Quality and Testing: XXXX agrees to assume responsibility of the content and quality of data and will work closely toward this objective, and in the best interest of the DoD community. XXXX will support test efforts including support of test planning, interface testing, exchange of sample data, evaluation of results, issue solution, and acceptance. Additional responsibilities related to testing are described in the bullets that follow.

3.2.5 Validate system interfaces and provide technical Test and Evaluation (T&E) Points of Contact (POC), as needed. Coordinate the resolution of issues discovered during testing.

3.2.6 Provide exit criteria and unique test scenarios to support testing when needed or as required.

3.2.7 Provide a test team to meet with and formulate plans to build test scripts and or documentation.

4.0 System Security Considerations

System Name, Owners

Global Exchange Services/GEX Business Transformation Agency

System Security

Sensitive But Unclassified (SBU) The GEX system is designated Mission Assurance Category Level III as defined in DoD 8500.2

Security Classification

Sensitive But Unclassified (SBU)

Security Accreditation Status

ATO valid through April 2013

Hardware Platform

HP rx6600

Hardware Platform Location

The GEX system resides in two separate Defense Enterprise Computing Centers (DECCs), in Ogden, Utah and Columbus, Ohio.

Software Operating System

HP-UX11i

Designated Accreditation Authority (DAAs)

Michael McLaughlin

317-490-6880

Mike.mclaughlin@bta.mil

Interface Methods

· Secure FTP

SFTP over SSH

Data can be pushed/pulled in both directions

Currently migrating to a FIPS-140 compliant SSH server (Tectia)

Provides public key encryption and authentication

· HTTPS

HTTP with SSL encryption

Data can be pushed in both directions

Open source packages are used (Apache, CURL)

Provides certificate-based encryption and authentication

· WebSphere MQ

MQ Messaging with SSL encryption

Part of the IBM WebSphere package

Provides certificate-based encryption

· Non-Secure Communications:

SMTP (encrypted within DoD thru VPN) Supports reporting capabilities and data acknowledgements

Security requirements/ constraints (Discuss how the sign-on and password procedures are obtained.)

IAW DoD 8500.2 MAC III Sensitive Controls

5 General Information/Data Description The purpose of the system to system connection is for XXXX to exchange data with the GEX system. This connection exchanges data between the GEX system and the XXXX system via an encrypted connection.

5.1 Data Sensitivity

The sensitivity of data exchanged between GEX and XXXX is not to exceed Sensitive-But-Unclassified. Under no circumstances shall any classified information be exchanged over GEX related channels.

5.2 User Community

All XXXX users are authorized recipients of XXXX/GEX information and require this information to perform their job function.

5.3 Trusted Behavior Expectations

XXXX system and users are expected to protect the GEX files and connection, and the GEX system and users are expected to protect the XXXX data. Both systems will act in accordance with the Privacy Act and Trade Secrets Act (18 U.S. Code 1905) and the Unauthorized Access Act (18 U.S. Code 2701 and 2710).

5.4 Formal Security Policy

Policy documents that govern the protection of the data are Department of Defense Directive 8500.1, Information Assurance. XXXX will be expected to comply with any applicable security bulletins released by the providers of their hardware, operating system and commercial software.

5.5 Audit Trail Responsibilities

Both parties are responsible for auditing application processes and user activities involving the interconnection. Activities that will be recorded include event type, date and time of event, user identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for one (1) year.

5.6 GEX Key and Certificate Authentication and Information Exchange Encryption

Per DoDI 8500.2, control # IAKM-1, GEX is required to eliminate the use of login/password in favor of key or certificate authentication. The certificate/key management exchange are transmitted over the network using DoD approved secure methods. Symmetric keys are produced, controlled and distributed using approved key management technology.

Information Exchange Security: The security of the information being passed in this interface connection is protected through the use of encryption mechanisms. GEX supports secure FIPS-compliant encryption for connectivity between systems and to encrypt data at rest.

5.7 Privacy (To be filled out by Interface Partner)

The following Personally Identifiable Information (PII) information is being transmitted between GEX and XXXX.

Name

Yes _____ No _______

Personal Bank Account Number Yes ______ No _______

Tax Identification Number/SSN Yes ____ No _______

5.8 GEX COOP

In accordance to DoDI 5000.2 guidance, GEX has a dual production sites in Ogden and Columbus that are configured to COOP. The GEX COOP will provide recovery of mission or business essential operations at the GEX COOP site.

5.9 GEX Incident Response

In accordance to BTA guidance, GEX has an Incidence Response plan. The GEX Incidence Response plan is exercised and approved annually.

After discovering irregular or suspicious activity that may affect the confidentiality, integrity, or availability of information, XXXX will report the incident to the EB OST GEX Helpdesk regardless of confirmation.

6 ICA Points of Contact The following represent their system and organization as participants in this agreement:

6.1 GEX PMO

Matthew Fegley

Program Manager, Global EXchange (GEX) Services

Phone: (703) 607-0381

Email: Matthew.Fegley@bta.mil

Jeffrey Bognar

Technical Lead, Global EXchange (GEX) Services

Phone: (703) 607-5178

Email: Jeffrey.Bognar@bta.mil

Denise Kleinfelter

Customer Liaison, Global EXchange (GEX) Services

Phone: (703) 607-5005

Email: Denise.Kleinfelter@bta.mil

Leema Walls

Information Assurance Officer, Global EXchange (GEX) Services

Phone: (703) 607-1443

Email: Leema.Walls@bta.mil

Electronic Business Operational Support Team (EB OST) Helpdesk

Phone:

(Toll Free) 866-618-5988

(Commercial) 801-605-7095

(DSN) 388-7095`

Email: cscassig@csd.disa.mil

6.2 XXXX PMO

To be filled out by Interface Partner

7 Signatory Authority The terms of the ICA will become effective upon the signature of all parties. This agreement shall remain in effect for the life cycle of the GEX and XXXX program office. This agreement will be reviewed and modified as required and appropriate. Either party may terminate this agreement upon 30 days’ advanced notice in writing of intent and reason for termination or in the event of a security incident that necessitates an immediate response. Both parties must approve changes to this agreement bilaterally.

The following organizations have approved this document as evidenced by signature and date contained herein.

Date ___________________ Approved: _______________________________ Matthew Fegley Program Manager, BTA Global EXchange (GEX) Services Matthew.Fegley@bta.mil

703-607-0381 Date _______________ Approved: _______________________________ XXXX Approving Official

Appendix A - Interface Data Flow Diagram

(To be filled out by Interface Partner)

PAGE

_1346141134.vsd Server

Data

DMZ

NAS

INBOUND

ESB NAS Mount Point:

/opt/fms/nas_esb_to_app/file_drop/US/GOV/DOD/AF/ACQ/AFWAY

/GEX

/ABSS

/AIM

ESB File Server

AFWAY Inbound Interface

AFWAY II

Inbound home dir: /opt/fms/inbound/file_drop/US/GOV/DOD/AF/ACQ/AFWAY

/GEX

/ABSS

/AIM

Development Server simulating GEX

FTP

ABSS

AFEMS(AIM)