Attachment_2_-_NIH-ISA-template.pdf

Attachment 2 National Institutes of Health Clinical Center, Medical Record Department Transcription of Medical Reports, Letters, and Pathology Reports

OFFICIAL USE ONLY

OFFICIAL USE ONLY

Logo

Your National Institutes of Health (NIH) Address 9000 Rockville Pike City, state, zip Bethesda, MD 20892

Interconnection Security Agreement (ISA) Between

[Your Organization] And

The National Institutes of Health (NIH)

[DATE]

http://www.os.dhhs.gov/�

1 OFFICIAL USE ONLY

INTERCONNECTION SECURITY AGREEMENT

[NOTE: Please delete everything inside square brackets “[ ]” throughout this template including this comment.]

SSEECCTTIIOONN 11 –– IINNTTEERRCCOONNNNEECCTTIIOONN SSTTAATTEEMMEENNTT OOFF RREEQQUUIIRREEMMEENNTTSS The requirements for interconnection between [Your organization] and the NIH are for the purpose of [sharing, exchanging, or passing one-way] data between [Your system,] owned by [Your Organization], and [NIH system,] owned by [Institute/Center] at the NIH. [Your Organization] requires the use of [NIH database/system] at the NIH and the NIH requires the use of [NIH database/system at your organization]. The expected benefit is to expedite the processing of data associated with [Name of the project, if applicable] within prescribed timelines.

[This section is used to document the formal requirement for connecting the two systems. Enter one or two narrative paragraphs that justify interconnecting the two systems being documented. The following information should be included:

1. The names of the two systems being interconnected.

2. The requirement for the interconnection to include the benefits derived.]

SSEECCTTIIOONN 22 –– SSEECCUURRIITTYY CCOONNSSIIDDEERRAATTIIOONNSS

[Use this section to document the security features that are in place to protect the confidentiality, integrity and availability of the data and the systems being interconnected. The technical representative from each organization will need to discuss the contents on this section to come to a mutual agreement as to which items are to be included. Both parties must answer each item even if the subjected item is affecting only one party.]

a. General Information/Data Description.

[At a general level, describe the information/data being made available, exchanged, or passed one way only, by the interconnection of the two systems.]

b. Services Offered

[Describe the nature of the information services (e.g. E-mail, FTP, data base query, file query, general computational services, etc.) offered over the interconnected system by each participating organization.]

2 OFFICIAL USE ONLY

c. Data Sensitivity

[Enter the sensitivity or classification level of the information to be exchanged, in particular, the highest sensitivity (i.e., Privacy Act, Trade Secret Act, Law Enforcement Sensitive, Sensitive-But-Unclassified, etc.) or classification (Confidential, Secret, Top Secret) and most restrictive protection requirements for information to be handled through the interconnection.]

d. User Community

[Enter a thorough explanation of the “user community” and/or “information recipients,” including any formal access approvals, to be served by the interconnected systems to include their clearance levels and nationality of the defined user communities, in particular the lowest clearance of any individual who shall have access to the interconnected system. If there is no user community defined, state so.]

e. Information Exchange Security

[Enter a description of all system security technical services pertinent to the secure exchange of information/data among and between the systems in question.]

f. Trusted Behavior Expectations/Rules of Behavior

[Summarize the aspects of trusted behavior that is expected by and from each system in the interconnection. For example, each system is expected to protect the information belonging to the other through the implementation of security program that provides for defense again intrusion, tampering, virus detection, etc. In other words those things expected (not guaranteed) by each system to further enhance the security posture and if those items are operational capabilities. Do not enter statements of Law or policy; those are typically in the MOU covering the concept.]

g. Federal Security Policy and Standards

[Enter the titles of the formal security policy (ies) that govern each system.

For example, "Information Systems Policy And Procedures, Number xxxx" for Organization A.]

NIH security policies and standards are reflected in the NIH Enterprise Information Security Plan, August 10, 2010. This interconnection must comply with these policies and standards.

h. Incident Reporting [Your organization] or the NIH, upon discovering a security incident involving the interconnection, shall report such incident in accordance with agency-specific incident

3 OFFICIAL USE ONLY

reporting procedures and shall expeditiously notify the [Your contact/incident response team] and the NIH IRT at 301.881.9726, email: irt@mail.nih.gov.

[Your organization] technical staff shall immediately notify the designated NIH counterpart by telephone or e-mail when a security incident(s) is detected, in order that the counterpart may take steps to determine whether the NIH system has been compromised and to take appropriate action. The NIH technical staff shall immediately notify its Computer Security Incident Response Center (CSIRC), the NIH Incident Response Team (IRT) of the incident.

[Your organizations incident response policy is reflected in (Your policy).]

NIH incident response policy is reflected in the NIH Information Technology Security Incident Response Policy, April 4, 2006, http://irm.cit.nih.gov/nihsecurity/Incident- Response-Policy.doc

i. Audit Trail Responsibilities

[Required if users of one system access data or services of the other system across the interconnection. Enter a description of how the audit trail responsibility is to be shared by participating systems and what events each shall log. If no audit trail is being performed, state so.]

j. Training and Awareness

[Enter the details of any new or additional security awareness, training requirements, and the assignment of responsibility for conducting it throughout the life cycle of the interconnected system.]

k. Security Documentation The following information technology security documents set forth the procedures and requirements for the protection of data transmitted under this ISA: [enter in bullet format]

[Enter the title and general details of an overall system security plan as defined in the System Development Life Cycle documents of each organization for the interconnected system and assignment of responsibilities for developing and accepting the plan. In general, this plan shall be an addendum to the security plan of each participating system.]

SSEECCTTIIOONN 33 -- TTOOPPOOLLOOGGIICCAALL DDRRAAWWIINNGG

The following diagram illustrates all communication paths, circuits, and other components used for the interconnection.

http://irm.cit.nih.gov/nihsecurity/Incident-Response-Policy.doc� http://irm.cit.nih.gov/nihsecurity/Incident-Response-Policy.doc�

4 OFFICIAL USE ONLY

[Each ISA shall include a one-page topological drawing depicting the interconnectivity from end-point to end-point. The drawing shall include the following:

1. All communications paths, circuits, etc. used for the interconnection beginning with the Customs-owned system(s) traversing through all interconnected systems to the non-Customs end-point.

2. The drawing should depict the logical location of all components.

(e.g., Mainframe Computers, Host Processors, Hubs, Firewalls, Encryption Devices, Routers, Frame Relay Devices, Secure Frame Units (SFU), Communications Service Units (CSU), Data Service Units (DSU), Customer Personal Computers, etc.)

3. Center the words "FOR OFFICIAL USE ONLY" in bold Arial appropriate-sized pitch as the last line on the bottom of the page containing the drawing.]

SSEECCTTIIOONN 44 –– SSIIGGNNAATTOORRYY AAUUTTHHOORRIITTYY

This ISA is valid for three (3) years after the latest date on either signature below if the technology documented herein does not change or if there are no other intervening requirements for update. At that time it must be reviewed, updated, and reauthorized. The security controls for this interconnection will be reviewed at least annually or whenever a significant change occurs. Either party may terminate this agreement with thirty days (30) advance notice.

Noncompliance on the part of NIH or its employees or contractors with regards to security policies, standards, and procedures explained herein may result in the immediate termination of this agreement.

[Your DAA]

Andrea T. Norris NIH, Chief Information Officer Office of the Chief Information Office (OCIO) National Institutes of Health (NIH)

(Signature Date)

(Signature Date)