Attachment_3_-_NIH-MOU-template.pdf

Attachment 3 National Institutes of Health Clinical Center, Medical Record Department Transcription of Medical Reports, Letters, and Pathology Reports

OFFICIAL USE ONLY

LOGO

Org name National Institutes of Health Address 9000 Rockville Pike City, state zip Bethesda, MD 20892

Memorandum of Understanding (MOU) Between

[Your Organization] And

National Institutes of Health

[DATE]

http://www.os.dhhs.gov/�

This page intentionally left blank.

1 OFFICIAL USE ONLY

MEMORANDUM OF UNDERSTANDING (MOU)

[NOTE: Please delete everything inside square brackets “[ ]” throughout this template including this comment.]

SUPERSEDES:

[If this is a new MOU, delete this section.]

[If this is from a previous MOU, use the following. Please show title and date of previous MOU.] This Memorandum of Understanding (MOU) supersedes all previous agreements between the parties regarding the interconnection of the parties’ systems.

INTRODUCTION

The purpose of this document is to establish a management agreement between the [Your organization], and the National Institutes of Health (NIH) regarding the development, management, operation, and security of a connection between systems owned by [Your organization] and systems owned by the NIH. This agreement will govern the relationship between [Your organization] and the NIH, including designated managerial and technical staff, in the absence of a common management authority.

AUTHORITY

The authority for this agreement is based on the following policy, standards and guidance:

• Federal Information Security Management Act (FISMA) as part of the E-Government Act of

• Office of Management and Budget (OMB) Circular A-130, Appendix III, Security of Federal Automated Information Resources

• National Institutes of Health Enterprise Information Security Plan, August 10, 2010

NIST Special Publication 800-47, Security Guide for Interconnecting Information Technology systems

• [Any other policy, standards or guidance as needed]

2 OFFICIAL USE ONLY

BACKGROUND

It is the intent of both parties to this agreement to maintain an interconnection of information technology (IT) systems to [share, exchange, or pass one-way] data between [Your system] and [NIH system]. Systems administrators from both parties will comply with appropriate security requirements to protect both parties’ data and information systems. [Please explain the expected benefit of the interconnection and/or the business purpose for the interconnection (Example: The expected benefit of the interconnection is to expedite the processing of data associated with “Project” within prescribed timelines).]

Name: [Your system name (GSS)]

Function: [Briefly describe the function - What is the purpose of the system? How will it function?]

Location: [Identify the physical location – complete address]

Description of data, including sensitivity or classification level:

[Identify the sensitivity or classification level based on FIPS 199. Identify the data that is been stored, processed, and/or transmitted.]

[Example:

The data that traverses this connection contains federal financial information as well as Privacy Act data and is classified Sensitive but Unclassified (SBU). The data sensitivity classification for confidentiality is high, integrity high, and availability high for the following reasons:]

[Select the correct level for your system]

• Confidentiality

– [High, Moderate, or Low] - Data that traverses this interconnection contains information that if accessed or disclosed is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, or individuals.

• Integrity

– [High, Moderate, or Low] – Data that traverses this interconnection contains information that, if altered, is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, or individuals.

3 OFFICIAL USE ONLY

• Availability contains information that, if not timely and readily accessible, is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, or individuals.

Name: [Name of the NIH system (i.e. application name or specific system name)]

Function: [Briefly describe the function - What is the purpose of the system? How will it function?]

Location: [Location] i.e.Building 12, 9000 Rockville Pike, Bethesda, MD 20892

Description of data, including sensitivity or classification level:

[Identify the sensitivity or classification level based on FIPS 199. Identify the data that is been stored, processed, and/or transmitted.]

[Example:

The NIH system is one of multiple general support systems that support scientific and general administrative applications for the National Institutes of Health, the Department of Health and Human Services (HHS), and other federal agencies.

The data sensitivity classification for confidentiality is medium, integrity medium, and availability medium, determined as follows. (Select the correct level for the specific system being connected).]

NIH used NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, to determine the security categories for all general support systems that host customer applications. NIH formulated a list of all possible information types from NIST 800-60 that might be stored/processed on the general support systems. Based on the NIST-assigned default categories for the identified possible information types, the high-water mark for confidentiality, integrity, and availability is [place classification level] based on the following:

• Confidentiality

– [High, Moderate, or Low] - Data that traverses this interconnection contains information that if accessed or disclosed is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, or individuals.

• Integrity – [High, Moderate, or Low] – Data that traverses this interconnection contains information that, if altered, is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, 4 OFFICIAL USE ONLY or individuals.

• Availability contains information that, if not timely and readily accessible, is expected to have [a severe or catastrophic, a serious, or a limited] adverse effect on organizational operations, organizational assets, or individuals.

COMMUNICATIONS:

Frequent formal communications are essential to ensure the successful management and operation of the interconnection. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. All communications described herein must be conducted in writing unless otherwise noted.

[Your organization’s system] and [the NIH system] agree to designate and provide contact information for technical leads for their respective system, and to facilitate direct contacts between technical leads to support the management and operation of the interconnection. See Attachment 2 (NIH POCs) and Attachment 3 (Your POCs). To safeguard the confidentiality, integrity, and availability of the connected systems and the data they store, process, and transmit, the parties agree to provide notice of specific events within the time frames indicated below:

Security Incidents: The technical staffs will immediately notify their designated counterpart by telephone or e-mail when a security incident(s) is detected, in order to determine whether their system has been compromised and take appropriate security precautions. In addition, the technical staffs will notify their respective Incident Response Centers or points of contact to ensure that appropriate actions and reporting takes place.

Disasters and Other Contingencies: The technical staff will immediately notify their designated counterpart by telephone or e-mail in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

Material Changes to System Configuration: Planned technical changes to the system architecture will be reported to technical staff within a week before such changes are implemented. The initiating party agrees to conduct a risk assessment based on the new system architecture and to modify and re-sign the ISA within one (1) month of implementation.

New Interconnections: [Your Organization] will notify the NIH at least one (1) month before it connects the system that is related to this interconnection with any system that is not directly related to this interconnection, including systems that are owned and operated by third parties.

5 OFFICIAL USE ONLY

Personnel Changes: The parties agree to provide notification of the separation or long-term absence of their respective system owner or technical lead. In addition, both parties will provide notification of any changes in point of contact information. Both parties will also provide notification of changes to user profiles, including applicable users who resign or change job responsibilities.

INTERCONNECTION SECURITY AGREEMENT

The technical details of the interconnection will be documented in an Interconnection Security Agreement (ISA). The parties agree to work together to develop the ISA, which must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated to determine the potential impact on the interconnection. The ISA will be renegotiated before changes are implemented.

SECURITY

Both parties agree to work together to ensure the joint security of the connected systems and the data they store, process, and transmit, as specified in the ISA. Each party certifies that its respective system is designed, managed, and operated in compliance with all relevant federal laws, regulations, and policies. Interconnecting systems shall have undergone a Certification and Accreditation (C&A) process with associated memorandums that designate the systems as fully accredited and has an Authority to Operate (ATO). Upon request, a C&A and/or an ATO will be provided for review.

COST CONSIDERATIONS

Both parties agree and are responsible for their own agency costs for the equipment necessary to interconnect its local system. Modifications to either system that are necessary to support the interconnection should be mutually agreed upon and are the responsibility of the respective system owner’s organization. Should it be necessary, the organizations will jointly fund the interconnecting mechanism and/or media, but no such expenditures or financial commitments shall be made without the written concurrence of both parties.

6 OFFICIAL USE ONLY

TIMELINE

This agreement will remain in effect for three (3) years after the last date on either signature in the signature block below. After three (3) years, this agreement will expire without further action. If the parties wish to extend this agreement, they may do so by reviewing, updating, and reauthorizing this agreement. The newly signed agreement will explicitly supersede this agreement, which should be referenced by title and date in the appropriate section of this document. If one or both of the parties wish to terminate this agreement prematurely, they may do so upon 30 days' advanced notice or in the event of a security incident that necessitates an immediate response. This agreement will be reviewed at least annually or whenever a significant change occurs to ensure that security controls are operating properly and providing appropriate levels of protection.

[Your DAA]

Andrea T. Norris NIH, Chief Information Officer Office of the Chief Information Office

(OCIO)

National Institutes of Health (NIH)

(Signature Date)

(Signature Date)

A-1 OFFICIAL USE ONLY

Attachment 1

ISSO Recommendation Letter

From: ISSO of requesting IC

To: IC DAA

I have reviewed this MOU [Organization name] and find the overall security safeguards for this connection to have been addressed. I recommend that this agreement be signed. (Or similar words)

IC/ISSO

Signature/Date

A-2 OFFICIAL USE ONLY

Attachment 2

National Institutes of Health Points of Contact:

IT Security Program Daniel Sands NIH - Chief Information Security Officer

(NIH-CISO)

10401 Fernwood Rd.

Suite 3G-10 Bethesda, MD 20817 301.402.4445 Email sandsd@mail.nih.gov

IT Security Compliance Daniel Sands NIH - Chief Information Security Officer

(NIH-CISO)

10401 Fernwood Rd.

Suite 3G-10 Bethesda, MD 20817 301.402.4445 Email sandsd@mail.nih.gov

Contingency Planning

NIH

Incident Response Christopher Todd NIH – Senior ISSO 10401 Fernwood Rd.

Suite 3G-14 Bethesda, MD 20817

301.451.4326 / 301.881.9726 Email toddc@mail.nih.gov

Technical POC

NIH

A-3 OFFICIAL USE ONLY

[Your organization] Points of Contact:

IT Security Program Your POC

Security Operations

Incident Response POC

Contingency Planning mailto:Your� mailto:Your� mailto:Your�