Section_J-Attachment_C.6_IRS_ISA_MOU_template_20160912-V1.pdf

Internal Revenue Service

Solicitation Number: TIRNO-16-R-00026 IRS Integrated Enterprise Portal 1.5 (IEP 1.5)

MEMORANDUM OF UNDERSTANDING /

INTERCONNECTION SECURITY AGREEMENT

BETWEEN

[ABCPartner]

AND

Internal Revenue Service (IRS)

September 10, 2016

SECTION J-ATTACHMENT C.6

Document Control Change Sheet

Document Title: Memorandum of Understanding / Interconnection Security Agreement

Date Filename/Version # Author Revision Description

TABLE OF CONTENTS

PART A: INTRODUCTION

A.1 Agreement Description A.2 Parties A.3 Supersession

PART B: MOU

B.1 MOU Purpose

B.2 Interconnection Background B.2.1 Expected Benefits B.2.2 Systems Descriptions

B.3 Authority B.3.1 Legal Authority for Data Exchange

B.3.2 Applicable Systems of Records B.4 Communications

B.4.1 Security Incidents

B.4.2 Disasters and Other Contingencies

B.4.3 Material Changes to System Configuration B.4.4 New Interconnections B.4.5 Personnel Changes

B.5 ISA Development Procedures B.5.1 Development

B.5.2 Changes B.6 Security B.7 Cost Considerations

B.8 Personally Identifiable Information (PII) Requirements B.9 Disclosure

PART C: ISA

C.1 Interconnection Statement of Requirements

C.1.1 ISA Purpose and Authority C.1.2 Interconnection Requirements

C.2 System Security Considerations C.2.1 General Information/Data Description C.2.2 Services Offered

C.2.3 Data Sensitivity Categorization C.2.4 User Community C.2.5 Information Exchange Security

C.2.6 Trusted Behavior Expectations and Training Requirements C.2.7 Specific Equipment Restrictions C.2.8 Formal Security Policy C.2.9 Security Documentation

C.2.10 Audit Trail Responsibilities C.2.11 Incident Reporting and Security Incident Points of Contact C.2.12 Points of Contacts

C.3: TOPOLOGICAL DIAGRAM

PART D: EFFECTIVE DATE, DURATION, & MODIFICATIONS OF AGREEMENT

D.1 Effective Date

D.1.1 Contingency Clause D.2 Expiration

D.2.1 Renewal D.2.2 Premature Termination

D.3 Modifications and Annual Review

PART E: SIGNATORY AUTHORITY

E.1 Signatories and Interconnection Activation E.2 Signatures of the Parties

Notes: Instructions in italicized text must be removed before the document can be finalized. TBDs and text enclosed in brackets […] are placeholders and must be replaced with actual information. Text in blue color maybe tailored or removed as needed. After tailoring, the text color must be changed to black.

PART A: INTRODUCTION

A.1 Agreement Description

The purpose of this document (hereinafter, Agreement) is to (1) define the responsibilities of the parties identified below in establishing, operating, and securing a system interconnection and (2) describe the requirements of the interconnection.

Specifically, Part B, Memorandum of Understanding (MOU), sets forth the business and legal requirements surrounding the establishment of the interconnection. Part C, Interconnection Security Agreement (ISA), specifies the technical and security requirements of the interconnection. Parts D and E provide the timeframe and signatory authority, respectively, for this Agreement. This Agreement is drafted in alignment with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800- 47, Security Guide for Interconnecting Information Technology Systems.

A.2 Parties

This Agreement is made between the [ABCPartner] and the Internal Revenue Service (IRS) (collectively, the Parties). Hereinafter, the Parties will be individually referred to as [ABCPartner] and IRS.

A.3 Supersession

This is the first Agreement between the Parties concerning the establishment of an encrypted system interconnection for the express reasons and under the express authority set forth below in Part B.

If there was a prior agreement, use

This agreement supercedes the ISA and MOU between the IRS and [ABCPartner] dated [month, day, year].

PART B: MOU

B.1 MOU Purpose

The purpose of this MOU is to define the responsibilities and procedures between [ABCPartner] and IRS regarding the interconnection of information technology (IT) systems that are owned and operated by [ABCPartner] and IRS, as specified below.

Specifically, this MOU serves as a management agreement between [ABCPartner] and IRS regarding the development, management, operation and security of a connection between the IT systems. It will govern the relationship between [ABCPartner] and IRS, including designated managerial and technical staff, in the absence of a common management authority.

B.2 Interconnection Background

It is the intent of the Parties to interconnect the IT systems described herein in order for IRS to provide [ABCPartner] with [PII or data type....] information for purposes of [..the business reason...]. The specifics of the legal authority underlying this Agreement are provided in greater detail in Section B.3 below.

Given the above, the express purpose of this interconnection is to exchange [......] data between the [......] owned by IRS (IRS System) and the following systems owned by [ABCPartner] (collectively, [ABCPartner] Systems):

o [system1] o [system2] , etc.

This interconnection between [ABCPartner] and IRS is a [two-way\one-way] data exchange path.

B.2.1 Expected Benefits The interconnection of the IRS System and [ABCPartner] Systems will expedite data transfer. Specifically, the establishment of this interconnection is expected to accomplish the following:

a. Enable IRS and [ABCPartner] to share and receive data files electronically, thus, implementing a more secure transmission process.

b. Provide a Federal Information Processing Standards (FIPS) 140-2 compliant medium by which data will be exchanged between IRS and [ABCPartner].

c. Provide a mechanism for data exchange in compliance with IRS requirements wherein only authorized [ABCPartner] employees (not including contractors) will have access to IRS data to [....].

B.2.2 Systems Descriptions

B.2.2.1 IRS System

a. Name. [..System Name..]

b. Function. [...Briefly describe the function of the system ..].

c. Location. The IRS System is located at the [Martinsburg Enterprise Computing Center, Kearneysville, WV].

d. Data Description and Federal Information Processing Standards (FIPS) 199 Security Categorization Level. The data extracted from the IRS System contains [federal tax information, SBU] information and has a [HIGH/MODERATE] level of potential impact.

B.2.2.2 [ABCPartner] Systems

a. Name(s). ____________

b. Function. __________

c. Location. The [ABCPartner] Systems are located at the [... data center....] at [street address, city, state, zip]. Their respective locations are identified within their individual system names.

d. Data Description and FIPS 199 Security Categorization Level. The data extracted from the [ABCPartner] Systems contains [personally identifiable information, SBU] and has a [HIGH/MODERATE] level of potential impact.

B.3 Authority

This interconnection is authorized pursuant to Office of Management & Budget (OMB) Circular No. A-130 and [...MOA/CMA/contract, etc...].

....[The Parties are authorized to exchange certain data pursuant to the Privacy Act of 1974, (5 U.S.C. 552a), as amended by the Computer Matching and Privacy Protection Act of 1988, and the Office of Management and Budget’s final guidance interpreting these acts. The specific data to be exchanged, as well as the terms and conditions prescribing that exchange, are set forth in a Computer Matching Agreement (CMA) for the Disclosure of Information to Federal, State and Local Agencies (DIFSLA). The exchange of data per this Agreement is conditioned upon the CMA taking effect. This Agreement incorporates all of the terms and conditions of the CMA.]

B.3.1 Legal Authority for Data Exchange

The authority for [ABCPartner] to enter into a matching program with IRS is contained in 38 U.S.C. § ####. ______ has a statutory obligation to collect income information from certain applicants for benefits and to utilize that income data to determine the applicant’s eligibility for the benefits sought.

Section 6103(#)(#) of the Internal Revenue Code (I.R.C. 6103(#)(#)) authorizes the IRS to disclose ___ information with respect to ___ income to Federal, State and local agencies. The programs to which this provision applies and which the CMA governs are: I.R.C. Section 6103(####).

B.3.2 Applicable Systems of Records

a. ______.

b. ______.

B.4 Communications

Frequent formal communications are essential to ensure the successful management and operation of the interconnection. The Parties agree to maintain open lines of communication between designated personnel at the managerial and technical levels.

All communications described herein must be conducted in writing, unless otherwise noted.

The Parties agree to designate and provide contact information for the technical leads of their respective systems, and to facilitate direct contacts between technical leads to support the management and operation of the interconnection. To safeguard the confidentiality, integrity, and availability of the connected systems and the data they store, process, and transmit, the Parties agree to provide notice of specific events within the timeframes indicated below:

B.4.1 Security Incidents

Within one (1) hour of detecting and positively identifying an incident, as defined by the United States Computer Emergency Readiness Team (US-CERT) and/or NIST SP 800-61 (Computer Security Incident Handling Guide), the technical staff will notify its designated counterparts by telephone or e-mail so that the other party may take steps to determine whether its system has been compromised in order to take appropriate security precautions.

B.4.2 Disasters and Other Contingencies

Technical staff will immediately notify its designated counterparts by telephone or e-mail in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

B.4.3 Material Changes to System Configuration

Planned technical changes to the system architecture will be reported to technical staff before such changes are implemented. The initiating party agrees to conduct a risk assessment based on the new system architecture and to modify and have this Agreement, which includes the ISA, re-executed by both Parties at least one (1) month prior to implementation.

B.4.4 New Interconnections

The initiating party will notify the other party at least one (1) month before it connects its IT system with any other IT system, including systems that are owned and operated by third parties.

B.4.5 Personnel Changes

Each of the Parties agrees to provide notification, as soon as possible, to the other party of: (1) the long-term absence of any of its system owner(s) or technical lead(s) and (2) any changes in its point of contact information, including separation, resignation, and/or changes in job responsibilities regarding any of its system owner(s) or technical lead(s). Points of contact are identified in Part C, ISA, of this Agreement.

B.5 ISA Development Procedures

B.5.1 Development

The technical and security details of the interconnection are documented in Part C, ISA, of this Agreement. They were drafted through the collaborative efforts of the Parties and their mutual consent. The Parties agree to work together to develop the interconnection as described herein subsequent to the execution of this Agreement.

Work to build the interconnection will be done pursuant to applicable [ABCPartner] and IRS policies and procedures.

B.5.2 Changes

Proposed changes to either system or the interconnecting medium will be reviewed and evaluated to determine the potential impact on the interconnection. This Agreement, which includes the ISA, will be renegotiated and resigned by the Parties before any changes are implemented.

B.6 Security

The Parties agree to work together to ensure the joint security of the connected systems and the data they store, process, and transmit, as specified in Part C, ISA. Each of the

Parties certifies that its respective system is designed, managed, and operated in compliance with all relevant federal laws, regulations, and policies.

B.7 Cost Considerations

The Parties agree to bear their own costs or share equally the costs of the interconnecting mechanism and/or media. No additional expenditures or financial commitments shall be made without the written concurrence of the Parties.

Modifications to either system that are necessary to support the interconnection are the responsibility of the party owning the respective system.

B.8 Personally Identifiable Information (PII) Requirements

Each of the Parties agrees:

a. Not to use or disclose PII other than as permitted or required under this Agreement or by law.

b. To use appropriate safeguards as recommended by NIST to prevent the use or disclosure of PII, excepting the permissible use or disclosure per the terms of this Agreement.

c. To mitigate, to the extent practicable, any harmful effect that it has knowledge of resulting from any impermissible use or disclosure of PII in violation of the terms of this Agreement by any of its business partners.

d. To report to the other party any impermissible use or disclosure of PII in violation of the terms of this Agreement of which it becomes knowledgeable. Such an incident is to be reported within one (1) hour of discovery to the appropriate personnel as prescribed in Sections B.5.1 and C.2.10 below.

e. To ensure that any agent, including a subcontractor, to whom it provides PII will be contractually obligated to comply with all of the terms of this Agreement respecting PII.

f. To make the protocols and procedures utilized in safeguarding the PII data being exchanged pursuant to this Agreement available to the other party’s privacy and/or information security officer(s) upon request. Information will be provided in a timely manner for the purpose of determining compliance with the Privacy Act of 1974 (5 U.S.C. § 552a).

B.9 Disclosure

All users covered by this agreement acknowledge that they will comply with disclosure and privacy statutes (including but not limited to section 6103 of the Internal Revenue Code, the Privacy Act, the Bank Secrecy Act, and 18 USC) that are applicable to the information transmitted.

PART C: ISA

C.1 Interconnection Statement of Requirements

C.1.1 ISA Purpose and Authority

The purpose of this ISA is to document the technical and security requirements for connecting the [ABCPartner] and IRS systems in support of the management agreement (MOU, Part B) between the Parties, as provided above. The authority for interconnectivity between the systems is (1) found in OMB Circular No. A-130 and

(2) contingent upon the execution of this Agreement, which includes the MOU.

C.1.2 Interconnection Requirements

[IRS..] initiated the request for interconnection between the Parties for the express purpose of exchanging [ ....] data between the IRS System and the [ABCPartner] Systems, all of which is described in greater detail in the MOU, Parts B.2 and B.3, aboveincluding expected benefits, system descriptions/names, justification, and authority.

C.2 System Security Considerations

C.2.1 General Information/Data Description

Describe in 1 or 2 short paragraphs about the systems that will exchange data.

Describe at a high level the data types that passes through the interconnection, eg., tax data, procurement data, etc..

Describe the basic technical protocols, ports and technologies used to uphold this interconnection. Describe the type of interconnection, eg., Connect:Direct, web services, IPSec VPN, leased line, interforest trust, etc. Describe the process used to transfer the data between the IRS and the external partner.

A data file is compiled with names and social security numbers of _____ for the individuals on which the ___ is requesting data. ______ then sends the data file to IRS and requests income information for each record/person for a particular tax year. The tax year is entered via parameter.

When IRS receives the data file from ______, it runs a match against the information in its Masterfile system and generates a return file for ______. Upon receipt of the return file from IRS that supplies tax return information for identified individuals from ______’s data file, ______ runs a match.

C.2.2 Services Offered

Describe the services being provided by the IRS and/or the external partner. List the services that the connection makes available such as web access to an external partner site to access services/applications or server-to-server file/data transfers.

Example:

No user services are offered. [IRS..] will use the interconnection to provide a simple, reliable, and secure way to transfer files between [ABCPartner] and IRS. The data will be accessed by authorized users only, which include Government employees (not including contractors) and IRS personnel whose duties require them to have access to the data in compliance with I.R.C. Sections 6103(###) and 38 U.S.C. §

C.2.3 Data Sensitivity Categorization

Describe sensitivity level of data that passes through the connection. PII information is of particular interest. The goal is to ensure no more data is sent than is required.

The sensitivity categorization of data exchanged between [ABCPartner] and IRS is based on Federal Information Processing Standards (FIPS) 199, Sensitivity Categorization of Federal Systems, and guidance provided in NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories. The files that are exchanged between [ABCPartner] and IRS include PII. For this reason, the information is rated as [HIGH\MODERATE].

C.2.4 User Community

Describe the type of employees for both IRS and External Partner involved with the connection. Depending on whether the systems involved are determined to be high risk or moderate risk as per FIPS 199, use the language below as appropriate:

All [ABCPartner] users with access to the data received from IRS are United States (U.S.) citizens operating from the U.S. or its territories and have a valid, current background investigation in compliance with FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors. All IRS users with access to the data received from [ABCPartner] are U.S. citizens operating from the U.S. or its territories and have a valid, current IRS background investigation in compliance with FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors.

Generally, background investigations for all users accessing data under this Agreement will be at a National Agency Check Inquiries (NACI) level or higher.

However, any user who is a system or database administrator with privileged access to any server and/or network in which [....] data will be stored, processed, or transmitted will have a background investigation level equivalent to a Background Investigation (BI) or higher.

C.2.5 Information Exchange Security

The security of the information being passed on this two-way connection will be protected through the use of FIPS 140-2 validated cryptographic modules, approved encryption algorithms, equipment, firewalls, routers, and other security products.

The connections at each end are located within controlled access facilities, guarded 24 hours a day. Individual users will not have access to the data except through their systems security software inherent to the operating system. All access will be controlled by authentication methods to validate the approved users.

Data exchanged between the Parties will be encrypted and transferred using [Connect:Direct, FTP, ....] software through a Transport Layer Protocol site-to-site VPN tunnel, which is FIPS 140-2 compliant.

C.2.6 Trusted Behavior Expectations and Training Requirements

The Parties are required to protect the information flowing through the interconnection with the implementation of security controls that protect the confidentiality, integrity and availability of the data and systems. The Parties will protect each other’s shared data in accordance with all applicable federal laws and regulations, including, but not limited to, 5 U.S.C. § 552a (the Privacy Act), 18 U.S.C § 1905 (part of the Trade Secrets Act), and 44 U.S.C. §§ 3541-49 (the Federal Information Security Management Act of 2002 or FISMA).

C.2.6.1 Privacy and Security Awareness Training For IRS, privacy and security awareness training compliance information is described in IRS Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies and Entities, Sections 6.0 and 9.0.

Publication 1075 is available at http://www.irs.gov.

All [ABCPartner] users of systems involved in this interconnection must have completed the [ABCPartner] Privacy and Security Awareness Training Course prior to being granted access to Federal Tax Information (FTI). Thereafter, training must be refreshed annually.

All IRS users of systems involved in this interconnection must follow and have signed IRS Rules of Behavior. They are expected to protect the systems and data in accordance with applicable laws and organizational policies. Training must be refreshed annually.

C.2.7 Specific Equipment Restrictions

Equipment involved in this interconnection shall only be used by authorized personnel and shall be housed in physically secure facilities where physical access is restricted to authorized personnel only.

Remote administration of the interconnected systems is permitted only via FIPS 140- 2 validated access products and by users using unique administrator credentials.

The information systems involved in this connection do not have any unnecessary services running on them that are not explicitly required to allow them to function.

C.2.8 Formal Security Policy

Directives, policies, and/or laws that govern the protection of the data are:

a. FISMA, 44 U.S.C. §§ 3541-49

b. OMB Circular No. A-130, Appendix III, Section A, Security of Federal Automated Information Resources

c. OMB M-06-15, Safeguarding Personally Identifiable Information

d. OMB M-06-16, Protection of Sensitive Agency Information

e. OMB M-06-19, Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments

f. NIST SP, 800 Series, including, but not limited to:

NIST SP 800-41, Guidelines on Firewalls and Firewall Policy http://www.irs.gov/

NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems

NIST SP 800-53, Security Controls for Federal Information Systems

NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories

NIST SP 800-61, Computer Security Incident Handling Guide

NIST SP 800-100, Information Security Handbook: A Guide for Managers, Chapter 6, Interconnecting Systems

g. FIPS 140-2, Security Requirements for Cryptographic Modules

h. FIPS 201, PIV of Federal Employees and Contractors

i. Department of the Treasury Security Manuals - TD P 71-10 and TD P 85-01

j. Internal Revenue Manual (IRM) 10.8.1, Information Technology (IT) Security Policy and Guidance

C.2.9 Security Documentation

The IRS Perimeter Security General Support System-1 (GSS-1) provides network infrastructure services to IRS personnel and information systems across the nation and serves as the boundary for monitoring and controlling communications with external networks and information systems. Security certification for GSS-1 was completed and an Authorization to Operate (ATO) was granted by Franklin Kist, Director, Network Engineering Division, IT User and Network Services, on April 10, 2015.

{Name of person}, Chief Information Officer/{Director Information Technology Services Division} signed the ATO after completion of certification activities for the {External Partner Name} system on {month, day, year} on which the systems involved in the [ABCPartner] side of this connection reside.

C.2.10 Audit Trail Responsibilities

The Parties are responsible for auditing application processes and user activities involving the interconnection with sufficient granularity to allow successful investigation and possible prosecution of wrongdoers. Activities that will be recorded include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers.

For [ABCPartner], audit logs will be retained for one (1) year. For IRS, all log incidents are to be time-stamped in Greenwich Mean Time (GMT) to synchronize events across all time zones. CSIRC maintains firewall logs for a minimum period of six (6) months on a log analysis system. Archived data is made available and extends the data retention period to six (6) years. CSIRC log data is available to CSIRC personnel only and may be provided to law enforcement personnel with valid jurisdiction. IRS Enterprise Operations maintains server and management logs and make logs available to IRS CSIRC on an as requested basis for the analysis of security events.

C.2.11 Incident Reporting and Security Incident Points of Contact

Either of the Parties discovering a security incident, as defined by US-CERT and/or NIST SP 800-61, related to this exchange will report it in accordance with its incident reporting procedures, which must comply with federal mandates including requirements for protecting PII. Each of the Parties will report any security incident it discovers to the other party, and specifically to its security incident points of contact listed below, within one (1) hour of the incident for report and action. In order to ensure clear communications, the Parties will utilize the incident categories and types provided in the table below:

Federal Agency Incident Categories

Category Type Description Reporting Timeframe

CAT 0

Exercise/Network

Defense Testing

This category is used during state, federal, national, international exercises and approved activity testing of internal/external network defenses or responses.

Not Applicable; this category is for each agency's internal use during exercises.

CAT 1

Unauthorized

Access

In this category an individual gains logical or physical access without permission to a federal agency network, system, application, data, or other resource

Within one (1) hour of discovery/detection.

CAT 2

Denial of Service

(DoS)

An attack that successfully prevents or impairs the normal authorized functionality of networks, systems or applications by exhausting resources. This activity includes being the victim or participating in the DoS.

Within two (2) hours of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate activity.

CAT 3 Malicious Code

Successful installation of malicious software

(e.g., virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are NOT required to report malicious logic that has been successfully quarantined by antivirus (AV) software.

Daily

Note: Within one (1) hour of discovery/detection if widespread across agency.

CAT 4 Improper Usage

A person violates acceptable computing use policies. Weekly

CAT 5

Scans/Probes/Att empted Access

This category includes any activity that seeks to access or identify a federal agency computer, open ports, protocols, service, or any combination for later exploit. This activity does not directly result in a compromise or denial of service.

Monthly

Note: If system is classified, report within one (1) hour of discovery.

CAT 6 Investigation

Unconfirmed incidents that are potentially malicious or anomalous activity deemed by the reporting entity to warrant further review.

Not Applicable; this category is for each agency's use to categorize a potential incident that is currently being investigated.

For the IRS specifically, the Computer Security Incident Response Center (CSIRC) monitors the availability and security of the infrastructure on which this connection runs. Upon detection of an incident related to this interconnection, CSIRC analysts will notify [ABCPartner] security incident points of contact and the following groups as appropriate: [ABCPartner] Emergency Contact, Treasury Security Incident Response Capability (TCSIRC) and the IRS Business/System owners. Additionally, IRS will log the incident in the CSIRC database, along with the resolution and mitigation process. In the event that an incident is detected by IRS User and Network Services or IRS Enterprise Operations, the CSIRC shall be notified immediately.

Each of the Parties will report any incidents involving PII it discovers to the other party’s security incident points of contact. Incidents involving PII must be reported to the IRS Privacy, Governmental Liaison and Disclosure (PGLD) Office. Overall PII incidents must be reported to United States Computer Emergency Readiness Team (US-CERT) within one (1) hour by the TCSIRC.

[ABCPartner]:

Name

Phone

Email

IRS:

CSIRC

(240) 613-3606

(240) 613-4991 (FAX)

csirc@irs.gov

Privacy, Governmental Liaison and Disclosure (PGLD) Office Incident Management hotline

(267) 941-7777

--- If taxpayer data will not be shared by the IRS, then remove the Office of Safeguards contact information. -- Office of Safeguards

(202) 622-6807

SafeguardReports@irs.gov mailto:csirc@irs.gov

C.2.12 Points of Contacts

Business\technical contact information is listed below.

Table 1. Business\Technical Contacts

Name Title E-mail Phone Time

Table #. Signatory Contacts

Name Title Address Phone

Sharon James

Associate CIO, IRS IT Cybersecurity

TBD

{IRS Business Authorizing Official}

TBD TBD

TBD

{External Partner Executive/Authorizing Official}

TBD TBD

IRS User and Network Services operates and maintains the network connectivity components. Its representatives are listed as follows:

Table #. User and Network Services Engineering

Table #. User and Network Services ECC-MTB On-Site

Include the text and table below if the Enterprise File Transfer Utility (EFTU) is used.

IRS Enterprise Operations supports the Enterprise File Transfer Utility (EFTU) project. Its representatives are listed as follows:

Table #. Enterprise Operations

The ISA should include a topological drawing illustrating the interconnectivity from one system to the other system (end-point to end-point). The drawing should include the following:

+ The title “TOPOLOGICAL DRAWING.”

+ All communications paths, circuits, and other components used for the interconnection, from “Organization A’s” system to “Organization B’s” system.

+ Depict the protocols used and directions of communication traffic as appropriate..

+ Depict the logical location of all components (e.g., firewalls, routers, switches, hubs, servers, encryption devices, and computer workstations).

C.3: TOPOLOGICAL DIAGRAM

EXAMPLE:

Perimeter Router External Partner

System Name

External Partner Name

IPSec VPN over the Internet

Internal Revenue Service

Perimeter Router

Firewall

Firewall

Internal IRS

System Name

IRS Network Segment, CCG, etc

External Partner City, State

IRS Facility, City, State

PART D: EFFECTIVE DATE, DURATION, & MODIFICATIONS

OF AGREEMENT

D.1 Effective Date

This Agreement takes effect on the date of the last signature in Part E.

D.1.1 Contingency Clause

The exchange of data under this Agreement is contingent upon ___

D.2 Expiration

This Agreement will remain in effect for three (3) years from the effective date of this Agreement or until the expiration of the [MOA\CMA\contract......].

D.2.1 Renewal

Upon expiration, this Agreement may be renewed by mutual agreement of the Parties. The newly signed agreement should explicitly supersede this Agreement, which should be referenced by title and date.

D.2.2 Premature Termination

If one or both of the Parties wish to terminate this Agreement prematurely, they may do so upon thirty (30)-days advanced written notice or in the event of a security incident that necessitates an immediate response.

D.3 Modifications and Annual Review

This Agreement will be reviewed annually by the Parties to ensure that the provisions set forth are current and valid. Any requests for modification will be provided to the other party in writing thirty (30)-days prior to review.

PART E: SIGNATORY AUTHORITY

E.1 Signatories and Interconnection Activation

Signatories to this Agreement are Data Owners, System Owners, and/or Authorizing Officials. The Parties shall sign this Agreement before the interconnection is activated.

This Agreement, and any Amendments to this Agreement, shall become an integral piece of the SA&A documentation and shall be included in subsequent accreditation requests.

E.2 Signatures of the Parties

We, the undersigned, mutually agree to the terms of this Agreement.

[ABCPartner]:

Date {First and Last Name of executive level person} {Their title -- CIO, Chief Information Security Officer, etc}

Internal Revenue Service

{First and Last Name of IRS Business executive level person} {Their title -- Director, W&I Commissioner, etc}

Sharon James IRS Authorizing Official, Associate CIO, IT Cybersecurity