Sample Interconnection Security and Data Use Agreement.pdf

Congressionally Directed Medical Research Program (CDMRP)

ISA i June 22, 2021 Template updated: 6/22/2021

Interconnection Security and Data Use Agreement Between:

Congressionally Directed Medical Research Programs (CDMRP)

Electronic Grants System (EGS) And

<<VENDOR NAME>> <<VENDOR SYSTEM>>

This document represents basic data use and system connection details operated by different organizations. Specifics will be determined based on contract requirements, specific systems and processes determined to be utilized for data sharing. Terms of agreement are subject to change.

Congressionally Directed Medical Research Program (CDMRP)

ISA i June 22, 2021 Template updated: 6/22/2021

Table of Contents

1 INTRODUCTION

2 INTERCONNECTION STATEMENT OF REQUIREMENTS

3 SYSTEM SECURITY CONSIDERATIONS

3.1 GENERAL INFORMATION/DATA DESCRIPTION

3.2 SERVICES OFFERED

3.3 DATA SENSITIVITY

3.4 DATA USE AGREEMENT

3.5 USER COMMUNITY

3.6 INFORMATION EXCHANGE SECURITY

3.7 RULES OF BEHAVIOR

3.8 COMMUNICATIONS

3.9 FORMAL SECURITY PLANS

3.10 INCIDENT REPORTING AND PRIVACY BREACH

3.11 DISASTERS AND OTHER CONTINGENCIES

3.12 MATERIAL CHANGES TO SYSTEM CONFIGURATION

3.13 AUDIT TRAIL RESPONSIBILITIES

3.14 SECURITY PARAMETERS

3.15 OPERATIONAL SECURITY MODE

3.16 TRAINING AND AWARENESS

3.17 SPECIFIC EQUIPMENT RESTRICTIONS

3.18 CHANGES TO TECHNICAL SPECIFICATIONS OF DATA EXCHANGES

4 TOPOLOGY DRAWING/DATA EXCHANGE DIAGRAM

5 SIGNATORY AUTHORITY

ISA 1 of 7 June 22, 2021

1 INTRODUCTION

The Congressionally Directed Medical Research Program (CDMRP) will comply with federal requirements related to the direct connection of information technology (IT) systems in accordance with the Federal Information Security Management Act of 2002 (FISMA), the Office of Management and Budget (OMB) Circular A-130, the Privacy Act of 1974, OMB memoranda related to personally identifiable information (PII), and the most current versions of NIST SP 800-53, and NIST SP 800-47. This Interconnection Security Agreement (ISA) and Data Use Agreement describes the technical and security requirements for direct connections between CDMRP Electronic Grants System (EGS), owned by Department of Defense, US Army Medical Research and Development Command (MRDC), and <<VENDOR SYSTEM>> owned by <<VENDOR NAME>> for the purposes of data sharing to support CDMRP research proposal and award management lifecycle processes.

It is a DoD requirement that any IT system that must directly connect to another system regardless of whether that system is classified as an internal or an external system, must have an Interconnection Security Agreement (ISA) created and signed off by the appropriate authorizing officials in order to document the connection of those systems being implemented.

In addition to direct connections, access to, and delivery of data by other methods such as exports provided for purposes of supporting CDMRP processes is subject to additional system interface documents and data use agreements as specified below.

2 INTERCONNECTION STATEMENT OF REQUIREMENTS

This interconnection security agreement between the Congressionally Directed Medical Research Programs (CDMRP) and <<VENDOR NAME>> pertains to the specified technical and security requirements regarding the interconnection between CDMRP’s EGS and <<VENDOR NAME>>’s <<VENDOR SYSTEM>>. It is the intent for these systems to allow bidirectional access.

EGS: The purpose of EGS is to allow the Office of Congressionally Directed Medical Research Programs (CDMRP), its partner agencies, and supporting contractors the capability to electronically manage biomedical research awards through a unified system and process. The system integrates data and files and supports processes including pre-proposal review, proposal receipt, peer review and programmatic review. It allows for contractors and partner agencies to collaborate and share data as well as allow for capture of scientific research outcomes for analysis and reporting to stakeholders including Congress, United States Army

ISA 2 of 7 June 22, 2021

Medical Research and Development Command (USAMRDC), and the Defense Health Agency.

EGS facilitates workflows including award negotiations, management of awards, program evaluation and regulatory reviews. It is the restricted back-end repository used to manage awards by Government employees and its support contractors. The electronic processes incorporated in EGS increase efficiency in CDMRP’s awards administration and data management as well as increase data quality and security. Each year approximately 10,000 new proposals are processed and an average of 4700 active awards are managed.

System Hosting Location:

EGS is hosted at the Ft. Detrick Network Enterprise Center (NEC).

CDMRP Program Management Office (PMO) Location 1077 Patchel Street Fort Detrick Frederick, MD 21702

EGS Program Manager Point of Contact

<<INSERT GOV POC NAME>>

Phone: <<INSERT GOV POC PHONE>> Email: <<INSERT GOV POC EMAIL>>

EGS Technical Point of Contact

<<INSERT GOV POC NAME>>

Phone: <<INSERT GOV POC PHONE>> Email: <<INSERT GOV POC EMAIL>>

EGS Alternate Technical Point of Contact

<<INSERT GOV POC NAME>>

Phone: <<INSERT GOV POC PHONE>> Email: <<INSERT GOV POC EMAIL>>

<<VENDOR SYSTEM>>: <<INSERT VENDOR SYSTEM PURPOSE AND DESCRIPTION >>

System Hosting Location:

<<VENDOR SYSTEM>> is hosted <<INSERT SYSTEM HOSTING SITE LOCATION>>.

<<VENDOR NAME>> Main Location

<<INSERT VENDOR ADDRESS>>

<<VENDOR NAME>> <<VENDOR SYSTEM>> Program Manager Point of Contact

<<INSERT VENDOR POC NAME>>

ISA 3 of 7 June 22, 2021

Phone: <<INSERT VENDOR POC PHONE>> Email: <<INSERT VENDOR POC EMAIL>>

<<VENDOR NAME>> <<VENDOR SYSTEM>> Technical Point of Contact

<<INSERT VENDOR POC NAME>>

Phone: <<INSERT VENDOR POC PHONE>> Email: <<INSERT VENDOR POC EMAIL>>

ISA 4 of 7 June 22, 2021

The benefits that can be obtained between the interconnected systems can range but not be limited to:

The exchange of data and information between specific systems/users

Customized levels of access to proprietary databases

Potential 24/7 communications

A “digital certificate” is an attachment to an electronic message used for security purposes and is used to encrypt data/information communications. Digital certificates allow organizations to positively determine the origin of an electronic message, and to securely encode messages to each other. A digital certificate is issued by a mutually-trusted certificate authority, and typically includes the name and public key of an organization, machine, or person. Both EGS and <<VENDOR NAME>> <<VENDOR SYSTEM>> use SHA 256 digital certificates so that the systems can recognize each other and exchange data securely.

“Proposal record” is a completed electronic proposal data submission submitted by a grant applicant for further processing and assessment for research funds.

“HTTP” or Hyper Text Transfer Protocol is the primary method used to convey information on the World Wide Web. Its standards are defined by the World Wide Web Consortium (W3C).

“HTTPS” is the encrypted version of HTTP protocol using TLS standards and requires use of digital certificates.

Simple Object Access Protocol: “SOAP” is a data exchange framework. Its use over HTTP or HTTPS protocol using TLS is standardized by the W3C. SOAP is based on XML and allows an application on one server to invoke a procedure on another server.

“REST” style architecture consists of clients and servers. Clients initiate requests to servers;

servers process requests and return appropriate responses. Requests and responses are built around the transfer of representations of resources. A resource can consist of and be any concept. RESTful services provide interoperability between computer systems on the internet and allow the request to access resources via stateless set of operations.

“System-to-System” interface is the set of communication protocols, data exchange standards and the associated details established by EGS and <<VENDOR SYSTEM>> to provide capabilities to interact with each system in an automated manner without human intervention. EGS and <<VENDOR SYSTEM>> utilize RESTful services or SOAP-based services over HTTPS using TLS to implement its system-to-system interfaces.

ISA 5 of 7 June 22, 2021

“WSDL” or Web Services Description Language (WSDL) is an XML format published for describing Web services. The WSDL file for agency system-to-system interface published by EGS and <<VENDOR SYSTEM>> shall contain complete description of all pairs of request and response messages that can be exchanged between the systems.

“Web Service” is a collection of protocols and standards used for exchanging data between applications. EGS and <<VENDOR SYSTEM>> have developed a collection of web services that makes up the system-to-system interface.

”XML” or the Extensible Markup Language is a W3C recommendation for creating special purpose markup language for defining textual tags that can be used to markup documents and messages. Its primary purpose is to facilitate the sharing of structured text and information across the Internet.

3 SYSTEM SECURITY CONSIDERATIONS

3.1 GENERAL INFORMATION/DATA DESCRIPTION

The EGS application provides authorized Government users with a simple, unified system through which they can search for proposal and award information, download records, and maintain research management information. The <<VENDOR SYSTEM>> system is used by CDMRP’s support contractor <<VENDOR NAME>> to facilitate the <<INSERT VENDOR SUPPORTED PROCESS>> aspect of CDMRP’s proposal lifecycle.

3.2 SERVICES OFFERED

This connection shall transmit information using an encrypted and authenticated channel that meets National Institute of Standards and Technology (NIST) recommendations. Unencrypted and unauthenticated access shall be prohibited. Both EGS and <<VENDOR SYSTEM>> must maintain a malware detection system on its end to ensure safety and protection of its own system(s) as well as meet all Government and DoD security regulations as specified in contract.

3.3 DATA SENSITIVITY

The data is categorized as Moderate based on FIPS 199 Standards for Security Categorization of Federal Information and Information Systems and the guidance of NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories. This data

ISA 6 of 7 June 22, 2021 categorization matches the overall system security categorization found in the EGS systems security plan.

No classified data shall be exchanged between the two systems. But the data exchanged may be proprietary to the proposal record. The EGS system contains personally identifiable information (PII) and proprietary business information that should be disseminated only to those within your agency with a need to know the information in the course of their official duties. Such information when output in any form from the EGS system must be handled and protected in accordance with applicable federal laws and Executive Orders (including Executive Order 13556 of November 4, 2010, Controlled Unclassified Information and its implementing guidance), as well as agency directives, policies, regulations, standards, and operational requirements. Appropriate means shall be used to protect unauthorized disclosure of proposal data in accordance with all federal laws.

3.4 DATA USE AGREEMENT

Data provided by CDMRP whether through a system-to-system interconnection, export/import processes, manually obtained from Government systems and resources are provided for the sole purposes of performing tasks under contract with CDMRP. No data may be used for any other purposes including aggregation of data to create additional data sources unless specifically defined as required for the contract, data mining to support other contracts or vendor business purposes. <<VENDOR NAME>> must remove all records from and all related files from its system <<INSERT RETENTION>> years from the original receipt of the records.

Once removed, no records or data shall be recoverable

Both parties agree to work together to ensure the joint privacy of the connected systems and the data they store, process, and transmit. Each party certifies that its respective system is designed, managed, and operated in compliance with all relevant federal laws, regulations, and policies. CDMRP will require approval prior to applying any changes in the use of the data.

3.5 USER COMMUNITY

EGS and <<VENDOR SYSTEM>> shall provide and maintain security mechanisms adequate for preventing unauthorized access to proposal or award records and proposal reviews. Both parties are responsible for determining authorized users as they see fit through the

ISA 7 of 7 June 22, 2021 management of their system logins and associated roles. Both parties are encouraged to regularly review the user logins for their organization to ensure appropriate authorization.

3.6 INFORMATION EXCHANGE SECURITY

Data transfer between the two systems shall be two ways. EGS primarily uses REST over HTTPS using most current NIST and Federal Government recommended versions of TLS to implement its system-to-system interface. EGS shall initiate all connections to <<VENDOR SYSTEM>> as defined in its technical documentation. All communication between the two systems shall be based on the principle of request and response messages.

The connection shall be initiated by the EGS system utilizing Port 443. EGS shall authorize the connection by verifying the details of the digital authentication certificate transmitted by the <<VENDOR SYSTEM>> system during the handshake procedure. EGS shall reject communication unless the certificate is current (‘valid’) and pre-registered with EGS. Once a connection is successfully established, the system may make data available for transfer. It may also retrieve all proposal data matching its query. EGS will limit the data available for retrieval specific to <<VENDOR SYSTEM>>. Timely retrieval of proposal, pre-proposal and award data from the EGS system is ultimately the responsibility of <<VENDOR SYSTEM>>.

The security of the information being passed between CDMRP and the <<VENDOR NAME>> is protected through the use of FIPS 140-2 approved and current NIST recommended standards for encryption.

3.7 RULES OF BEHAVIOR

EGS and <<VENDOR SYSTEM>> users are expected to protect data in accordance with the policies and standards of the Privacy Act, OMB A-130 and each systems prospective Rules of Behavior document.

3.8 COMMUNICATIONS

Frequent formal communications are essential to ensure the successful management and operation of this agreement. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. Phone calls may be conducted; however, one or both parties must follow up with the other with an email outlining any conversations that occur with the outcome of the discussion. All formal communications that outline requests for actions to be taken by either party described herein should be conducted in writing especially if the work activities originate from a phone call. It is recommended that each party keep copies of communications with the copy of this agreement.

ISA 8 of 7 June 22, 2021

These two systems agree to designate and provide contact information for technical leads for their respective system, and to facilitate direct contacts between technical leads to support the management and operation of this agreement.

3.9 FORMAL SECURITY PLANS

EGS security documentation such as the System Security Plan, Security Controls Assessment, Incident response, and Contingency Plan are stored in the Ft. Detrick NEC repository.

The <<VENDOR SYSTEM>> system security documentation such as the System Security Plan, Security Controls Assessment, Incident response, and Contingency Plan are stored in <<INSERT

VENDOR DOCUMENT STORAGE LOCATION>>.

3.10 INCIDENT REPORTING AND PRIVACY BREACH

CDMRP and <<VENDOR NAME>>, upon discovering a security incident, shall immediately report it in accordance with agency-specific incident reporting procedures. Both parties agree to notify by telephone or email the PMO and Technical and Security contacts of their counterparts upon discovery of a security incident that impacts the availability, integrity, or confidentiality of the applicant data or agency postings, so the affected party can take appropriate security precautions outlined in their respective Incident Response Plans. The affected party shall receive formal notification in writing within five business days after detection of the incident.

When a privacy breach is detected or discovered, the technical or managerial staff will immediately notify their designated counterpart by telephone or e-mail.

3.11 DISASTERS AND OTHER CONTINGENCIES

The technical staff will immediately notify their designated counterpart by telephone or e-mail in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

3.12 MATERIAL CHANGES TO SYSTEM CONFIGURATION

Planned technical changes to the system architecture or environmental or operational changes to either system will be reported to technical staff within <xx> days before such changes are implemented. All change requests must be appropriately documented and agreed to prior to implementation. The initiating party agrees to conduct a risk assessment based on the new system architecture and to modify and re-sign this agreement upon implementation.

ISA 9 of 7 June 22, 2021

3.13 AUDIT TRAIL RESPONSIBILITIES

Every record by CDMRP shall be assigned a unique log number. A records status in the EGS system can be tracked using the log number. Both CDMRP and the <<VENDOR NAME>> shall maintain an audit trail of all communication between the two systems. Either party in writing may request a copy of the relevant log of activity for the last 60 days. Older logs may be provided if requested and available.

3.14 SECURITY PARAMETERS

EGS and <<VENDOR SYSTEM>> use RESTful web services over HTTPS using most current NIST and Federal Government recommended versions of TLS to implement its system-to-system interface. The EGS system shall connect to the <<VENDOR SYSTEM>> system using the system-to-system interface.

3.15 OPERATIONAL SECURITY MODE

EGS System Categorization Level:

The system categorization level for EGS is MODERATE as noted in the system’s system security plan is as follows:

CATEGORIZATION LEVEL FOR CIA HIGH MODERATE LOW

Confidentiality: X Integrity: X

Availability: X

EGS received its’ most recent Authorization to Operate on <<INSERT CURRENT ATO DATE>>

<<VENDOR SYSTEM>> System Categorization Level:

The system categorization level for <<VENDOR SYSTEM>> is <<INSERT VENDOR SYSTEM CATEGORY>> as noted in the system’s system security plan is as follows:

CATEGORIZATION LEVEL FOR CIA HIGH MODERATE LOW

Confidentiality:

Integrity:

Availability:

ISA 10 of 7 June 22, 2021

3.16 TRAINING AND AWARENESS

EGS and <<VENDOR SYSTEM>> system administrators are required to take security and awareness training as a result of the interconnection and provide the assignment of responsibility for the tasks being performed.

3.17 SPECIFIC EQUIPMENT RESTRICTIONS

Connection, processing and operation of any system hardware component are restricted only to those identified within the defined system boundary as documented in this agreement. Any hardware, software or service changes shall be discussed and agreed to before implementation.

3.18 CHANGES TO TECHNICAL SPECIFICATIONS OF DATA EXCHANGES

Any changes to exchange specifications WSDL, XML or XSD must be appropriately coordinated including timely notification of change requests, technical documentation provided, project planning documentation, testing and deployment plans.

4 TOPOLOGY DRAWING/DATA EXCHANGE DIAGRAMS

<< INSERT TOPOLOGY AND OTHER APPLICABLE EXCHANGE DIAGRAMS >>

ISA 11 of 7 June 22, 2021

5 SIGNATORY AUTHORITY

This ISA/Data Use Agreement is valid for <<INSERT TERM OF CONTRACT>> after the latest date on either signature below if the technology documented herein does not change or if there are no other intervening requirements for update. At that time it must be reviewed, updated and reauthorized. Either party may terminate this agreement with (30) thirty days advance notice.

Noncompliance on the part of party and/or its employees or contractors with regards to security policies, standards and procedures explained herein may result in immediate termination of this agreement.

TBD <Date> TBD < Date>

Congressionally Directed Medical Research Programs <<VENDOR NAME>> Authorizing Official Authorizing Official

(AO) (AO)