Control statement
- a.Approve and manage the exchange of information between the system and other systems using [Organization-defined: ca-03_odp.01];
- b.Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
- c.Review and update the agreements [Organization-defined: frequency].
Discussion
System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in [CA-6(1)](#ca-6.1) or [CA-6(2)](#ca-6.2) , may help to communicate and reduce risk. Authorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from [CA-3a](#ca-3_smt.a) in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Information Exchange as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to assessment independence, authorization evidence, remediation, and continuous monitoring.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- assessment plans and reports
- plans of action and milestones
- authorization decisions and risk acceptances
- continuous monitoring results
Common failure patterns
- control status based only on owner assertion
- findings closed without evidence
- assessment scope that misses inherited services
- monitoring data disconnected from authorization decisions
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- CA-03a.the exchange of information between the system and other systems is approved and managed using [Organization-defined: ca-03_odp.01];
- CA-03b.
- CA-03b.[01]the interface characteristics are documented as part of each exchange agreement;
- CA-03b.[02]security requirements are documented as part of each exchange agreement;
- CA-03b.[03]privacy requirements are documented as part of each exchange agreement;
- CA-03b.[04]controls are documented as part of each exchange agreement;
- CA-03b.[05]responsibilities for each system are documented as part of each exchange agreement;
- CA-03b.[06]the impact level of the information communicated is documented as part of each exchange agreement;
- CA-03c.agreements are reviewed and updated [Organization-defined: frequency].
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection security agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- enterprise architecture
- system architecture
- system configuration settings and associated documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements
- organizational personnel with information security and privacy responsibilities
- personnel managing the system(s) to which the interconnection security agreement applies
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
CA-3(1) — Unclassified National Security System Connections
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
CA-3(2) — Classified National Security System Connections
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
CA-3(3) — Unclassified Non-national Security System Connections
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
CA-3(4) — Connections to Public Networks
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
CA-3(5) — Restrictions on External System Connections
This enhancement is marked withdrawn in the official OSCAL catalog. Related-control metadata below may identify where its intent was incorporated.
CA-3(6) — Transfer Authorizations
Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Official discussion
To prevent unauthorized individuals and systems from making information transfers to protected systems, the protected system verifies—via independent means— whether the individual or system attempting to transfer information is authorized to do so. Verification of the authorization to transfer information also applies to control plane traffic (e.g., routing and DNS) and services (e.g., authenticated SMTP relays).
Assessment objectives and methods
individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- system configuration settings and associated documentation
- control assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing connections to external systems
- network administrators
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms implementing restrictions on external system connections
Related controls
CA-3(7) — Transitive Information Exchanges
- (a)Identify transitive (downstream) information exchanges with other systems through the systems identified in [CA-3a](#ca-3_smt.a) ; and
- (b)Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
Official discussion
Transitive or "downstream" information exchanges are information exchanges between the system or systems with which the organizational system exchanges information and other systems. For mission-essential systems, services, and applications, including high value assets, it is necessary to identify such information exchanges. The transparency of the controls or protection measures in place in such downstream systems connected directly or indirectly to organizational systems is essential to understanding the security and privacy risks resulting from those information exchanges. Organizational systems can inherit risk from downstream systems through transitive connections and information exchanges, which can make the organizational systems more susceptible to threats, hazards, and adverse impacts.
Assessment objectives and methods
- CA-03(07)(a)transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified;
- CA-03(07)(b)measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- system configuration settings and associated documentation
- control assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing connections to external systems
- network administrators
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms implementing restrictions on external system connections
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.