{"data":{"id":"CA-03","name":"Information Exchange","family":"CA","family_name":"Security Assessment and Authorization","withdrawn":false,"description":"a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; nondisclosure agreements; [Assignment: organization-defined type of agreement]];\nb. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and\nc. Review and update the agreements [Assignment: organization-defined frequency].","supplemental_guidance":"System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in CA-06(01) or CA-06(02), may help to communicate and reduce risk.\n\nAuthorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from CA-03a in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.","enhancements":[{"id":"CA-03(01)","name":"Unclassified National Security System Connections","withdrawn":true,"incorporated_into":["SC-07(25)"]},{"id":"CA-03(02)","name":"Classified National Security System Connections","withdrawn":true,"incorporated_into":["SC-07(26)"]},{"id":"CA-03(03)","name":"Unclassified Non-national Security System Connections","withdrawn":true,"incorporated_into":["SC-07(27)"]},{"id":"CA-03(04)","name":"Connections to Public Networks","withdrawn":true,"incorporated_into":["SC-07(28)"]},{"id":"CA-03(05)","name":"Restrictions on External System Connections","withdrawn":true,"incorporated_into":["SC-07(05)"]},{"id":"CA-03(06)","name":"Transfer Authorizations","statement":"Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.","baselines":["high"]},{"id":"CA-03(07)","name":"Transitive Information Exchanges","statement":"a. Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-3a; and\nb. Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CA-03","name":"Information Exchange","description":"a. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; nondisclosure agreements; [Assignment: organization-defined type of agreement]];\nb. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and\nc. Review and update the agreements [Assignment: organization-defined frequency].","discussion":"System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in CA-06(01) or CA-06(02), may help to communicate and reduce risk.\n\nAuthorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from CA-03a in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.","related_controls":["AC-04","AC-20","AU-16","CA-06","IA-03","IR-04","PL-02","PT-07","RA-03","SA-09","SC-07","SI-12"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'System Interconnections' Parameter includes a selection of multiple types of agreements  Control text adds privacy requirements Discussion expanded to cover responsibilities for each system"}},"compliance_mappings":{"iso_27001_2022":["A.5.14","A.8.21"],"iso_27002_2022":[],"cobit_2019":["APO09"],"pci_dss_v4":[],"nist_csf_2":["ID.AM-03","PR.DS-01","PR.DS-02","PR.DS-10"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":["A.10.2"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":["SS2/21-9.1"],"bsi_grundschutz":[],"anssi":["Hygiene.9","Hygiene.26","SecNumCloud.14.1"],"osfi_b13":["B-13.2.2","B-13.3.2"],"finma_circular":["IV.C(62)","IV.F(100)","V(101)"],"gdpr":["Art.28(3)(a)","Art.32(1)(a)"],"dora":["Art.9(4)(a)"],"bio2":[],"rbi_csf":["Annex1.4","Annex1.11"],"fisc":["FISC.O6","FISC.T3","FISC.T9","FISC.T13"],"lgpd_bcb":["BCB.Art.11"],"hkma_tme1":[],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.I.2i","CRA.Info.8f"],"swift_cscf":["SWIFT.1.1","SWIFT.1.5","SWIFT.2.8"],"cbuae":["CR-14"],"nca_ecc":["2-5","4-1","4-2"],"qatar_nia":["CS"],"uae_ia":["T8"],"bog_cisd":["CISD-COMP","CISD-XI","CISD-XIII"],"bom_ctrm":["3.9"],"cbe_csf":["CTO-11","GOV-3"],"bcbs_239":["Principle 14"],"bot_cyber":["Ch5.2"],"cpmi_pfmi":["PFMI.P22"],"ecb_croe":["CROE.2.2.3","CROE.2.3.5"],"ffiec_is":["II.C.6","II.C.9","II.C.20"],"hipaa_sr":["§164.308(b)(1)","§164.308(b)(3)","§164.314(a)(1)","§164.314(a)(2)"],"iosco_cyber":["GOV-5","ID-2","PFMI-20","PROT-2"],"nydfs_500":["500.11"],"sebi_cscrf":["PR.CS"],"cmmc_2":["CA"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FRU/FTA/FTP"],"isae_3402":["Clause 7","Clause 8"],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["05.b"],"iso_27799":["13.1","13.2","H.2"],"lloyds_ms":["MS8.9","MS13.1"],"naic_ds":["4D"],"nhs_dspt":["NDG-10.2","NDG-10.3"],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.6"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":["Art.66(1)","Art.66(3)"],"basel_sco60":["SCO60.54","SCO60.84"],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Formal system connection agreements define authorized data flows between interconnected systems, enabling detection of unauthorized exfiltration over C2 channels that violate approved connection parameters."},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"System connection monitoring identifies unauthorized data transfers over alternative protocols that fall outside the scope of approved inter-system connection agreements and authorized data flows."},{"id":"T1078","name":"Valid Accounts","tactics":["defense-evasion","initial-access","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"System connection agreements define which accounts and authentication methods are authorized for cross-system access, enabling detection of valid account abuse across system boundaries."},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and controlling system connections identifies unauthorized outbound data transfers to external web services that are not covered by approved system connection agreements."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"System connection monitoring detects unauthorized traffic duplication configurations that mirror network data to destinations not covered by approved inter-system connection agreements."},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Ongoing monitoring of authorized system connections detects asymmetric-encrypted data transfers over non-standard protocols that violate approved connection parameters and data flow agreements."},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"System connection controls identify unencrypted data transfers over unapproved protocols that fall outside sanctioned inter-system communication channels defined in connection agreements."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-03: iso_27001_2022 A.8.21 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.DS-01, PR.DS-02, PR.DS-10 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-011","SP-016","SP-018","SP-019","SP-021"]}}