Interconnection and Information Exchange Agreement Templates

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

Mandate. National Institute of Standards and Technology (NIST) SP 800-53 control CA-3 requires the Organization to approve and manage each exchange of information between its systems and other systems with a written agreement. Office of Management and Budget (OMB) Circular A-130 Appendix I requires agreements for interfaces with systems that contractors and other entities run for the government. Examples include memoranda of understanding, interconnection security agreements, and contracts. NIST SP 800-47 Rev. 1, Managing the Security of Information Exchanges, describes the agreements and the steps. These templates follow it. The Chief Information Officer (CIO) Federal Information Security Modernization Act (FISMA) metrics for fiscal years 2026 and 2027 count the systems with active agreements. They also count the agreements reviewed in the past 12 months.

The CISO owns these templates. System Owners and Information System Security Officers (ISSOs) use them for every exchange that leaves a system’s authorization boundary. The Assessment, Authorization, and Monitoring Policy (POL-CA) sets the rule, and the Assessment, Authorization, and Monitoring Procedures (PROC-CA) name these templates.

1. How to Use These Templates #

1.1 Terms in NIST SP 800-47 Rev. 1 #

NIST SP 800-47 Rev. 1 (July 2021) replaced the 2002 edition, which covered only system interconnections. The revision covers every information exchange: access to or transfer of data outside a system’s authorization boundary. It names three agreements:

• An interconnection security agreement (ISA) states the technical and security terms of a system interconnection. Part A is the template.
• A memorandum of understanding (MOU) or memorandum of agreement (MOA) states the management terms: purpose, authorities, communications, costs, and timeline. These templates call it an MOU/A. It goes with an ISA or an information exchange agreement (IEA) and has the same expiration date. Part B is the template.
• An information exchange agreement (IEA) states the protection terms for an exchange that does not use a system interconnection. Part C is the template.

The revision keeps the ISA and the MOU/A as two documents. It does not define one combined agreement, so the Organization uses all three as NIST describes them. The Organization may sign another party’s form when it contains every element of the matching template.

1.2 Choosing the agreements #

The ISSO chooses the agreements for each exchange from this table. NIST calls its Table 1 a starting point, not a rule. The Assessment, Authorization, and Monitoring Policy requires an IEA and an MOU/A for every exchange with an outside party that does not use an interconnection. The agreement types the Organization uses are [CA-03 parameter 1 — to be defined].

1.3 Planning the exchange #

Evidence: the request ticket, the agreement choice, the planning notes, the privacy review, and the agreements both Authorizing Officials signed.

1.4 Establishing the exchange #

Evidence: the approved change, the configuration records, the test results, the activation notice, and the updated SSPP.

1.5 Maintaining the exchange and its agreements #

Evidence: the incident records, the notice log, the review records, and the renewed agreements.

1.6 Discontinuing the exchange #

Evidence: the notices and acknowledgments, the change records, the sanitization records, and the closed agreement record.

1.7 Recording agreements in the GRC system and the SSPP #

The ISSO records every signed agreement in the GRC system as part of the system’s authorization package. The record holds:

• the other system, its owner organization, and its Authorizing Official;
• the agreement types, the signature dates, the expiration date, and the next review date;
• the impact level of the information and the exchange method;
• the signed copies.

These records form the Organization’s agreement register. The CISO uses the register to answer the CIO FISMA metrics on interconnection security agreements. The System Owner lists each agreement in the SSPP, in the Information Exchange (CA-3) section, and shows each exchange on the boundary diagram. Each signed agreement may hold moderate-impact information, so staff protect the copies at the impact level of the exchange.

Evidence: the agreement records in the GRC system, the agreement register, and the SSPP sections that list the agreements.

1.8 Values the Organization sets #

The CISO sets these values once for every agreement. The parties may agree on shorter times in a given agreement.

Part A. Interconnection Security Agreement (ISA) #

The ISSO completes every field. Text in brackets is a fill-in.

A.1 Parties and purpose #

A.2 Systems and authorization boundaries #

A.3 Information types and impact levels #

A.4 Interconnection method and services #

Topological drawing. [Insert a drawing of the interconnection. Show both authorization boundaries, the end points, the boundary devices, the encryption points, and the direction of the data.]

A.5 Security controls each party maintains #

Each party keeps its own system authorized and keeps these controls in place for the life of the agreement.

A.6 Personnel and access #

A.7 Rules of behavior #

Users of each system protect the other party’s information under the law and their own organization’s rules of behavior. Users of this Organization’s systems follow the Rules of Behavior — General Users (ROB-GEN-001). Privileged users also follow the Rules of Behavior — Privileged Users (ROB-PRIV-001). The other party names its rules here: [policies and rules of behavior of Organization B].

A.8 Incident reporting #

The party that finds a security incident reports it under federal and its own incident reporting procedures. Each party also notifies the other.

This Organization reports its own incidents under the Incident Response Plan (PLAN-IR-001) and breaches under the Breach Response Plan (PLAN-BR-001).

A.9 Event logging and auditing #

A.10 Cost #

The MOU/A states who pays for each part of the interconnection. Each party pays for the equipment at its own end unless the MOU/A says otherwise.

A.11 Review, renewal, and changes #

This ISA is valid for the agreement validity period after the last signature date. The ISSO reviews it every year and after a significant change to either system. The parties review and update the ISA before a material change goes into use, and re-sign it within the set time. Renewal requires new signatures, and the new ISA names the one it supersedes.

A.12 Termination and disconnection #

Either party may end this ISA with the set advance written notice. Either System Owner may disconnect at once, without notice, after a security incident that needs an immediate response. The party that disconnects tells the other party at once. When the ISA ends, each party removes the connection and handles shared information as the MOU/A states.

A.13 Signatures #

The Authorizing Official of each system signs this ISA. A signature approves the interconnection and accepts the risk to that party’s system.

Part B. Memorandum of Understanding or Agreement (MOU/A) #

The MOU/A holds the management terms for an interconnection or for any other exchange. It holds no technical details: those belong in the paired agreement, which is the ISA for an interconnection and the IEA for any other exchange. Leave out the cost terms and call it an MOU when neither party pays for the other.

B.1 Supersession #

[Title and date of each earlier agreement this one replaces, or none.]

B.2 Introduction #

This memorandum sets out how [Organization A] and [Organization B] develop, manage, run, and secure the exchange of information between [System A] and [System B] by [a system interconnection, or the exchange method]. It governs the relationship between the parties and their staff, since no common management authority covers both.

B.3 Authorities #

[Laws, regulations, and policies the exchange rests on, including any authority to share personally identifiable information.]

B.4 Background #

The expected benefit of the exchange is [complete].

B.5 Communications #

The parties name managerial and technical contacts and keep the contact list current. They put formal communications in writing. Each party gives the other these notices:

B.6 Paired agreement #

The paired agreement is [the ISA in Part A for an interconnection, or the IEA in Part C for any other exchange]. The parties develop it together and sign it before the exchange starts. They review each proposed change for its effect on the exchange, and renegotiate the paired agreement before the change. The Authorizing Official of each system signs it.

B.7 Security #

The parties work together to protect the systems and the information as the paired agreement states. Each party certifies that its system meets the federal laws, regulations, and policies that apply to it.

B.8 Cost considerations #

Neither party makes a financial commitment under this memorandum without the written agreement of both parties.

B.9 Timeline #

This memorandum and its paired agreement expire on the same date, at the end of the agreement validity period. To extend it, the parties review, update, and sign it again, and the new memorandum names the one it supersedes. Either party may end it early with the set advance written notice, or at once after a security incident that needs an immediate response.

B.10 Signatures #

Part C. Information Exchange Agreement (IEA) #

Use the IEA for an exchange that does not use a system interconnection.

C.1 Purpose #

This agreement sets the terms, conditions, and protections for the exchange of [information types] between [Organization A] and [Organization B].

C.2 Programs, information, and systems #

C.3 Transfer of data #

[How the information moves, how it is encrypted in transit, and how each party confirms it arrived complete.]

C.4 Security procedures #

The receiving organization:

• uses the information only for the purposes in this agreement;
• limits access to users who need it for those purposes;
• encrypts the information at rest and on portable devices and media;
• sends the information by email only when it is protected as this agreement states;
• tells the other party of a suspected or actual loss or breach within the breach notice time, and reports it under federal and its own procedures.

C.5 Contractor and agent responsibilities #

[How each party binds its contractors and agents to these terms.]

C.6 Points of contact #

C.7 Duration, review, and certification #

This agreement takes effect on [date] and lasts for the agreement validity period. The ISSO reviews it every year. Before it expires, the receiving organization certifies in writing that it follows these terms and that the exchange has not changed. On request, it also provides logs or assessment reports that show its oversight.

C.8 Modification and termination #

The parties make changes only in writing, signed by both. Either party may end the agreement with the set advance written notice. Either party may suspend the exchange at once if the other party uses or discloses the information without authority, or breaks these terms.

C.9 Signatures #

The officials who sign warrant that they have authority to bind their organizations.

2. Related Documents #

• Assessment, Authorization, and Monitoring Policy (POL-CA) and Procedures (PROC-CA): the information exchange rule and the authorization steps.
• System and Services Acquisition Policy (POL-SA): terms for external services and cloud services.
• System and Communications Protection Policy (POL-SC): boundary protection.
• Incident Response Plan (PLAN-IR-001) and Breach Response Plan (PLAN-BR-001): reporting incidents and breaches.
• Rules of Behavior — General Users (ROB-GEN-001).
• Rules of Behavior — Privileged Users (ROB-PRIV-001).

3. Derived Governance Requirements #

• Use an interconnection security agreement to state the technical and security requirements for setting up, running, and maintaining each system interconnection. (NIST SP 800-47 Rev. 1, §3.1.5.1)
• Give the memorandum of understanding or agreement and the interconnection security agreement for an interconnection the same expiration date. (NIST SP 800-47 Rev. 1, Appendix C)
• Use an information exchange agreement for an exchange that does not use a system interconnection, such as a file transfer, a web service, or database sharing. (NIST SP 800-47 Rev. 1, §3.1.5.3)
• Have the Authorizing Official of each system approve the exchange by signing and dating its agreements. (NIST SP 800-47 Rev. 1, §3.1.6)
• Notify the other party of each security incident or suspected incident that affects the systems in the exchange. (NIST SP 800-47 Rev. 1, §3.3.6)
• Review and update the agreements and the security plans on the agreed frequency and after each significant change to the systems in the exchange. (NIST SP 800-47 Rev. 1, §3.3.9)
• Before a planned end to an exchange, notify the other party in writing and wait for its acknowledgment. (NIST SP 800-47 Rev. 1, §3.4.1)
• Let the System Owner decide an emergency end to an exchange, and have technical staff carry it out. (NIST SP 800-47 Rev. 1, §3.4.2)
• Update the affected security plans and related documents after an exchange ends. (NIST SP 800-47 Rev. 1, §3.4.1)
• Require agreements, such as memoranda of understanding, interconnection security agreements, or contracts, for interfaces between agency systems and systems that contractors or other entities run for the government. (OMB Circular A-130, Appendix I, §4(j)(2)(f))
• Document the interface characteristics, security requirements, and nature of the information for each such interface. (OMB Circular A-130, Appendix I, §4(j)(2)(d))
• Report how many systems have active interconnection security agreements and how many of them were reviewed in the past 12 months. (FY 2026-2027 CIO FISMA Metrics, CIO-FY26-0092 and CIO-FY26-0093)

4. References #

These are the sources this document cites, with a link to each official text.

• FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
• FY 2026-2027 CIO FISMA Metrics, August 3, 2026.
• NIST SP 800-47 Rev. 1: Managing the Security of Information Exchanges, July 2021.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.