CA-3(5) – System Interconnections |Restrictions on External System Connections The organization employs [DoD Selection: deny-all, permit-by-exception] policy for allowing [DoD Assignment: any information system requiring external connectivity ] to connect to external information systems.] CA-3(5) Control Summary Information Responsible Role: Parameter 1: Parameter 2: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CA-3(5) What is the solution and how is it implemented? CA-6 Security Authorization The organization: c. Updates the security authorization [DoD Assignment: at least every three years, or whenever there is a significant change to the system, or whenever there is a change to the ] environment in which the system operates Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1,
CA-3(5) – System Interconnections |Restrictions on External System Connections The organization employs [DoD Selection: deny-all, permit-by-exception] policy for allowing [DoD Assignment: any information system requiring external connectivity ] to connect to external information systems.] CA-3(5) Control Summary Information Responsible Role: Parameter 1: Parameter 2: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CA-3(5) What is the solution and how is it implemented? CA-6 Security Authorization The organization: c. Updates the security authorization [DoD Assignment: at least every three years, or whenever there is a significant change to the system, or whenever there is a change to the environment in which the system operates ] Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1,