In this section, for each interconnection between systems that are owned or operated by different organizations, provide the following information concerning the authorization for the connection to other systems or the sharing of information: Name of system Organization orDivision Type of interconnection (direct interface with database, FTP, etc.) Authorizations for interconnection (MOU/MOA/Statute/Management) Date of agreement FIPS 199 Category [Low|Moderate|High] Has system been through ISDM? [Yes|No] Name and title of authorizing official(s) For systems with numerous interconnections, a table format including the above information may be a good way to present the information. Laws, Regulations, and Policies Affecting the System List any laws, regulations, or policies that establish specific requirements for confidentiality, integrity, or availability of the system and information retained by, transmitted by, or processed by the system. General agency security requirements need not be listed since they mandate security for all systems. Each agency should decide on the level of laws, regulations, and policies to include in the system security plan. Examples might include the FBI’s Criminal Justice Information Security (CJIS) Policy, HIPAA, statutes defining confidential data, etc, or a specific statute or regulation concerning the information processed. Security Control Selection Please complete the SSC in 3 to cover security control selection. Completion Date The completion date of the SSP should be provided. The completion date should be updated whenever the plan is updated. When the system is updated, the version number in the title should be updated.
In this section, for each interconnection between systems that are owned or operated by different organizations, provide the following information concerning the authorization for the connection to other systems or the sharing of information: Name of system Organization orDivision Type of interconnection (direct interface with database, FTP, etc.) Authorizations for interconnection (MOU/MOA/Statute/Management) Date of agreement FIPS 199 Category [Low|Moderate|High] Has system been through ISDM? [Yes|No] Name and title of authorizing official(s) For systems with numerous interconnections, a table format including the above information may be a good way to present the information. Laws, Regulations, and Policies Affecting the System List any laws, regulations, or policies that establish specific requirements for confidentiality, integrity, or availability of the system and information retained by, transmitted by, or processed by the system. General agency security requirements need not be listed since they mandate security for all systems. Each agency should decide on the level of laws, regulations, and policies to include in the system security plan. Examples might include the FBI’s Criminal Justice Information Security (CJIS) Policy, HIPAA, statutes defining confidential data, etc, or a specific statute or regulation concerning the information processed. Security Control Selection Please complete the SSC in 3 to cover security control selection. Completion Date The completion date of the SSP should be provided. The completion date should be updated whenever the plan is updated. When the system is updated, the version number in the title should be updated.
SSPinstructions.docx