Responsible (R) Person working on activity – Accountable (A) Person with decision authority and one who delegates the work – Consulted (C) Key stakeholder or subject matter expert who should be included in – decision or work activity Informed (I) Person who needs to know of decision or action – Officer Owner Admin Manager Roles User User System System Security Information Review and update policy A/R Responsible for documentation and/or isa of dedicated connections between information systems A R I Assign an authorizing official for each system A/R Establish a continuous monitoring strategy A/R STATEMENT OF POLICY In accordance with SEC501, CA-1, CA-3, CA-3-COV, CA-6 and CA-7, Security Assessment and Authorization controls, VITA will develop, disseminate, and review/update the Security Assessment and Authorization Policy on an annual basis or more frequently if an operational change is made to a system involved in an interconnection agreement. INFORMATION SYSTEM CONNECTIONS This control applies to dedicated connections between information systems, and does not to transitory, user-controlled connections such as email and website browsing. Connections from the information system to other information systems outside of the authorization boundary must be authorized by the System Owner through the use of Interconnection Security Agreements (ISAs). If the connecting systems have the same Authorizing Official, an ISA is not required. Rather, the interface characteristics between the connecting information systems must be described in the security plans for the respective systems. If the connecting systems have different Authorizing Officials but the Authorizing Officials are in the same organization, VITA shall determine whether an ISA is required, or alternatively, the interface characteristics between the connecting information systems must be described in the security plans for the respective systems.
Responsible (R) – Person working on activity Accountable (A) – Person with decision authority and one who delegates the work Consulted (C) – Key stakeholder or subject matter expert who should be included in decision or work activity Informed (I) – Person who needs to know of decision or action Roles User User Manager System Owner System Admin Information Security Officer Review and update policy A/R Responsible for documentation and/or isa of dedicated connections between information systems A R I Assign an authorizing official for each system A/R Establish a continuous monitoring strategy A/R STATEMENT OF POLICY In accordance with SEC501, CA-1, CA-3, CA-3-COV, CA-6 and CA-7, Security Assessment and Authorization controls, VITA will develop, disseminate, and review/update the Security Assessment and Authorization Policy on an annual basis or more frequently if an operational change is made to a system involved in an interconnection agreement. INFORMATION SYSTEM CONNECTIONS This control applies to dedicated connections between information systems, and does not to transitory, user-controlled connections such as email and website browsing. Connections from the information system to other information systems outside of the authorization boundary must be authorized by the System Owner through the use of Interconnection Security Agreements (ISAs). If the connecting systems have the same Authorizing Official, an ISA is not required. Rather, the interface characteristics between the connecting information systems must be described in the security plans for the respective systems. If the connecting systems have different Authorizing Officials but the Authorizing Officials are in the same organization, VITA shall determine whether an ISA is required, or alternatively, the interface characteristics between the connecting information systems must be described in the security plans for the respective systems.
VITA-CSRM-IT-Security-Assessment-and-Authorization-Policy-v1_0.docx