[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fca-3":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ca-3","CA-3","Information Exchange",14,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Information exchanges between the system and other systems must be approved and managed using agreements such as interconnection security agreements or service level agreements, which document interface characteristics, security and privacy requirements, controls, responsibilities and the impact level of the information, and are reviewed and updated periodically.\n\n**In practice.** This means an inventory of system connections and data exchanges with partners and suppliers, each with an owner and an agreement or documented terms covering security responsibilities. API integrations, file transfers and network links should all be included. Auditors look for the interconnection inventory, signed agreements and evidence of periodic review.\n\n**Common gaps.** API and SaaS integrations are often set up by business teams without formal agreements or security review. Old connections remain open after the business relationship ends.","a. Approve and manage the exchange of information between the system and other systems using [Selection: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; {{ insert: param, ca-03_odp.02 }} ];\n  b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and\n  c. Review and update the agreements [Assignment: organization-defined frequency].\nDiscussion: System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in [CA-6(1)](#ca-6.1) or [CA-6(2)](#ca-6.2) , may help to communicate and reduce risk.\n\nAuthorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from [CA-3a](#ca-3_smt.a) in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"inherited-ai-agents-create-hidden-identity-and-access-blind-spots","Inherited AI Agents Create Hidden Identity and Access Blind Spots","2026-10-10T12:20:48.952+00:00",{"slug":25,"title":26,"published_at":27},"mdm-platforms-are-high-value-targets-that-need-dedicated-threat-modeling","MDM Platforms Are High-Value Targets That Need Dedicated Threat Modeling","2026-10-01T16:21:56.296+00:00",{"slug":29,"title":30,"published_at":31},"vodafone-espaa-fined-750k-for-gdpr-failures-including-false-encryption-claims","Vodafone España Fined €750K for GDPR Failures Including False Encryption Claims","2026-09-23T10:21:14.93+00:00",{"slug":33,"title":34,"published_at":35},"vodafone-fined-750k-for-gdpr-breaches-including-unauthorized-processor-operations","Vodafone Fined €750K for GDPR Breaches Including Unauthorized Processor Operations","2026-09-22T14:21:34.979+00:00",{"slug":37,"title":38,"published_at":39},"vodafone-espaa-fined-750k-for-allowing-processor-to-operate-without-valid-data-processing-agreement","Vodafone España Fined €750K for Allowing Processor to Operate Without Valid Data Processing Agreement","2026-09-22T12:22:41.69+00:00",{"slug":41,"title":42,"published_at":43},"greece-fines-ministries-350k-for-missing-gdpr-processor-contract-after-25m-record-breach","Greece Fines Ministries €350K for Missing GDPR Processor Contract After 2.5M-Record Breach","2026-09-08T12:20:52.268+00:00",{"slug":45,"title":46,"published_at":47},"350000-gdpr-fine-after-breach-exposes-25-million-records-in-greece","€350,000 GDPR Fine After Breach Exposes 2.5 Million Records in Greece","2026-09-08T10:20:20.279+00:00",{"slug":49,"title":50,"published_at":51},"fcc-targets-robocall-violations-with-consumer-scorecards-and-provider-removals","FCC Targets Robocall Violations with Consumer Scorecards and Provider Removals","2026-09-02T20:21:08.089+00:00",{"slug":53,"title":54,"published_at":55},"trump-memo-authorizes-private-firms-for-offensive-cyber-ops","Trump Memo Authorizes Private Firms for Offensive Cyber Ops","2026-08-14T10:20:20.453+00:00",{"slug":57,"title":58,"published_at":59},"slovenia-fines-company-for-missing-gdpr-data-processing-agreement-with-service-provider","Slovenia Fines Company for Missing GDPR Data Processing Agreement with Service Provider","2026-08-12T08:21:05.494+00:00",{"slug":61,"title":62,"published_at":63},"eu-commission-fined-for-unlawful-data-transfers-to-us-via-third-party-services","EU Commission Fined for Unlawful Data Transfers to US via Third-Party Services","2026-07-08T12:20:41.39+00:00",{"slug":65,"title":66,"published_at":67},"iran-linked-apt-exploits-it-supply-chain-with-modular-cc-framework","Iran-Linked APT Exploits IT Supply Chain with Modular C&C Framework","2026-07-07T14:22:18.841+00:00",[69,74,79,84,88,92],{"slug":70,"name":71,"problem":72,"stories":73},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",5,{"slug":75,"name":76,"problem":77,"stories":78},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",4,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",3,{"slug":85,"name":86,"problem":87,"stories":83},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":89,"name":90,"problem":91,"stories":83},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":93,"name":94,"problem":95,"stories":96},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,[98,104,109,115,119,124,128,132],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","15","Control 15","Service Provider Management",10,{"family":105,"item":106,"code":107,"title":107,"together":108},"itil","overview","ITIL",9,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","32","Article 32","Security of processing",8,{"family":110,"item":116,"code":117,"title":118,"together":114},"28","Article 28","Processor",{"family":5,"item":120,"code":121,"title":122,"together":123},"sa-9","SA-9","External System Services",6,{"family":110,"item":125,"code":126,"title":127,"together":73},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":99,"item":129,"code":130,"title":131,"together":78},"3","Control 3","Data Protection",{"family":99,"item":133,"code":134,"title":135,"together":78},"6","Control 6","Access Control Management"]