Information Exchange CA-3

Assessment, Authorization, and Monitoring · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CA-3 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Assessment, Authorization, and Monitoring family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CA-3 (Information Exchange) is about controlling the connections your system has with other systems: before data flows between them, you approve the exchange and back it with an agreement — an interconnection security agreement, a memorandum of understanding (MOU), a service level agreement (SLA), or similar. Each agreement documents the interface, the security and privacy requirements, who is responsible for what, and how sensitive the data is. You review the agreements on a schedule. It is part of the Low baseline.

What good looks like

Approve the exchange first — know every other system this one sends data to or receives data from before the connection is trusted.
Back each exchange with an agreement (interconnection security agreement, MOU, or SLA) rather than an informal, undocumented link.
Document the interface: the ports and protocols, the security and privacy requirements, the controls in place, and the sensitivity (impact level) of the data.
Name responsibilities — which side owns which control, so nothing falls through the gap between two systems.
Review the agreements on a defined frequency to catch a connection that changed or is no longer needed.

Framework mapping

NIST CSF 2.0 — ID.AM-03 — Authorized network communication and internal and external data flows are maintained

How to move it toward Implemented

List the external connections this host actually makes — run ss -tunp to see established sessions and listening sockets, and note outbound dependencies (package mirrors, name resolution, time sync, log forwarding, or service endpoints).
For each real external exchange, write a short agreement entry: the other system, the interface (ports and protocols), the data and its sensitivity, and who owns which control.
Protect the data in transit — confirm the exchange uses TLS (Transport Layer Security) or SSH (Secure Shell) rather than a cleartext protocol, and record that in the agreement.
Attach the connection inventory plus the exchange-agreement notes as hardening evidence on the asset, naming CA-3 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.