Every integration is a door. CA-3 asks you to know which doors exist, who approved them and what rules apply to each.
NIST SP 800-53 Rev 5 binds US federal systems and others through contract. For other organizations it is a reference, and it lines up with what customers ask about third party data flows.
What the control asks
Approve and manage the exchange of information between the system and other systems using mechanisms you define, such as interconnection security agreements, information exchange agreements, memoranda of understanding or service level agreements. Document in each agreement the interface characteristics, security and privacy requirements, controls and responsibilities of each system, and the impact level of the information. Review and update the agreements at a frequency you define.
What it means in practice
NIST's guidance says exchanges include VPNs, internet service providers, database sharing, cloud services, web services, file transfer, email and other organization to organization communications. It asks you to weigh the risk of new threats when systems with different security needs connect.
For a software company, that means an inventory of data flows: your payment processor, analytics, support desk, cloud providers, customer integrations and webhooks. For each, an agreement and an owner.
The record lists seven enhancements: CA-3.1 Unclassified National Security System Connections, CA-3.2 Classified National Security System Connections, CA-3.3 Unclassified Non-national Security System Connections, CA-3.4 Connections to Public Networks, CA-3.5 Restrictions on External System Connections, CA-3.6 Transfer Authorizations and CA-3.7 Transitive Information Exchanges. Most small companies will care about CA-3.5 and CA-3.7. The first is about restricting which external systems may connect, with allow lists or deny lists. The second is about data passed on to a third party by your vendor.
Evidence to collect
- An inventory of external connections and data flows with owners.
- Signed agreements or contract clauses for each, with data types and responsibilities.
- Security and privacy requirements documented per exchange.
- Approval records for new connections.
- Review dates for agreements.
- Egress rules or allow lists that enforce approved exchanges.
Common gaps
- Integrations added by engineers with no review.
- Contracts that are silent on data handling.
- Agreements signed once and never reviewed.
- No record of subprocessors of your vendors.
- Outbound network traffic that is wide open.
How to implement it
Create a register of exchanges. Require a short review before a new integration goes live, covering data classification, authentication, encryption and breach notice terms. Store the agreement beside the register entry. Review the register every year or when a vendor changes terms. Restrict outbound access to approved destinations where practical.
The demo shows how a vendor review fits this flow.
Click through it at your own pace, or open it full screen.
Quick check
Do SaaS tools count as information exchange?
Yes. NIST's guidance includes connections and exchanges with cloud services and web based services.
What is the minimum agreement content?
Interface characteristics, security and privacy requirements, controls, responsibilities and the impact level of the information.
