Information Exchange Agreement template: The agreement that approves and governs one exchange of information with a system outside the authorization boundary, usable as an interconnection security agreement or an information exchange security agreement, with a register of every exchange and its review date, as SP 800-53 CA-3 requires.
The agreement that approves and governs one exchange of information with a system outside the authorization boundary, usable as an interconnection security agreement or an information exchange security agreement, with a register of every exchange and its review date, as SP 800-53 CA-3 requires.
This agreement sets the terms, conditions and safeguards under which Organization name and Fill in: the other organization exchange the information described in section 2. It is one of the agreements Organization name uses to approve and manage information exchanges, which are Select one or more: interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: organization-defined type of agreement] Typical: interconnection security agreements or information exchange security agreements, and service level agreements or contract terms with the same content for external services (CA-3a).
Item
Description
Business purpose
Fill in: why the exchange is needed and the benefit expected
Authority
Fill in: the law, contract, policy or decision that authorizes the exchange
Related agreements
Fill in: for example a memorandum of understanding, contract, service level agreement or nondisclosure agreement, with dates
Supersedes
Fill in: the earlier agreement this replaces, with its date, or “none”
The receiving party uses the information only for the purpose in section 1, and only as that purpose requires.
The receiving party does not disclose the information to anyone not party to this agreement without the providing party’s written consent, unless a law requires it. Fill in: any further limits, for example no transfer outside the country
Access is limited to the receiving party’s employees, contractors and agents who need the information for the stated purpose, and who have signed an access agreement or equivalent user agreement.
The receiving party keeps the information for Fill in: retention period or rule, then returns or destroys it as the providing party directs, and confirms the destruction in writing.
Each party protects the exchanged information, and the systems that process, store or transmit it, according to its impact level (CA-3b).
Requirement
Commitment
Governing policies and baseline
Fill in: each party’s governing security and privacy policies, and the control baseline each system meets, for example the SP 800-53B Moderate baseline
Protection in transit
Fill in: for example encryption with validated cryptographic modules over the whole path
Protection at rest
Fill in: for example encrypted storage on the receiving system
Authentication and access
Fill in: for example multifactor authentication for users, and certificates or keys for system accounts
Accounts authorized to transfer data
Fill in: for a High system, the accounts or systems allowed to send data and the write permissions each holds (CA-3(6)); otherwise “not required”
Event logging
Fill in: the events each party logs for the exchange, for example transfers, access attempts and administrator actions, and how long logs are kept
Personally identifiable information
Fill in: privacy requirements, for example minimization, use limits and breach notification, or “none exchanged”
This agreement takes effect on the date of the last signature and remains in effect until Fill in: the end date, or until terminated.
The System owner reviews and updates this agreement, with the other party, Fill in: the frequency at which to review and update agreements Typical: at least annually, and when either system makes a significant change that affects the exchange (CA-3c). Each party certifies at the review that it has complied with the agreement and reports any changes to the exchange.
Changes to this agreement are made in writing and signed by both parties.
Either party may end the exchange with Fill in: notice period written notice. Either party may suspend it immediately if a security incident requires, or if the other party misuses the information or breaks this agreement.
When the exchange ends, the parties disconnect it, disable the accounts used, return or destroy the exchanged information as section 3 requires, and update their system security plans (CA-3a).
The authorizing official for each system approves this exchange (CA-3a). Each signatory confirms that they have authority to commit their organization to this agreement.
OMB Circular A-130, Appendix I, section 4.c(16), requires the authorizing official’s approval for connections from a system, as defined by its authorization boundary, to other systems, based on the risk to agency operations and assets, individuals, other organizations and the Nation. Section 4.j(2)(f) requires agreements, such as memoranda of understanding, interconnection security agreements or contracts, for interfaces between agency systems and systems that contractors or other entities use or operate on the Government’s behalf. Section 4.i(14) requires agencies to encrypt all FIPS 199 moderate-impact and high-impact information at rest and in transit, unless it is technically infeasible or would demonstrably affect the mission, and the authorizing official accepts the risk of not encrypting with the approval of the agency Chief Information Officer, in consultation with the Senior Agency Official for Privacy as appropriate; section 4.i(15) requires validated cryptographic modules under NIST standards. Where the exchange discloses records from a system of records for a computer matching program, the Privacy Act requires a separate written matching agreement (5 U.S.C. § 552a(o)). As of September 2026.
The authorizing official shall base the approval in section 10 on the risk to agency operations and assets, individuals, other organizations and the Nation, as OMB Circular A-130, Appendix I, section 4.c(16), requires. (CA-3a)
The System owner shall ensure moderate-impact and high-impact information exchanged under this agreement is encrypted in transit and at rest with validated cryptographic modules, or that the authorizing official has accepted the risk of not encrypting it with the Chief Information Officer’s approval, as OMB Circular A-130, Appendix I, section 4.i(14) and (15), requires. (CA-3b)
The System owner shall confirm with the Senior privacy official whether the exchange is a computer matching program, and if so ensure a matching agreement under 5 U.S.C. § 552a(o) is in place before records are disclosed. (CA-3b)
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.