CA-3: Information Exchange

What this control requires

CA-03 requires organizations to approve, document, and manage every information exchange between systems using formal agreements. That means no data flows between interconnected systems without a signed agreement that spells out interface characteristics, security and privacy requirements, applicable controls, each party’s responsibilities, and the impact of the exchange.

In practice, these agreements take several forms depending on the relationship and risk level: interconnection security agreements (ISAs), information exchange security agreements (IESAs), memoranda of understanding (MOUs), service-level agreements (SLAs), user agreements, and non-disclosure agreements (NDAs). The type of agreement you use depends on the data’s impact level, the organizational relationship between the parties, and the level of access each system has to the other’s resources.

What makes CA-03 distinct from a one-time documentation exercise is the ongoing review requirement. Without a defined review cycle, agreements go stale as systems evolve, new data types are introduced, and security requirements shift. CA-03 applies broadly across exchange methods including VPNs, leased lines, database sharing, cloud services, web services, file transfers, email, and organization-to-organization communications.

Why it matters

Unmanaged information exchanges consistently surface as compliance findings during NIST SP 800-53 assessments. Organizations frequently connect systems, share data with partners, and spin up cloud integrations without formalizing the security boundaries around those exchanges. The result is a growing web of undocumented data flows that auditors can’t verify and security teams can’t monitor.

Without formal agreements, accountability breaks down. When an incident occurs on an interconnected system, the lack of documented responsibilities makes it unclear who owns the response, who must notify affected parties, and which controls were supposed to be in place. This accountability gap directly increases organizational risk exposure and extends incident response timelines.

Specifically, the risk compounds when systems with different security categorizations exchange data. A high-impact system sharing information with a moderate-impact system without documented controls creates an unmanaged downgrade path for sensitive data. Auditors specifically look for these mismatches, and a missing or outdated agreement is a straightforward finding that can delay or block an authorization to operate (ATO).

What attackers exploit

• Undocumented interconnections that bypass network segmentation and monitoring controls, creating blind spots in the security architecture
• Stale agreements that reference decommissioned controls or outdated configurations, leaving gaps between documented and actual security posture
• Unmonitored data exchange channels such as legacy file transfers and email-based data sharing that lack encryption or integrity verification
• Third-party connections with weaker security requirements, where attackers pivot from a lower-security partner system into a higher-value target

How to implement

The most common failure mode for CA-03 isn’t a lack of agreements altogether. It’s agreements that exist on paper but don’t reflect reality. Systems get connected, integrations get built, and the formal documentation either never catches up or falls out of date within months.

For your organization

Start by inventorying every system-to-system exchange your organization participates in. This inventory should capture the exchange method (VPN, API, file transfer, cloud service), the data types flowing in each direction, and the current authorization status of each connection.

The appropriate agreement type depends on who manages the systems involved. Systems managed under the same authorizing official can reference their system security plans rather than creating separate ISAs. For exchanges with external organizations, formal ISAs or IESAs are typically required.

Specifically, every agreement should document these elements at a minimum.

• Interface characteristics, including ports, protocols, data formats, and connection methods
• Security and privacy requirements specific to the data being exchanged
• Controls in place at each endpoint to protect the exchange
• Each party’s responsibilities for monitoring, incident response, and access management
• The impact level of the systems and data involved

In practice, this documentation baseline degrades quickly without a review cadence. Tie agreement reviews to system reauthorization cycles or set an independent frequency (annually at minimum). Track review dates and assign ownership so agreements don’t silently expire.

Beyond review cycles, build a connection approval workflow that requires security review before any new system interconnection goes live. Without a gate, shadow connections will accumulate faster than your team can document them.

For your vendors

When assessing third-party compliance with CA-03, you’re looking for evidence that your vendors treat information exchanges with the same rigor you do. Start with these key requirements for third-party risk.

Specifically, the most direct evidence to request is copies of your vendor’s interconnection security agreements or information exchange security agreements. Review them for completeness against the CA-03 assessment objectives: interface characteristics, security requirements, privacy requirements, controls, responsibilities, and impact levels should all be documented.

Beyond completeness, verify that agreements are current. Ask for the date of the last review and the defined review frequency. An agreement last updated three years ago for a system that has undergone significant changes is a red flag.

Specifically, evaluate the vendor’s process for approving new connections. Vendors with a formal approval workflow that includes security review demonstrate stronger CA-03 maturity than those who rely on informal or ad hoc processes.

Where these processes break down, specific red flags emerge during assessment.

• Agreements that use generic boilerplate language without system-specific details
• Missing or vague descriptions of security controls at the interface boundary
• No defined review cadence or evidence of past reviews
• Inconsistent impact level documentation between the agreement and the vendor’s system security plan

Use your compliance checklist to track vendor assessment status and ensure nothing falls through the cracks.

Evidence examples

Cross-framework mapping

Related controls

The following controls within the Assessment, Authorization, and Monitoring family and across other NIST SP 800-53 families are closely related to CA-03.

• AC-04 — Information Flow Enforcement: Enforces the technical flow restrictions that CA-03 agreements define at the policy level.
• AC-20 — Use of External Systems: Governs how your organization connects to and uses systems outside its authorization boundary.
• AU-16 — Cross-organizational Audit Logging: Establishes shared logging requirements for exchanges that span organizational boundaries.
• CA-06 — Authorization: Provides the formal authorization decision that CA-03 agreements support and depend on.
• IA-03 — Device Identification and Authentication: Ensures devices at each end of an information exchange are positively identified before data flows.
• IR-04 — Incident Handling: Defines the incident response responsibilities that CA-03 agreements must document for each party.
• PL-02 — System Security and Privacy Plans: Contains the security plan information that systems under the same authorizing official can reference instead of separate ISAs.
• PT-07 — Specific Categories of Personally Identifiable Information: Addresses privacy-specific requirements for exchanges involving personally identifiable information (PII).
• RA-03 — Risk Assessment: Informs the risk-based decisions about which agreement type and which controls are appropriate for each exchange.
• SA-09 — External System Services: Covers contracted services where information exchange agreements may be incorporated into formal service contracts.

Frequently asked questions

What is NIST SP 800-53 CA-03?

CA-03 is the NIST SP 800-53 control that requires organizations to approve and manage information exchanges between systems using formal agreements such as interconnection security agreements and information exchange security agreements. These agreements must document interface characteristics, security and privacy requirements, applicable controls, each party’s responsibilities, and the impact level of the systems involved. CA-03 is included in the LOW, MODERATE, and HIGH baselines, making it a universal requirement across federal system categorizations.

What happens if CA-03 is not implemented?

Without CA-03, organizations lose visibility into how data moves between systems and who bears responsibility for protecting those exchanges. Auditors checking CA-03 specifically verify that exchange agreements exist, that they document interface characteristics and security requirements, and that they’re reviewed on a defined schedule. A missing or incomplete agreement is a direct finding that can delay an authorization to operate. The risk compounds when systems with different impact levels exchange data without documented controls governing the downgrade path.

How do you audit CA-03?

Auditors assess CA-03 by verifying that each system interconnection has an approved formal agreement and that the agreement covers all required elements: interface characteristics, security requirements, privacy requirements, controls, responsibilities, and impact levels. They’ll request interconnection security agreements, information exchange security agreements, MOUs, and SLAs as evidence. Auditors also check whether agreements have been reviewed and updated according to the organization’s defined frequency by examining review logs and comparing agreement dates to the review cadence documented in the system security plan.

What types of agreements does CA-03 require?

CA-03 doesn’t mandate a single agreement type. The appropriate format depends on the data’s impact level, the relationship between organizations, and the level of system access involved. Common agreement types include interconnection security agreements (ISAs) for system-to-system connections, information exchange security agreements (IESAs) for data-sharing arrangements, memoranda of understanding (MOUs) for interagency partnerships, service-level agreements (SLAs) for contracted services, and non-disclosure agreements (NDAs) when sensitive data is involved. When two systems share the same authorizing official, the system security plan can serve as the governing document instead of a separate agreement.