Organizations interconnecting test and development environments must have MOAs, MOUs, and SLAs properly documented.

From Test and Development Zone C Security Technical Implementation Guide

Part of ENTD0340 - Approved contracts are not in place between interconnected organizations.

Associated with IA controls: EBCR-1, ECSC-1, DCID-1

SV-51540r1_rule Organizations interconnecting test and development environments must have MOAs, MOUs, and SLAs properly documented.

Vulnerability discussion

Prior to establishing a connection with another organization, a Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), and/or Service Level Agreement (SLA) must be established between the two organizations. This documentation, along with diagrams of the network topology, is required to be submitted to the DAAs for approval to connect to each other. The policy must ensure that all connections to external networks conform equally.

Check content

Verify Authorizing Official-approved MOAs, MOUs, and SLAs are up to date and included with the organization's accreditation package. If the organization does not have MOAs, MOUs, and/or SLAs with the accreditation package, this is a finding.

Fix text

Create MOUs, MOAs, and/or SLAs with other interconnected organizations, and then gain approval from the organization’s Authorizing Official and add the documentation to the accreditation package.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.