Organizations interconnecting test and development environments must have MOAs, MOUs, and SLAs properly documented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39673	ENTD0340	SV-51540r1_rule	DCID-1 EBCR-1 ECSC-1	Medium

Description
Prior to establishing a connection with another organization, a Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), and/or Service Level Agreement (SLA) must be established between the two organizations. This documentation, along with diagrams of the network topology, is required to be submitted to the DAAs for approval to connect to each other. The policy must ensure that all connections to external networks conform equally.

Description

Prior to establishing a connection with another organization, a Memorandum of Understanding (MOU), Memorandum of Agreement (MOA), and/or Service Level Agreement (SLA) must be established between the two organizations. This documentation, along with diagrams of the network topology, is required to be submitted to the DAAs for approval to connect to each other. The policy must ensure that all connections to external networks conform equally.

STIG	Date
Test and Development Zone C Security Technical Implementation Guide	2018-09-17

Details

Check Text ( C-46828r1_chk )
Verify Authorizing Official-approved MOAs, MOUs, and SLAs are up to date and included with the organization's accreditation package. If the organization does not have MOAs, MOUs, and/or SLAs with the accreditation package, this is a finding.

Fix Text (F-44681r1_fix)
Create MOUs, MOAs, and/or SLAs with other interconnected organizations, and then gain approval from the organization’s Authorizing Official and add the documentation to the accreditation package.