![](https://csdnimg.cn/release/download_crawler_static/12167314/bgb.jpg)
SECURITY GUIDE FOR INTERCONNECTING INFORMATION TECHNOLOGY SYSTEMS
1. INTRODUCTION
1.1 Authority
This document has been developed by the National Institute of Standards and Technology (NIST) in
furtherance of its statutory responsibilities under the Computer Security Act of 1987 and the Information
Technology Management Reform Act of 1996, specifically 15 United States Code (U.S.C.) 278 g-3
(a)(5). This document is not a guideline within the meaning of 15 U.S.C 278 g-3 (a)(3).
These guidelines are for use by federal organizations that process sensitive information. They are
consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130,
Appendix III.
This document may be used by nongovernmental organizations on a voluntary basis. It is not subject to
copyright.
Nothing in this document should be taken to contradict standards and guidelines made mandatory and
binding upon federal agencies by the Secretary of Commerce under statutory authority. Nor should these
guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,
the Director of the OMB, or any other federal official.
1.2 Purpose
This document provides guidance for planning, establishing, maintaining, and terminating
interconnections between information technology (IT) systems that are owned and operated by different
organizations, including organizations within a single federal agency.
1.3 Scope
This document is published by the National Institute of Standards and Technology (NIST) as
recommended guidance for federal agencies. It also may be used by nongovernmental (private sector)
organizations. This document presents general guidelines for interconnecting IT systems. Other forms of
information exchange, such as the use of browser cookies to exchange information between Web portal
sites, are beyond the scope of this document, although guidance contained herein may be useful for
developing such exchanges.
This document does not address classified systems or data, and it should not be used for guidance on
securing such systems. Federal agencies should rely on applicable laws, regulations, and policies for
interconnecting systems that are used to store, process, or transmit classified data.
1.4 Audience
This document is intended for system owners, data owners, program managers, security officers, system
architects, system administrators, and network administrators who are responsible for planning,
approving, establishing, maintaining, or terminating system interconnections. It is written in nontechnical
language for use by a broad audience. It does not address specific information technologies.
1-1