NIST SP800-47：联邦组织间信息系统互联安全指南

NIST

SP800

需积分: 9 6 浏览量更新于2024-07-16 收藏 534KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

SECURITY GUIDE FOR INTERCONNECTING INFORMATION TECHNOLOGY SYSTEMS

1. INTRODUCTION

1.1 Authority

This document has been developed by the National Institute of Standards and Technology (NIST) in

furtherance of its statutory responsibilities under the Computer Security Act of 1987 and the Information

Technology Management Reform Act of 1996, specifically 15 United States Code (U.S.C.) 278 g-3

(a)(5). This document is not a guideline within the meaning of 15 U.S.C 278 g-3 (a)(3).

These guidelines are for use by federal organizations that process sensitive information. They are

consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130,

Appendix III.

This document may be used by nongovernmental organizations on a voluntary basis. It is not subject to

Nothing in this document should be taken to contradict standards and guidelines made mandatory and

binding upon federal agencies by the Secretary of Commerce under statutory authority. Nor should these

guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,

the Director of the OMB, or any other federal official.

1.2 Purpose

This document provides guidance for planning, establishing, maintaining, and terminating

interconnections between information technology (IT) systems that are owned and operated by different

organizations, including organizations within a single federal agency.

1.3 Scope

This document is published by the National Institute of Standards and Technology (NIST) as

recommended guidance for federal agencies. It also may be used by nongovernmental (private sector)

organizations. This document presents general guidelines for interconnecting IT systems. Other forms of

information exchange, such as the use of browser cookies to exchange information between Web portal

sites, are beyond the scope of this document, although guidance contained herein may be useful for

developing such exchanges.

This document does not address classified systems or data, and it should not be used for guidance on

securing such systems. Federal agencies should rely on applicable laws, regulations, and policies for

interconnecting systems that are used to store, process, or transmit classified data.

1.4 Audience

This document is intended for system owners, data owners, program managers, security officers, system

architects, system administrators, and network administrators who are responsible for planning,

approving, establishing, maintaining, or terminating system interconnections. It is written in nontechnical

language for use by a broad audience. It does not address specific information technologies.

1-1

SECURITY GUIDE FOR INTERCONNECTING INFORMATION TECHNOLOGY SYSTEMS

1.5 Other Approaches to System Interconnectivity

This document provides a recommended approach for interconnecting IT systems. It is recognized,

however, that many organizations have interconnected IT systems using different approaches, and some

organizations follow specific procedures to meet unique operational requirements.

This document is intended only as guidance and it should not be construed as defining the only approach

possible. It provides a logical framework for those organizations that have not previously interconnected

IT systems, and it provides information that other organizations may use to enhance the security of

existing interconnections. Organizations should tailor the guidelines to meet their specific needs and

requirements.

1.6 Document Structure

This document is organized into six sections. Section 1 introduces the document. Section 2 describes the

benefits of interconnecting IT systems, identifies the basic components of an interconnection, identifies

methods and levels of interconnectivity, and discusses potential risks of interconnecting systems.

Sections 3 through 6 address the interconnection life-cycle. Section 3 presents recommended steps for

planning a system interconnection. Section 4 provides recommended steps for establishing the

interconnection. Section 5 provides recommended steps for maintaining the system interconnection after

it is established. Section 6 provides guidelines for terminating the interconnection and restoring it after it

is terminated.

Appendix A provides a guide for developing an Interconnection Security Agreement, which documents

the technical requirements of the interconnection, as well as a sample agreement. Appendix B provides a

guide for developing a Memorandum of Understanding/Agreement, which defines the responsibilities of

the participating organizations, as well as a sample memorandum. Appendix C provides a guide for

developing a System Interconnection Implementation Plan, which defines the process of establishing the

interconnection. Appendixes D, E, and F contain a glossary, a list of references, and an index,

respectively.

1-2

剩余57页未读，继续阅读

艾米的爸爸

粉丝: 760
资源: 314

NIST SP800-47：联邦组织间信息系统互联安全指南

NIST SP 800-193(中文)

NISTSP800-57,RecommendationforKeyManagement：NISTSP800-57，密钥管理的建议....

NIST SP800-177r1.pdf

NIST SP800-133：加密密钥生成建议

NIST SP800-126: SCAP 1.0技术规范

NIST SP800-94：入侵检测与预防系统指南

NIST SP800-168：近似匹配定义与术语

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

nist sp800-60

2017 nist sp800-181

NIST SP800-22r1a

sp800-53 工控

SP800-22标准 MATLA

什么是SP800-121

[nist 800-38b]

最新资源