Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements?
What is the security perspective of an information exchange agreement? Unfortunately my research into the subject have revealed close to nothing in useful guidance. Section 6.2.3 (Addressing security in third party agreements) in SS-ISO/IEC 27002:2005 is not entirely helpful.
In addition to the ISO-documentation I've read several Information Exchange policies, but none seem to include an actual agreement. Mostly it seems to revolve around the following sections (specific details remain hidden from view):
- Use an "endorsed" information security management system (ISMS)
- Establish roles and responsibilities
- Confidentiality, integrity and availability requirements (... doh)
- Business continuity plan
- Incident procedure/processes
Would appreciate any guidance, experience or knowledge you might have to share pertaining to my question. At this point in time almost anything is better than what I have which is close to nothing. (Points for examples!)