Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements?

What is the security perspective of an information exchange agreement? Unfortunately my research into the subject have revealed close to nothing in useful guidance. Section 6.2.3 (Addressing security in third party agreements) in SS-ISO/IEC 27002:2005 is not entirely helpful.

In addition to the ISO-documentation I've read several Information Exchange policies, but none seem to include an actual agreement. Mostly it seems to revolve around the following sections (specific details remain hidden from view):

  • Use an "endorsed" information security management system (ISMS)
  • Establish roles and responsibilities
  • Confidentiality, integrity and availability requirements (... doh)
  • Business continuity plan
  • Incident procedure/processes

Would appreciate any guidance, experience or knowledge you might have to share pertaining to my question. At this point in time almost anything is better than what I have which is close to nothing. (Points for examples!)

  • 2
    IANAL but asking for example agreements is probably beyond the point as such things usually fall within multi-jurisdictional laws and regulations of a particular governing body (bodies?) you're drafting this exchange agreement for, depend on data sensitivity and of course, who are the parties involved in such exchange (multilateral data exchange agreements?). You however don't mention either, and your question is as such probably unanswerable for being too broad (not specific enough) for our Q&A format.
    – TildalWave
    May 21, 2013 at 11:38
  • Agreement would be in public domain once established. May 21, 2013 at 11:50
  • TidalWave, Ok. Thanks, guess I'll simply close the question. May 21, 2013 at 11:51
  • 1
    Christoffer - the agreement may be in public domain, not so for the information exchanged between the agencies. Who decides the need-to-know? Who and how downgrades the information/releases to third parties? These are the basic items; maybe I'm misreading your question and you simply need the IT security perspective on that, but still, the key questions have to be answered. May 21, 2013 at 12:13
  • Deer hunter - You're absolutely correct in regards to the actual information exchanged. My question was/is more in regards to the more general governing framework (security perspective) that should be encapsulated in the actual agreement. The data-specification is an entirely different document. (+1 for constructive comment) May 21, 2013 at 12:16

1 Answer 1


In my experience in high level agreements of any type it's very difficult to insert specific requirements relating to security due to the challenge of matching controls that different organisations have in place (i.e. trying to get the other party to state compliance against your specific standards)

That's why most times, you'll see language around things like ISO2700x ISMS' . These form a common base where someone can say that the other party has a "reasonable" level of security in place (with the usual caveats that apply like the scope of the ISMS matching the use of the data etc)

Apart from that I'd say that the main security requirements you could consider would depend on how much you know about the specific data being shared under the agreement.

If you know for example that one class of data that's being shared should only be used by a specific department or individual in the other government that's something that would be worth adding to the agreement.

Also having a mapping of terms relating to things like protective marking could be useful to ensure that there are no mis-understandings relating to the information shared.

  • Thanks for your reply Rory. In some sense it's a more general overarching statement/agreement for information exchange. It is, indeed, difficult to be specific in any requirements. Currently it includes things such as "uses encryption to ensure transport confidentiality" and so forth. Rather broad, fairly meaningless statements but perhaps that's what needs to be included. IMHO responsibility and data ownership should be specified as should incident related contacts. A part from that... May 21, 2013 at 11:36
  • 4
    Actually as I wrote that I was thinking perhaps the most useful bit in such an agreement would be a mapping of the security terminology of the two organisations so "when we say securely marked with "secret" this is equivalent to your designation of "s2" ", as I'd say a lot of the problems would come in people not understanding the equivalencies and making assumptions as a result. May 21, 2013 at 12:01
  • Actually, that is a good point. Translating between two "schemes" of information classification. That might probably be a useful inclusion to ensure that the two talk the same language! (+1) May 21, 2013 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .