US Dept of Homeland Security FEMA 8/28/2020

FOR OFFICIAL USE ONLY//CONTROLLED UNCLASSIFIED INFORMATION resolution procedures will be documented by the identifying party and after action reports generated and submitted to the system owner and/or designated security officials within five(5)business days after detection of the incident(s). • Disasters and Other Contingencies: The FEMA IPAWS Program Office will notify the COG by telephone,e- mail or other acceptable means in the event of a disaster or other contingency that disrupts the normal operation of IPAWS-OPEN. • System Interconnections:This MOA is intended for systems interoperating with IPAWS-OPEN using SOAP over HTTPS via the public Internet. If in the future,an interconnection(i.e.dedicated system-to-system connection)is required to IPAWS-OPEN,this MOA must be updated and an Interconnection Security Agreement(ISA)must be executed.If a change in status from interoperating to interconnected system is required,the initiating party will notify the other party at least 3 months before the planned interconnection is to be in place. • Discontinuation of Use:In the event the use of IPAWS-OPEN is no longer required,the COG agrees to immediately notify,in writing,the FEMA IPAWS Program Office at which time the COGID and associated access credentials will be deactivated. • Personnel Changes:Both parties agree to provide notification of changes to their respective system owner or technical lead.In addition,both parties will provide notification of any changes in the point of contact information provided in Appendix B. All relevant personnel changes and changes to contact information must be provided within 5 business days of the change. 6.0 TYPE OF INTERCONNECTIVITY Both parties agree that the COG will utilize only the assigned COGID,associated credentials and digital certificates provided by the FEMA IPAWS Program Office to support interoperability between the system(s)listed in Appendix A and IPAWS-OPEN.In addition,all interoperable systems must be configured to interface with IPAWS-OPEN over the public Internet using only approved web service standards and associated requirements. A listing of approved web service standards and supporting requirements can be obtained from the IPAWS-OPEN Web Service Interface Design Guidance document. In the event,a dedicated connection is required,both parties will agree to negotiate and execute an Interconnection Security Agreement(ISA)as required per Department of Homeland Security(DHS)policy which must be signed by all required parties before the interconnection is activated.Proposed changes to either system that affect system interoperability will be reviewed and evaluated to determine the potential impact.If the proposed changes impact the agreed upon terms,the MOA will be renegotiated and executed before changes are implemented. 7.0 SECURITY To ensure the joint security of the systems and the message data they store,process,and transmit,both parties agree to adhere to and enforce the Rules of Behavior(as specified in Appendix C). In addition,both parties agree to the following: • Ensure authorized users accessing the interoperable system(s)receive,agree to abide by and sign(electronically or in paper form)the IPAWS-OPEN Rules of Behavior as specified in Appendix C.Each jurisdiction is responsible for keeping the signed Rules of Behavior on file or stored electronically for each system user. • Utilize FEMA approved PKI certificates to digitally sign messages as they are transported over the public Internet. • Certify that its respective system is designed,managed and operated in compliance with all relevant federal laws, regulations,and policies. • Document and maintain jurisdictional and/or system specific security policies and procedures and produce such documentation in response to official inquiries and/or requests. 3 V4.2,June 20,2019