ISC2 Governance, Risk and Compliance (CGRC) Practice Question

An Interconnection Security Agreement (ISA) is the formal document prescribed by NIST SP 800-47 and referenced in NIST SP 800-18 for any connection between two information systems. The ISA spells out the technical interface characteristics, security controls (for example, encryption and authentication methods), and delineates the responsibilities of each party for operating and securing the shared interface. A Memorandum of Agreement (MOA) or MOU describes high-level roles and intentions but lacks detailed security control specifications. A Service Level Agreement focuses on performance and service metrics, not security safeguards for data exchanges. A Privacy Impact Assessment addresses personal data handling risks rather than defining the technical and security requirements of system interconnections. Therefore, documenting the API links in an ISA is the correct action.