Securing External Data Connections

Securing data exchange is essential for applications deploying in both Commercial, FedRAMP, and DoW Impact Level (IL) environments. Every External Data Connection (EDC) must be carefully planned, documented, and reviewed to ensure compliance with DoW and FedRAMP security standards.

This guide outlines the requirements and security practices for safely establishing EDCs in the Game Warden platform.

---

Why securing EDCs matters

Improperly configured external connections can lead to data spills, unauthorized access, and Software Approval delays. For example:

• An IL4 application cannot send Controlled Unclassified Information (CUI) to an IL2 system or public internet endpoint.
• All data moving over external connections must be encrypted using FIPS-compliant standards.
• Game Warden must verify that connections don’t bypass IL or FedRAMP boundary segmentation rules.

---

Key security requirements

• Data Flow Documentation – Diagrams and written descriptions of all inbound, outbound, and bidirectional data flows.
• Encryption In Transit – All data must be protected with TLS 1.2+ (for example, mTLS).
• Encryption At Rest – External systems must use FIPS 140-2 validated encryption modules or equivalent.
• Impact Level Segmentation – Data must remain within its assigned Impact Level or FedRAMP baseline unless explicitly approved by the risk-owning Authorizing Official (AO).

---

Security guidelines for Impact Levels

Impact Level	Requirement
IL2 – Public or Non-Critical Mission Data	Enforce basic access controls and authentication Use TLS 1.2+ encryption for all data in transit Maintain activity logging and monitoring to detect misuse Avoid exposing non-public DoW data despite lower sensitivity
IL4 – Controlled Unclassified Information (CUI)	Strictly enforce IL segmentation—CUI must remain within IL4 or higher Do not process or store National Security System (NSS) CUI Apply encryption at rest using FIPS 140-2 validated modules Maintain role-based access control (RBAC) and audit logging Mission Owner Attestation may be required before approving EDCs
IL5 – Higher Sensitivity CUI / Mission-Critical	Enforce least privilege for all users and services Segment workloads to isolate sensitive functions Apply continuous monitoring (for example, IDS/IPS, SIEM) Encrypt all external data at rest and in transit Document and justify all boundary-crossing data flows Cross-IL data movement requires formal security review
IL6 – Classified Systems	Continuous monitoring and active threat detection Apply the strongest possible encryption for all data Enforce restricted physical and logical access Follow NSA/DoW-defined cross-domain control protocols External connections must use approved cross-domain solutions and are rarely permitted

---

Security guidelines for FedRAMP Certification Classes (Class B – Class D)

The following table outlines the specific security and boundary requirements for all FedRAMP certification classes.

Certification Class	Security & Boundary Requirements
FedRAMP Low / Class B	Enforce basic access controls, TLS 1.2+ encryption in transit, and activity logging. External connections must be limited to essential, pre-approved public-facing services.
FedRAMP Class C (Moderate)	Restrict data flows to FedRAMP Moderate+ endpoints unless an Interconnection Security Agreement (ISA/MOU) is executed (NIST CA-3). Encrypt using active FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Outbound integrations with non-FedRAMP operational tools are permitted only if documented and restricted to non-sensitive telemetry (zero CUI/PII).
FedRAMP Class D (High)	Enforce strict least privilege, zero-trust boundary isolation, and explicit deny-by-default egress rules (NIST SC-7). Encrypt all external data flows using FIPS 140 validated mTLS (TLS 1.3) with mutual authentication. Immutable audit logs must capture all connection events, data volumes, and session durations directly to the SIEM (NIST AU-2, AU-10).

---

EDC and Sponsoring Agency Approval

Second Front customers may use a sponsoring authorizing agency to support capabilities that extend beyond the Game Warden authorization boundary. These EDCs can integrate external services and data sources, provided the connections receive the required approvals and meet applicable security requirements.

Key guidance:

Area	FedRAMP	DoW
AO risk acceptance	The sponsoring agency's AO is responsible for accepting the risk associated with an expanded authorization boundary or EDC. The AO must approve the connection through a Security Impact Analysis (SIA) memorandum or other required authorization process.	The AO or Authorizing Official Designated Representative (AODR) retains authority over external connections entering or leaving the designated Impact Level boundary.
Interconnection governance	Direct system-to-system connections with external or non-authorized boundaries may require an Interconnection Security Agreement (ISA), Memorandum of Understanding (MOU), or other applicable interconnection documentation.	External connections may require Mission Owner attestations and additional connection approvals to maintain appropriate segmentation of Controlled Unclassified Information (CUI) and Controlled Technical Information (CTI).
Boundary and data flow documentation	Document each EDC in updated Data Flow Diagrams (DFDs) and Authorization Boundary Diagrams (ABDs). The documentation should identify the connection's ingress and egress paths, ports, protocols, and applicable encryption controls.	Document each EDC in updated DFDs and ABDs. The documentation should identify the connection's ingress and egress paths, ports, protocols, and applicable encryption controls.
Connections to non-authorized or commercial endpoints	Connections to non-FedRAMP external endpoints, such as operational webhooks or logging services, may be permitted when appropriately documented and approved. The connection must use the required encryption controls and must not expose CUI or PII to an unauthorized external system.	External commercial connections are subject to additional restrictions across Impact Levels IL2 through IL5. Outbound connections may require explicit approval from the Mission Owner or AO.

---

Commercial connection rules

Commercial data connections entering a DoW-IL environment must follow a strict ingress-only policy—this includes IL2 environments. Outbound or bidirectional communication is not allowed unless explicitly approved through the EDC request process.

Following these security requirements—and taking a proactive approach to risk management—helps teams maintain secure data flows, protect critical systems, and ensure mission continuity. A documented incident response plan is also essential for addressing potential security events swiftly and effectively.

---

EDCs checklist

If your application includes any EDCs, you must submit an EDC request package to Second Front for review and approval. Use the checklist below to validate your setup before assembling the required artifacts for your submission.

1. Core checklist2. DoW-specific EDC checklist3. FedRAMP-specific EDC checklist

Applies to all EDCs.

• Data protection: Is data encrypted in transit using TLS 1.2+ or mTLS and at rest using active FIPS 140-2 or FIPS 140-3 validated cryptographic modules?
• Connection documentation: Have you submitted updated Network Diagrams, DFDs, and ABDs that show the exact ingress and egress routes, protocols, and ports?
• SIEM log forwarding: Are connection lifecycle events, connection failures, and volume metrics streamed immutably to the Game Warden SIEM in accordance with NIST AU-02 and AU-06?

Applies to IL 2–6.

• Impact Level segmentation: Are data flows strictly confined to their assigned IL without bypassing segmentation controls?
• Ingress-only compliance: Does the commercial-to-DoW connection enforce an ingress-only data flow unless the AO has granted an explicit outbound exception?
• CTI and CUI containment: Have you verified that no Controlled Technical Information (CTI) or National Security System (NSS) Controlled Unclassified Information (CUI) is transmitted outside the DoW environment?
• DoW governance: Has a Mission Owner Attestation been executed and signed for IL4 and IL5 interconnections?

Applies to Classes B–D.

• FedRAMP baseline alignment: Is the destination external service FedRAMP-authorized at an equivalent or higher impact baseline?
• Non-FedRAMP endpoints: If connecting to an unauthorized external service, such as an operational webhook, is the connection declared in the SSP or Application Security Profile, restricted to non-sensitive telemetry, and confirmed to carry no CUI or PII?
• NIST CA-03 compliance: Is a formal Interconnection Security Agreement (ISA) or Memorandum of Understanding (MOU) documented for system-to-system data exchanges?
• Egress deny-by-default: Is outbound traffic blocked by default at the mesh or firewall level, with only explicitly approved IP addresses, ports, and domains allowed?

---

Required artifacts

Include the following artifacts with your EDC submission package to Second Front for review:

Artifact	Requirements
Technical data flow specifications	- Complete inventory of all external IP addresses, ports, protocols, and communication directions, including ingress, egress, and bidirectional connections. - Detailed description of the data transmitted through each connection and its categorization, such as CUI, CTI, or non-sensitive operational telemetry. - Clear operational justification and business purpose for each connection.
Boundary and architecture diagrams	- Updated DFDs and ABDs that show exact ingress and egress routes, security mesh boundaries, and encryption mechanisms. - Format the diagrams consistently with your existing Body of Evidence (BoE).
FedRAMP / Civilian submissions	- Completed Interconnection Security Agreement (ISA) or Memorandum of Understanding (MOU), as required under NIST CA-03. - Updated Table 7, Table 9, and Appendix Q declarations in your System Security Plan (SSP) or Application Security Profile.
DoW submissions	- Signed Mission Owner Attestation. - Security review sign-off confirming IL segmentation and CUI and CTI containment.

---

Need help?

For questions or to submit your request package, contact your Mission Success Manager (MSM).