Securing External Data Connections¶

Securing data exchange is essential for applications deploying in both Commercial, FedRAMP, and DoW Impact Level (IL) environments. Every External Data Connection (EDC) must be carefully planned, documented, and reviewed to ensure compliance with DoW and FedRAMP security standards.

This guide outlines the requirements and security practices for safely establishing EDCs in the Game Warden platform.

Why securing EDCs matters¶

Improperly configured external connections can lead to data spills, unauthorized access, and Software Approval delays. For example:

An IL4 application cannot send Controlled Unclassified Information (CUI) to an IL2 system or public internet endpoint.
All data moving over external connections must be encrypted using FIPS-compliant standards.
Game Warden must verify that connections don’t bypass IL or FedRAMP boundary segmentation rules.

Key security requirements¶

Data Flow Documentation – Diagrams and written descriptions of all inbound, outbound, and bidirectional data flows.
Encryption In Transit – All data must be protected with TLS 1.2+ (for example, mTLS).
Encryption At Rest – External systems must use FIPS 140-2 validated encryption modules or equivalent.
Impact Level Segmentation – Data must remain within its assigned Impact Level or FedRAMP baseline unless explicitly approved by the risk-owning Authorizing Official (AO).

Security guidelines for Impact Levels¶

Impact Level	Requirement
IL2 – Public or Non-Critical Mission Data	Enforce basic access controls and authentication Use TLS 1.2+ encryption for all data in transit Maintain activity logging and monitoring to detect misuse Avoid exposing non-public DoW data despite lower sensitivity
IL4 – Controlled Unclassified Information (CUI)	Strictly enforce IL segmentation—CUI must remain within IL4 or higher Do not process or store National Security System (NSS) CUI Apply encryption at rest using FIPS 140-2 validated modules Maintain role-based access control (RBAC) and audit logging Mission Owner Attestation may be required before approving ATCs or EDCs
IL5 – Higher Sensitivity CUI / Mission-Critical	Enforce least privilege for all users and services Segment workloads to isolate sensitive functions Apply continuous monitoring (for example, IDS/IPS, SIEM) Encrypt all external data at rest and in transit Document and justify all boundary-crossing data flows Cross-IL data movement requires formal security review
IL6 – Classified Systems	Continuous monitoring and active threat detection Apply the strongest possible encryption for all data Enforce restricted physical and logical access Follow NSA/DoW-defined cross-domain control protocols External connections must use approved cross-domain solutions and are rarely permitted

Security guidelines for FedRAMP Certification Classes (Class B – Class D)¶

The following table outlines the specific security and boundary requirements for all FedRAMP certification classes.

Certification Class	Security & Boundary Requirements
FedRAMP Low / Class B	Enforce basic access controls, TLS 1.2+ encryption in transit, and activity logging. External connections must be limited to essential, pre-approved public-facing services.
FedRAMP Class C (Moderate)	Restrict data flows to FedRAMP Moderate+ endpoints unless an Interconnection Security Agreement (ISA/MOU) is executed (NIST CA-3). Encrypt using active FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Outbound integrations with non-FedRAMP operational tools are permitted only if documented and restricted to non-sensitive telemetry (zero CUI/PII).
FedRAMP Class D (High)	Enforce strict least privilege, zero-trust boundary isolation, and explicit deny-by-default egress rules (NIST SC-7). Encrypt all external data flows using FIPS 140 validated mTLS (TLS 1.3) with mutual authentication. Immutable audit logs must capture all connection events, data volumes, and session durations directly to the SIEM (NIST AU-2, AU-10).

EDC and Sponsoring Agency Approval¶

Second Front customers may use a sponsoring authorizing agency to support capabilities that extend beyond the Game Warden authorization boundary. These EDCs can integrate external services and data sources, provided the connections receive the required approvals and meet applicable security requirements.

Key guidance:

Area	FedRAMP	DoW
AO risk acceptance	The sponsoring agency's AO is responsible for accepting the risk associated with an expanded authorization boundary or EDC. The AO must approve the connection through a Security Impact Analysis (SIA) memorandum or other required authorization process.	The AO or Authorizing Official Designated Representative (AODR) retains authority over external connections entering or leaving the designated Impact Level boundary.
Interconnection governance	Direct system-to-system connections with external or non-authorized boundaries may require an Interconnection Security Agreement (ISA), Memorandum of Understanding (MOU), or other applicable interconnection documentation.	External connections may require Mission Owner attestations and additional connection approvals to maintain appropriate segmentation of Controlled Unclassified Information (CUI) and Controlled Technical Information (CTI).
Boundary and data flow documentation	Document each EDC in updated Data Flow Diagrams (DFDs) and Authorization Boundary Diagrams (ABDs). The documentation should identify the connection's ingress and egress paths, ports, protocols, and applicable encryption controls.	Document each ATC or EDC in updated DFDs and ABDs. The documentation should identify the connection's ingress and egress paths, ports, protocols, and applicable encryption controls.
Connections to non-authorized or commercial endpoints	Connections to non-FedRAMP external endpoints, such as operational webhooks or logging services, may be permitted when appropriately documented and approved. The connection must use the required encryption controls and must not expose CUI or PII to an unauthorized external system.	External commercial connections are subject to additional restrictions across Impact Levels IL2 through IL5. Outbound connections may require explicit approval from the Mission Owner or AO.

Commercial connection rules¶

Commercial data connections entering a DoW-IL environment must follow a strict ingress-only policy—this includes IL2 environments. Outbound or bidirectional communication is not allowed unless explicitly approved through the ATC or EDC request process.

Following these security requirements—and taking a proactive approach to risk management—helps teams maintain secure data flows, protect critical systems, and ensure mission continuity. A documented incident response plan is also essential for addressing potential security events swiftly and effectively.

ATC or EDC checklist¶

If your application includes any EDCs, you must submit an EDC request package to Second Front for review and approval. Use the checklist below to validate your setup before assembling the required artifacts for your submission.

Authorization to Connect (ATC) memorandum¶

For DoW IL2, IL4, and IL5 applications, the Authorization to Connect (ATC) memorandum replaces the previous EDC form. Complete one ATC memorandum for each connection and include it in your request package. Some existing connections are grandfathered and may continue under the EDC form. Your Mission Success Manager (MSM) can confirm which applies to you.

The memorandum is a recommendation from the Information System Security Manager (ISSM) to the Defense Innovation Unit (DIU) Authorizing Official (AO). It documents the following for the proposed connection:

System-to-system identification: The owning organization, eMASS system ID, and Impact Level of the source and destination systems.
Connection details: Source and destination IPs or URLs, directionality, data elements transmitted in each direction, explicit exclusions, port, and whether the connection is permanent or temporary.
Technical interface: The file types or payload format, interface type, encryption, and authentication method.
Risk assessment: The impacted controls and how you validated the risk, including how you validated the sensitivity classification of the data.

Note

The ATC approval applies only to the Game Warden Platform as a Service configuration under the DIU ISSM and AO. It does not extend to ATCs for any other government information system boundary.

→ Download ATC memorandum template

Replace every placeholder in angle brackets, such as the application name, connected system, and domains. Contact your MSM if you need help completing the memorandum.

Required artifacts¶

Include the following artifacts with your EDC submission package to Second Front for review:

Artifact	Requirements
Technical data flow specifications	- Complete inventory of all external IP addresses, ports, protocols, and communication directions, including ingress, egress, and bidirectional connections. - Detailed description of the data transmitted through each connection and its categorization, such as CUI, CTI, or non-sensitive operational telemetry. - Clear operational justification and business purpose for each connection.
Boundary and architecture diagrams	- Updated DFDs and ABDs that show exact ingress and egress routes, security mesh boundaries, and encryption mechanisms. - Format the diagrams consistently with your existing Body of Evidence (BoE).
FedRAMP / Civilian submissions	- Completed Interconnection Security Agreement (ISA) or Memorandum of Understanding (MOU), as required under NIST CA-03. - Updated Table 7, Table 9, and Appendix Q declarations in your System Security Plan (SSP) or Application Security Profile.
DoW submissions	- Completed ATC memorandum for each connection, or the EDC form for grandfathered connections. Refer to Authorization to Connect (ATC) memorandum. - Signed Mission Owner Attestation. - Security review sign-off confirming IL segmentation and CUI and CTI containment.

Need help?¶

For questions or to submit your request package, contact your Mission Success Manager (MSM).