Securing External Data Connections

Securing data exchange is essential for applications deploying in both Commercial, FedRAMP, and DOW Impact Level (IL) environments. Plan, document, and review every External Data Connection (EDC) to ensure compliance with DOW and FedRAMP security standards.

This guide outlines the requirements and security practices for establishing EDCs in the Game Warden platform.

Why securing EDCs matters

Improperly configured external connections can lead to data spills, unauthorized access, and Software Approval delays. For example:

An IL4 application cannot send Controlled Unclassified Information (CUI) to an IL2 system or public internet endpoint.
Encrypt all data moving over external connections using FIPS-compliant standards.
Game Warden must verify that connections don’t bypass IL or FedRAMP boundary segmentation rules.

Key security requirements

Data Flow Documentation: Diagrams and written descriptions of all inbound, outbound, and bidirectional data flows.
Encryption In Transit: Protect all data with TLS 1.2+ (for example, mTLS).
Encryption At Rest: External systems must use FIPS 140-2 validated encryption modules or equal.
Impact Level Segmentation: Data must remain within its assigned Impact Level or FedRAMP baseline unless explicitly approved by the risk-owning Authorizing Official (AO).

Security guidelines for Impact Levels

Impact Level	Requirement
IL2 – Public or Non-Critical Mission Data	Enforce basic access controls and authentication Use TLS 1.2+ encryption for all data in transit Maintain activity logging and monitoring to detect misuse Avoid exposing non-public DOW data despite lower sensitivity
IL4 – Controlled Unclassified Information (CUI)	Strictly enforce IL segmentation—CUI must remain within IL4 or higher Do not process or store National Security System (NSS) CUI Apply encryption at rest using FIPS 140-2 validated modules Maintain role-based access control (RBAC) and audit logging Mission Owner Attestation may be required before approving Authorization to Connect (ATCs) or EDCs
IL5 – Higher Sensitivity CUI / Mission-Critical	Enforce least privilege for all users and services Segment workloads to isolate sensitive functions Apply continuous monitoring (for example, IDS/IPS, SIEM) Encrypt all external data at rest and in transit Document and justify all boundary-crossing data flows Cross-IL data movement requires formal security review
IL6 – Classified Systems	Continuous monitoring and active threat detection Apply the strongest possible encryption for all data Enforce restricted physical and logical access Follow NSA/DOW-defined cross-domain control protocols External connections must use approved cross-domain solutions and are rarely permitted

Security guidelines for FedRAMP Certification Classes (Class B – Class D)

The following table outlines the specific security and boundary requirements for all FedRAMP certification classes.

Certification Class	Security & Boundary Requirements
FedRAMP Low / Class B	Enforce basic access controls, TLS 1.2+ encryption in transit, and activity logging. External connections must be limited to essential, pre-approved public-facing services.
FedRAMP Class C (Moderate)	Restrict data flows to FedRAMP Moderate+ endpoints unless an Interconnection Security Agreement (ISA/MOU) is executed (NIST CA-3). Encrypt using active FIPS 140-2 or FIPS 140-3 validated cryptographic modules. Outbound integrations with non-FedRAMP operational tools are permitted only if documented and restricted to non-sensitive telemetry (zero CUI/PII).
FedRAMP Class D (High)	Enforce strict least privilege, zero-trust boundary isolation, and explicit deny-by-default egress rules (NIST SC-7). Encrypt all external data flows using FIPS 140 validated mTLS (TLS 1.3) with mutual authentication. Immutable audit logs must capture all connection events, data volumes, and session durations directly to the SIEM (NIST AU-2, AU-10).

EDC and Sponsoring Agency Approval

Second Front customers may use a sponsoring authorizing agency to support capabilities that extend beyond the Game Warden authorization boundary. These EDCs can integrate external services and data sources, provided the connections receive the required approvals and meet applicable security requirements.

The requirements for external connections differ between FedRAMP and DOW deployments. Each area below lists the requirement for both.

FedRAMP: The sponsoring agency's AO must accept the risk associated with an expanded authorization boundary or EDC. The AO must approve the connection through a Security Impact Analysis (SIA) memorandum or other required authorization process.
DOW: The AO or Authorizing Official Designated Representative (AODR) retains authority over external connections entering or leaving the designated Impact Level boundary.

Commercial connection rules

Commercial data connections entering a DOW-IL environment must follow a strict ingress-only policy. This requirement also applies to IL2 environments. Do not allow outbound or bidirectional communication unless the ATC or EDC request process explicitly approves it.

Follow these security requirements and manage connection risks proactively to maintain secure data flows, protect critical systems, and support mission continuity. Maintain a documented incident response plan so your team can respond to potential security events.

ATC or EDC checklist

If your application includes any EDCs, you must submit an EDC request package to Second Front for review and approval. Use the checklist below to validate your setup before assembling the required artifacts for your submission.

Applies to all ATCs or EDCs.

Data protection: Is data encrypted in transit using TLS 1.2+ or mTLS and at rest using active FIPS 140-2 or FIPS 140-3 validated cryptographic modules?
Connection documentation: Have you submitted updated Network Diagrams, DFDs, and ABDs that show the exact ingress and egress routes, protocols, and ports?
SIEM log forwarding: Are connection lifecycle events, connection failures, and volume metrics streamed immutably to the Game Warden SIEM follow the NIST AU-02 and AU-06?

ATC memorandum

For DOW Impact Level 2, 4, and 5 applications, the ATC memorandum replaces the previous EDC form for new connections. Complete one ATC memorandum for each connection and include it in your request package.

!!! note "ATC scope" The ATC approval applies only to the Game Warden platform as a Service configuration under the DIU Information System Security Manager (ISSM) and Authorizing Official (AO). It does not authorize connections to or from any other government information system boundary.

Some existing connections retain their grandfathered status and may continue under the EDC form. Your Mission Success Manager (MSM) can confirm which process applies to your connection.

The ATC memorandum documents the proposed connection and serves as the ISSM's recommendation to the DIU AO. Include the following information:

System identification: Identify the owning organization, eMASS system ID, and Impact Level for the source and destination systems.
Connection details: Specify the source and destination IP addresses or URLs, traffic direction, data elements transmitted in each direction, explicit exclusions, port, and whether the connection is permanent or temporary.
Technical interface: Specify the file types or payload format, interface type, encryption, and authentication method.
Risk assessment: Identify the impacted controls and describe how you validated the connection risk and the sensitivity classification of the transmitted data.

→ Download ATC memorandum template

Contact your MSM if you need help completing the memorandum.

Required artifacts

Include these four artifacts with your EDC submission package to Second Front for review:

Complete inventory of all external IP addresses, ports, protocols, and communication directions, including ingress, egress, and bidirectional connections.
Detailed description of the data transmitted through each connection and its categorization, such as CUI, CTI, or non-sensitive operational telemetry.
Clear operational justification and business purpose for each connection.

Need help

For questions or to submit your request package, contact your Mission Success Manager.