System interfaces are the defined connection points through which two or more IT systems, applications, or infrastructure components exchange data, trigger processes, or share state. An interface specifies the contract between systems: what data is sent, in what format, over what protocol, and under what conditions. Interfaces are not the systems themselves — they are the boundaries and bridges between them. Modern interfaces take many forms: REST APIs (request-response over HTTP/S), event-driven message queues (asynchronous publish-subscribe), database links, file-based transfers (EDI, SFTP batch), and streaming data pipelines. Every interface has three core elements: a protocol (how data travels), a schema or contract (what the data looks like), and an error-handling strategy (what happens when something goes wrong). A system interface IS: a governed connection point with defined inputs, outputs, protocols, and error behaviors. A system interface IS NOT: the internal logic of either connected system, the network layer those systems run on, or an informal ad-hoc connection — though ungoverned connections exist in most environments and must be identified and managed.
Where it stops · what it isn't
- —Internal system architecture — what happens inside System A is not an interface concern; interfaces govern only the exchange between systems.
- —Network infrastructure (routers, firewalls, load balancers) is the transport layer that interfaces depend on, not the interface itself.
- —Data governance and data quality are related but distinct — interfaces carry data; data stewardship is an application-layer responsibility.
- —Application integration patterns (ESB, service mesh) describe architectural approaches that implement interfaces, not the interfaces themselves.
- —User interfaces (UIs) are human-system boundaries, not system-to-system interfaces as defined in this CISA context.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFInformation Systems Operations and Business Resilience
REQUIRESIT Components (cisa-d4-it-components)IT Security Controls (authentication, authorization, encryption)
ENABLESSystem Resilience and Business Continuity
RELATED TODatabase ManagementIT Change Management
CONSTRAINSJob Scheduling and Automation