Question: CM-5 Access Restrictions for Change (M) (H)

Answer:
The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

|CM-5|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (1) Control Enhancement (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The information system enforces access restrictions and supports auditing of the enforcement actions.

|CM-5 (1)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (3) Control Enhancement (M) (H)

Answer:
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

CM-5 (3) Additional FedRAMP Requirements and Guidance:

Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be used.

|CM-5 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-5(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (5) Control Enhancement (M) (H)

Answer:
The organization:

Limits privileges to change information system components and system-related information within a production or operational environment; and

Reviews and reevaluates privileges [FedRAMP Assignment: at least quarterly].

|CM-5 (5)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-5(5):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (5) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-6 Configuration Settings (L) (M) (H)

Answer:
The organization:

Establishes and documents configuration settings for information technology products employed within the information system using [FedRAMP Assignment: see CM-6(a) Additional FedRAMP Requirements and Guidance] that reflect the most restrictive mode consistent with operational requirements;

CM-6(a) Additional FedRAMP Requirements and Guidance:

Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) (http://scap.nist.gov/) validated or SCAP compatible (if validated checklists are not available).

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline.

Implements the configuration settings;

Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

|CM-6|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-6(a)-1:
|Parameter CM-6(a)-2:
|Parameter CM-6(c)-1:
|Parameter CM-6(c)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CM-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components].

|CM-6|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-6(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-6 What is the solution and how is it implemented?|
|---|
|Part a|

#


Question: CM-7 Least Functionality (L) (M) (H)

Answer:
The organization:

Configures the information system to provide only essential capabilities; and

Prohibits or restricts the use of the following functions, ports, protocols, and/or services [FedRAMP Assignment: United States Government Configuration Baseline (USGCB)]

CM-7 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline
Partially derived from AC-17 (8).

|CM-7|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-7 (1) Control Enhancement (M) (H)

Answer:
The organization:

Reviews the information system [FedRAMP Assignment: at least Monthly] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

Disables [Assignment: organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure].

|CM-7 (1) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(1)(a):
|Parameter CM-7(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-7 (2) Control Enhancement (M) (H)

Answer:
The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].

CM-7 (2) Additional FedRAMP Requirements and Guidance:

Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing).  This control is not to be based off of strictly written policy on what is allowed or not allowed to run.

|CM-7 (2) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-7 (5) Control Enhancement (M)

Answer:
The organization:

Identifies [Assignment: organization-defined software programs authorized to execute on the information system];

Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and

Reviews and updates the list of authorized software programs [FedRAMP Assignment: at least annually or when there is a change].

|CM-7 (5) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(5)(a):
|Parameter CM-7(5)(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (5) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-8 Information System Component Inventory (L) (M) (H)

Answer:
The organization:

Develops and documents an inventory of information system components that:

Accurately reflects the current information system;

Includes all components within the authorization boundary of the information system;

Is at the level of granularity deemed necessary for tracking and reporting; and

Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and

Reviews and updates the information system component inventory [FedRAMP Assignment: at least monthly].

CM-8 Additional FedRAMP Requirements and Guidance:

Requirement: Must be provided at least monthly or when there is a change.

|CM-8 |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-8(a)(4):
|Parameter CM-8(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-8 (1) Control Enhancement (M) (H)

Answer:
The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

Instruction: A description of the inventory information is documented in Section 10.  It is not necessary to re-document it here.

Delete this and all other instructions from your final version of this document.

|CM-8 (1)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-8 (3) Control Enhancement (M) (H)

Answer:
The organization:

Employs automated mechanisms [FedRAMP Assignment: Continuously, using automated mechanisms with a maximum five-minute delay in detection] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and

Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies [Assignment: organization-defined personnel or roles]].

|CM-8 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (3) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-8 (5) Control Enhancement (M) (H)

Answer:
The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories.

|CM-8 (5)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-9 Configuration Management Plan (M) (H)

Answer:
The organization develops, documents, and implements a configuration management plan for the information system that:

Addresses roles, responsibilities, and configuration management processes and procedures;

Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

Defines the configuration items for the information system and places the configuration items under configuration management; and

Protects the configuration management plan for unauthorized disclosure and modification.

|CM-9|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CM-10 Software Usage Restrictions (L) (M) (H)

Answer:
The organization:

Uses software and associated documentation in accordance with contract agreements and copyright laws;

Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

|CM-10|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-10 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-10 (1) Control Enhancement (M) (H)

Answer:
The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions].

CM-10|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-10(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-10 What is the solution and how is it implemented?|
|---|
||

#


Question: CM-11 User-Installed Software (M) (H)

Answer:
The organization:

Establishes [Assignment: organization-defined policies] governing the installation of software by users;

Enforces software installation policies through [Assignment: organization-defined methods]; and

Monitors policy compliance [FedRAMP Assignment: Continuously (via CM-7 (5))].

CM-11|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-11(a):
|Parameter CM-11(b):
|Parameter CM-11(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-11 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
---
title: Contingency Planning (CP)
---


Question: Contingency Planning (CP)


Question: CP-1 Contingency Planning Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls; and

Reviews and updates the current:

Contingency planning policy [FedRAMP Assignment: at least every three (3) years].; and

Contingency planning procedures [FedRAMP Assignment: at least annually].

|CP-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-1(a):
|Parameter CP-1(b)(1):
|Parameter CP-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|CP-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-2 Contingency Plan (L) (M) (H)

Answer:
The organization:

Develops a contingency plan for the information system that:

Identifies essential missions and business functions and associated contingency requirements;

Provides recovery objectives, restoration priorities, and metrics;

Addresses contingency roles, responsibilities, assigned individuals with contact information;

Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];

Coordinates contingency planning activities with incident handling activities;

Reviews the contingency plan for the information system [FedRAMP Assignment: at least annually];

Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and

Protects the contingency plan from unauthorized disclosure and modification.

CP-2 Additional FedRAMP Requirements and Guidance:

Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.

|CP-2|Control Summary Information|
|---|---|
|Responsible Role
|Parameter CP-2(a)(6):
|Parameter CP-2(b):
|Parameter CP-2(d):
|Parameter CP-2(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: CP-2 (1) Control Enhancement (M) (H)

Answer:
The organization coordinates contingency plan development with organizational elements responsible for related plans.

|CP-2 (1)|Control Summary Information|
|---|---|
|Responsible Role
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (2) Control Enhancement (M) (H)

Answer:
The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

|CP-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (3) Control Enhancement (M) (H)

Answer:
The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.

|CP-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (8) Control Enhancement (M) (H)

Answer:
The organization identifies critical information system assets supporting essential missions and business functions.

|CP-2 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-2 (8) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-3 Contingency Training (L) (M) (H)

Answer:
The organization provides contingency training to information system users consistent with assigned roles and responsibilities:

Within [FedRAMP Assignment: ten (10) days] of assuming a contingency role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|CP-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-3(a):
|Parameter CP-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-3 What is the solution and how is it implemented?|
|---|
||

#


Question: CP-4 Contingency Plan Testing (M)

Answer:
The organization:

Tests the contingency plan for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: functional exercises] to determine the effectiveness of the plan and the organizational readiness to execute the plan;

CP-4(a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended) and provides plans to FedRAMP prior to initiating testing.  Test plans are approved and accepted by the JAB/AO prior to initiating testing.

Reviews the contingency plan test results; and

Initiates corrective actions, if needed.

|CP-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-4 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CP-4 (1) Control Enhancement (M) (H)

Answer:
The organization coordinates contingency plan testing and/or exercises with organizational elements responsible for related plans.

|CP-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-6 Alternate Storage Site (M) (H)

Answer:
The organization:

Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.

|CP-6 |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-6 (1) Control Enhancement (M) (H)

Answer:
The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.

|CP-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-6 (3) Control Enhancement (M) (H)

Answer:
The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

CP-6 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-7 Alternate Processing Site (M) (H)

Answer:
The organization:

Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [FedRAMP Assignment: see additional FedRAMP requirements and guidance] when the primary processing capabilities are unavailable;

CP-7a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.

Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

Ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.

CP-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-7(a)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CP-7 (1) Control Enhancement (M) (H)

Answer:
The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.

CP-7 (1) Additional FedRAMP Requirements and Guidance

Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern.  For one particular type of threat (i.e., hostile cyber-attack), the degree of separation between sites will be less relevant.

CP-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-7 (2) Control Enhancement (M) (H)

Answer:
The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

CP-7 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-7 (3) Control Enhancement (M) (H)

Answer:
The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives).

CP-7 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-8 Telecommunications Services (M) (H)

Answer:
The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [FedRAMP Assignment: See CP-8 additional FedRAMP requirements and guidance] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

CP-8 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.

CP-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-8-1:
|Parameter CP-8-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 What is the solution and how is it implemented?|
|---|
||

1. CP-8 (1) Control Enhancement (M) (H)
The organization:

Develops primary and alternate telecommunications service agreements that contain priority- of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and

Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.

CP-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-8 (2) Control Enhancement (M) (H)

Answer:
The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

CP-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-9 Information System Backup (L) (M) (H)

Answer:
The organization:

CP-9 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.

Conducts backups of user-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full]

CP-9 (a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online).

Conducts backups of system-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full];

CP-9 (b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online).

Conducts backups of information system documentation including security-related documentation [FedRAMP Assignment: daily incremental; weekly full ]; and

CP-9 (c) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online).

Protects the confidentiality, integrity, and availability of backup information at storage locations.

CP-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9(a):
|Parameter CP-9(b):
|Parameter CP-9(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CP-9 (1) Control Enhancement (M)

Answer:
The organization tests backup information [FedRAMP Assignment: at least annually] to verify media reliability and information integrity.

CP-9 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-9 (3) Control Enhancement (M) (H)

Answer:
The organization stores backup copies of [Assignment: organization-defined critical information system software and other security-related information] in a separate facility or in a fire-rated container that is not collocated with the operational system.

CP-9 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-10 Information System Recovery and Reconstitution (L) (M) (H)

Answer:
The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

CP-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-10 What is the solution and how is it implemented?|
|---|
||

#


Question: CP-10 (2) Control Enhancement (M) (H)

Answer:
The information system implements transaction recovery for systems that are transaction-based.

CP-10 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-10 (2) What is the solution and how is it implemented?|
|---|
||
---
title: Identification and Authentication (IA)
---


Question: Identification and Authentication (IA)


Question: IA-1 Identification and Authentication Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls; and

Reviews and updates the current:

Identification and authentication policy [FedRAMP Assignment: at least every three (3) years]; and

Identification and authentication procedures [FedRAMP Assignment: at least annually].

|IA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-1(a):
|Parameter IA-1(a):
|Parameter IA-1(b)(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|IA-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: IA-2 User Identification and Authentication (L) (M) (H)

Answer:
The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

|IA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (1) Control Enhancement (L) (M) (H)

Answer:
The information system implements multifactor authentication for network access to privileged accounts.

|IA-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (1) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (2) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for network access to non-privileged accounts.

|IA-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (2) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (3) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for local access to privileged accounts.

|IA-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (3) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (5) Control Enhancement (M) (H)

Answer:
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

|IA-2 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (5) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (8) Control Enhancement (M) (H)

Answer:
The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

#


Question: IA-2 (5) Control Enhancement (M) (H)

Answer:
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

|IA-2 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (8) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (11) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [FedRAMP Assignment: FIPS 140-2, NIAP* Certification, or NSA approval].
*National Information Assurance Partnership (NIAP)

Additional FedRAMP Requirements and Guidance:

Guidance: PIV = separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials.  FIPS 140-2 means validated by the Cryptographic Module Validation Program (CMVP).

|IA-2 (11)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-2(11):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (11) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (12) Control Enhancement (L) (M) (H)

Answer:
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials.
IA-2 (12) Additional FedRAMP Requirements and Guidance:

Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.

|IA-2 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (12) What is the solution and how is it implemented?|
|---
||

#


Question: IA-3 Device Identification and Authentication (M) (H)

Answer:
The information system uniquely identifies and authenticates [Assignment: organization-defined specific and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.

|IA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-3-1:
|Parameter IA-3-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-3 What is the solution and how is it implemented?|
|---
||

#


Question: IA-4 Identifier Management (L) (M)

Answer:
The organization manages information system identifiers for users and devices by:

Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier;

Selecting an identifier that identifies an individual, group, role, or device;

Assigning the identifier to the intended individual, group, role, or device;

Preventing reuse of identifiers for [FedRAMP Assignment: at least two (2) years]; and

Disabling the identifier after [FedRAMP Assignment: ninety days for user identifiers (see additional requirements and guidance)]

IA-4e Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period of inactivity for device identifiers.
Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.

|IA-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-4(a):
|Parameter IA-4(d):
|Parameter IA-4(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-4 What is the solution and how is it implemented?|
|---
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: IA-4 (4) Control Enhancement (M) (H)

Answer:
The organization manages individual identifiers by uniquely identifying each individual as [FedRAMP Assignment: contractors; foreign nationals].

|IA-4 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-4 (4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-4 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 Authenticator Management (L) (M)

Answer:
The organization manages information system authenticators by:

Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

Establishing initial authenticator content for authenticators defined by the organization;

Ensuring that authenticators have sufficient strength of mechanism for their intended use;

Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

Changing default content of authenticators prior to information system installation;

Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type].

Protecting authenticator content from unauthorized disclosure and modification;

Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

Changing authenticators for group/role accounts when membership to those accounts changes.

IA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Authenticators must be compliant with NIST SP 800-63-3 Digital Identity Guidelines IAL, AAL, FAL level 2. Link https://pages.nist.gov/800-63-3.

|IA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(g):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|
|Part h|
|Part i|
|Part j|

#


Question: IA-5 (1) Control Enhancement (L) (M)

Answer:
The information system, for password-based authentication:

Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type];

Enforces at least the following number of changed characters when new passwords are created: [FedRAMP Assignment: at least one (1)];

Stores and transmits only cryptographically-protected passwords;

Enforces password minimum and maximum lifetime restrictions of [Assignment: organization- defined numbers for lifetime minimum, lifetime maximum];

Prohibits password reuse for [FedRAMP Assignment: twenty-four (24)] generations; and

Allows the use of a temporary password for system logons with an immediate change to a permanent password.

IA-5 (1) a and d Additional FedRAMP Requirements and Guidance:

Guidance: If password policies are compliant with NIST SP 800-63B Memorized Secret (Section 5.1.1) Guidance, the control may be considered compliant.

|IA-5 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(1)(a):
|Parameter IA-5(1)(b):
|Parameter IA-5(1)(d):
|Parameter IA-5(1)(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|

#


Question: IA-5 (2) Control Enhancement (M) (H)

Answer:
The information system, for PKI-based authentication:

Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;

Enforces authorized access to the corresponding private key;

Maps the authenticated identity to the account of the individual or group; and

Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

|IA-5 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (2) What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|

#


Question: IA-5 (3) Control Enhancement (M) (H)

Answer:
The organization requires that the registration process to receive [FedRAMP Assignment: All hardware/biometric (multifactor authenticators] be conducted [FedRAMP Selection: in person] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].

|IA-5 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(3)-1:
|Parameter IA-5(3)-2:
|Parameter IA-5(3)-3:
|Parameter IA-5(3)-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (4) Control Enhancement (M)

Answer:
The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].
IA-5 (4) Additional FedRAMP Requirements and Guidance:

Guidance: If automated mechanisms which enforce password authenticator strength at creation are not used, automated mechanisms must be used to audit strength of created password authenticators.

|IA-5 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (6) Control Enhancement (M) (H)

Answer:
The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.

|IA-5 (6)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (6) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (7) Control Enhancement (M) (H)

Answer:
The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.

|IA-5 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (11) Control Enhancement (L) (M) (H)

Answer:
The information system, for hardware token-based authentication, employs mechanisms that satisfy [Assignment: organization-defined token quality requirements].

|IA-5 (11)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(11):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (11) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-6 Authenticator Feedback (L) (M) (H)

Answer:
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

|IA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-6 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-7 Cryptographic Module Authentication (L) (M) (H)

Answer:
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

|IA-7|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-7 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 Identification and Authentication (Non-Organizational Users) (L) (M) (H)

Answer:
The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).

|IA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (1) Control Enhancement (L) (M) (H)

Answer:
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.

|IA-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (2) Control Enhancement (L) (M) (H)

Answer:
The information system accepts only FICAM-approved third-party credentials.

|IA-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (3) Control Enhancement (L) (M) (H)

Answer:
The organization employs only FICAM-approved information system components in [Assignment: organization-defined information systems] to accept third-party credentials.

|IA-8 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-8(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (4) Control Enhancement (L) (M) (H)

Answer:
The information system conforms to FICAM-issued profiles.

|IA-8 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (4) What is the solution and how is it implemented?|
|---|
||
---
title: Incident Response (IR)
---


Question: Incident Response (IR)


Question: IR-1 Incident Response Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the incident response policy and associated incident response controls; and

Reviews and updates the current:

Incident response policy [FedRAMP Assignment: at least every three (3) years]; and

Incident response procedures [FedRAMP Assignment: at least annually].

|IR-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-1(a):
|Parameter IR-1(b)(1):
|Parameter IR-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|IR-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: IR-2 Incident Response Training (L) (M)

Answer:
The organization provides incident response training to information system users consistent with assigned roles and responsibilities in accordance with NIST SP 800-53 Rev 4:

Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|IR-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-2(a):
|Parameter IR-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: IR-3 Incident Response Testing (M)

Answer:
The organization tests the incident response capability for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance] to determine the incident response effectiveness and documents the results.

IR-3 Additional FedRAMP Requirements and Guidance:

Requirements: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). For JAB authorization, the service provider provides test plans to the JAB/AO annually. Test plans are approved and accepted by the JAB/AO prior to the test commencing.

|IR-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-3-1:
|Parameter IR-3-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-3 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-3 (2) Control Enhancement (M) (H)

Answer:
The organization coordinates incident response testing with organizational elements responsible for related plans.

|IR-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-4 Incident Handling (L) (M) (H)

Answer:
The organization:

Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

Coordinates incident handling activities with contingency planning activities; and

Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

IR-4 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.

|IR-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: IR-4 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the incident handling process.

|IR-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-5 Incident Monitoring (L) (M) (H)

Answer:
The organization tracks and documents information system security incidents.

#


Question: IR-4 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the incident handling process.

|IR-5|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-5 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-6 Incident Reporting (L) (M) (H)

Answer:
The organization:

Requires personnel to report suspected security incidents to the organizational incident response capability within [FedRAMP Assignment: US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended)]; and

Reports security incident information to [Assignment: organization-defined authorities].

IR-6 Additional FedRAMP Requirements and Guidance

Requirement: Report security incident information according to FedRAMP Incident Communications Procedure.

|IR-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-6(a):
|Parameter IR-6(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: IR-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to assist in the reporting of security incidents.

|IR-6 (1) |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 Incident Response Assistance (L) (M) (H)

Answer:
The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.

|IR-7 |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to increase the availability of incident response related information and support.

|IR-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 (2) Control Enhancement (M) (H)

Answer:
The organization:

Establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability; and

Identifies organizational incident response team members to the external providers.

|IR-7 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 (2) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: IR-8 Incident Response Plan (L) (M) (H)

Answer:
The organization:

Develops an incident response plan that:

Provides the organization with a roadmap for implementing its incident response capability;

Describes the structure and organization of the incident response capability;

Provides a high-level approach for how the incident response capability fits into the overall organization;

Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;

Defines reportable incidents;

Provides metrics for measuring the incident response capability within the organization;

Defines the resources and management support needed to effectively maintain and mature an incident response capability; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the incident response plan to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance].

IR-8(b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements.  The incident response list includes designated FedRAMP personnel.

Reviews the incident response plan [FedRAMP Assignment: at least annually];

Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing;

Communicates incident response plan changes to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance]; and

IR-8(e) Additional FedRAMP Requirements and Guidance:

Requirement:  The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements.  The incident response list includes designated FedRAMP personnel.

Protects the incident response plan from unauthorized disclosure and modification.

|IR-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-8(a)(8):
|Parameter IR-8(b):
|Parameter IR-8(c):
|Parameter IR-8(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: IR-9 Information Spillage Response (M) (H)

Answer:
The organization responds to information spills by:

Identifying the specific information involved in the information system contamination;

Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;

Isolating the contaminated information system or system component;

Eradicating the information from the contaminated information system or component;

Identifying other information systems or system components that may have been subsequently contaminated; and

Performing other [Assignment: organization-defined actions].

|IR-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(b):
|Parameter IR-9(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: IR-9 (1) Control Enhancement (M) (H)

Answer:
The organization assigns [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills.

|IR-9 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-9 (2) Control Enhancement (M)

Answer:
The organization provides information spillage response training [Assignment: organization- defined frequency].

|IR-9 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-9 (3) Control Enhancement (M) (H)

Answer:
The organization implements [Assignment: organization-defined procedures] to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

|IR-9 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (3) What is the solution and how is it implemented?|
|---|
||

#