Question: CA-5 Plan of Action and Milestones (L) (M) (H)

Answer:
The organization:

Develops a plan of action and milestones for the information system to document the organization’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and

Updates existing plan of action and milestones [FedRAMP Assignment: at least monthly] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.

CA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Plan of Action & Milestones (POA&M) must be provided at least monthly.
Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Plan of Action and Milestones (POA&M) Template Completion Guide
https://www.FedRAMP.gov/documents/

|CA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-5(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-5 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CA-6 Security Authorization (L) (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The organization:

Assigns a senior-level executive or manager as the authorizing official for the information system;

Ensures that the authorizing official authorizes the information system for processing before commencing operations; and

Updates the security authorization [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs].

CA-6c Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F (SP 800-37).  The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture.  The types of changes are approved and accepted by the JAB/AO.

|CA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-6(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CA-7 Continuous Monitoring (L) (M) (H)

Answer:
The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

Establishment of [Assignment: organization-defined metrics] to be monitored;

Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

Correlation and analysis of security-related information generated by assessments and monitoring;

Response actions to address results of the analysis of security-related information; and

Reporting the security status of organization and the information system to [FedRAMP Assignment: to meet Federal and FedRAMP requirements] [Assignment: organization-defined frequency].

CA-7 Additional FedRAMP Requirements and Guidance:

Requirement: Operating System Scans: at least monthly. Database and Web Application Scans: at least monthly. All scans performed by Independent Assessor: at least annually.

Guidance: CSPs must provide evidence of closure and remediation of a high vulnerability within the timeframe for standard POA&M updates.

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Continuous Monitoring Strategy Guide
https://www.fedramp.gov/documents/

|CA-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-7(a):
|Parameter CA-7(b)-1:
|Parameter CA-7(b)-2:
|Parameter CA-7(g)-1:
|Parameter CA-7(g)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

CA-7 Additional FedRAMP Requirements and Guidance:

Requirement 1: Operating System Scans: at least monthly

Requirement 2: Database and Web Application Scans: at least monthly

Requirement 3: All scans performed by Independent Assessor: at least annually

|CA-7 Req.|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 What is the solution and how is it implemented?|
|---|
|Req. 1|
|Req. 2|
|Req. 3|

#


Question: CA-7 (1) Control Enhancement (M) (H)

Answer:
The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to monitor the security controls in the information system on an ongoing basis.

|CA-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-7(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-8 Penetration Testing (M) (H)

Answer:
The organization conducts penetration testing [FedRAMP Assignment: at least annually] on [Assignment: organization-defined information systems or system components].

CA-8 Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Penetration Test Guidance
https://www.fedramp.gov/documents/

|CA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-8-1:
|Parameter CA-8-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-8 What is the solution and how is it implemented?|
|---|
||

#


Question: CA-8 (1) Control Enhancement (M) (H)

Answer:
The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.

|CA-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-9 Internal System Connections (L) (M) (H)

Answer:
The organization:

Authorizes internal connections of [Assignment: organization-defined information system components or classes of components] to the information system; and

Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.

|CA-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-9(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|


Question: System and Communications Protection (SC)


Question: SC-1 System and Communications Protection Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls; and

Reviews and updates the current:

System and communications protection policy [FedRAMP Assignment: at least every three (3) years]; and

System and communications protection procedures [FedRAMP Assignment: at least annually].

|SC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-1(a):
|Parameter SC-1(b)(1):
|Parameter SC-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|SC-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SC-2 Application Partitioning (M) (H)

Answer:
The information system separates user functionality (including user interface services) from information system management functionality.

|SC-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-2 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-4 Information in Shared Resources (M) (H)

Answer:
The information system prevents unauthorized and unintended information transfer via shared system resources.

|SC-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-4 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-5 Denial of Service Protection (L) (M) (H)

Answer:
The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or reference to source for such information] by employing [Assignment: organization-defined security safeguards].

|SC-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-5-1:
|Parameter SC-5-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-5 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-6 Resource Availability (M) (H)

Answer:
The information system protects the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more); priority; quota; [Assignment: organization-defined security safeguards]].

|SC-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-6-1:
|Parameter SC-6-2:
|Parameter SC-6-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-6 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 Boundary Protection (L) (M) (H)

Answer:
The information system:

Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; and

Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and

Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with organizational security architecture.

|SC-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: SC-7 (3) Control Enhancement (M) (H)

Answer:
The organization limits the number external network connections to the information system.

|SC-7 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (3) What is the solution and how is it implemented?|
|---|
|Part a

#


Question: SC-7 (4) Control Enhancement (M)

Answer:
The organization:

Implements a managed interface for each external telecommunication service;

Establishes a traffic flow policy for each managed interface;

Protects the confidentiality and integrity of the information being transmitted across each interface;

Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and

Reviews exceptions to the traffic flow policy [FedRAMP Assignment: at least at least annually] and removes exceptions that are no longer supported by an explicit mission/business need.

|SC-7 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(4)(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (4) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: SC-7 (5) Control Enhancement (M) (H)

Answer:
The information system at managed interfaces denies network traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).

|SC-7 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (5) What is the solution and how is it implemented?|
|---|
|Part a

#


Question: SC-7 (7) Control Enhancement (M) (H)

Answer:
The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.

|SC-7 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (8) Control Enhancement (M) (H)

Answer:
The information system routes [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.

|SC-7 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(8)-1:
|Parameter SC-7(8)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (8) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (12) Control Enhancement (M)

Answer:
The organization implements [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined information system components].

|SC-7 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(12)-1:
|Parameter SC-7(12)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (12) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (13) Control Enhancement (M)

Answer:
The organization isolates [FedRAMP Assignment: See SC-7 (13) additional FedRAMP Requirements and Guidance] from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

SC-7 (13) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.

|SC-7 (13)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(13):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (13) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (18) Control Enhancement (M) (H)

Answer:
The information system fails securely in the event of an operational failure of a boundary protection device.

|SC-7 (18)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (18) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-8 Transmission confidentiality and Integrity (M) (H)

Answer:
The information system protects the [FedRAMP Assignment: confidentiality AND integrity] of transmitted information.

|SC-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-8 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-8 (1) Control Enhancement (M) (H)

Answer:
The information system implements cryptographic mechanisms to [FedRAMP Assignment: prevent unauthorized disclosure of information AND detect changes to information] during transmission unless otherwise protected by [FedRAMP Assignment: a hardened or alarmed carrier Protective Distribution System (PDS)].

|SC-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-8 (1)-1:
|Parameter SC-8 (1)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-10 Network Disconnect (M)

Answer:
The information system terminates the network connection associated with a communications session at the end of the session or after [FedRAMP Assignment: no longer than thirty (30) minutes for RAS-based sessions and no longer than sixty (60) minutes for non-interactive user sessions] of inactivity.

|SC-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-10 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 Cryptographic Key Establishment & Management (L) (M) (H)

Answer:
The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

SC-12 Additional FedRAMP Requirements and Guidance:

Guidance: Federally approved and validated cryptography.

|SC-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 (2) Control Enhancement (M) (H)

Answer:
The organization produces, controls, and distributes symmetric cryptographic keys using [FedRAMP Selection: NIST FIPS-compliant] key management technology and processes.

|SC-12 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 (3) Control Enhancement (M) (H)

Answer:
The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3  certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and  hardware security tokens that protect the user’s private key].

|SC-12 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12 (3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-13 Use of Cryptography (L) (M) (H)

Answer:
The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

|SC-13|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-13:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-13 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-15 Collaborative Computing Devices (M) (H)

Answer:
The information system:

Prohibits remote activation of collaborative computing devices with the following exceptions:[FedRAMP Assignment: no exceptions]; and

Provides an explicit indication of use to users physically present at the devices.

SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.

|SC-15|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-15(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-15 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.

|SC-15 req.|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-15(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-15 What is the solution and how is it implemented?|
|---|
|Req. 1|

#


Question: SC-17 Public Key Infrastructure Certificates (M) (H)

Answer:
The organization issues public key certificates under an [Assignment: organization-defined certificate policy] or obtains public key certificates from an approved service provider.

|SC-17|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-17:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-17 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-18 Mobile Code (M) (H)

Answer:
The organization:

Defines acceptable and unacceptable mobile code and mobile code technologies;

Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and

Authorizes, monitors, and controls the use of mobile code within the information system.

|SC-18|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-18 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

##


Question: SC-19 Voice Over Internet Protocol (M) (H)

Answer:
The organization:

Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and

Authorizes, monitors, and controls the use of VoIP within the information system.

|SC-19|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-19 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SC-20 Secure Name / Address Resolution Service (Authoritative Source) (L) (M) (H)

Answer:
The information system:

Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

|SC-20|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-20 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver) (L) (M) (H)

Answer:
The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.

|SC-21|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-21|Control Summary Information|
|---|---|
|//date|

|SC-21 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-22 Architecture and Provisioning for Name / Address Resolution Service (L) (M) (H)

Answer:
The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.

|SC-22|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

SC-22 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-23 Session Authenticity (M) (H)

Answer:
The information system protects the authenticity of communications sessions.

|SC-23|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-23 What is the solution and how is it implemented|
|---|
||

#


Question: SC-28 Protection of Information at Rest (M) (H)

Answer:
The information system protects the [FedRAMP Selection: confidentiality AND integrity]] of [Assignment: organization-defined information at rest].
SC-28 Additional FedRAMP Requirements and Guidance:

Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest.

|SC-28|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-28-1:
|Parameter SC-28-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-28 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-28 (1) Control Enhancement (M)

Answer:
The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined information] on [Assignment: organization-defined information system components]

|SC-28 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-28(1)-1:
|Parameter SC-28(1)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-28 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-39 Process Isolation (L) (M) (H)

Answer:
The information system maintains a separate execution domain for each executing process.

|SC-39|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-39 What is the solution and how is it implemented?|
|---|
||


Question: Maintenance (MA)


Question: MA-1 System Maintenance Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls; and

Reviews and updates the current:

System maintenance policy [FedRAMP Assignment: at least every three (3) years]; and

System maintenance procedures [FedRAMP Assignment: at least annually].

|MA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-1(a):
|Parameter MA-1(b)(1):
|Parameter MA-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|MA-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MA-2 Controlled Maintenance (L) (M) (H)

Answer:
The organization:

Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

|MA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-2(c):
|Parameter MA-2(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: MA-3 Maintenance Tools (M) (H)

Answer:
The organization approves, controls, and monitors information system maintenance tools.

|MA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (1) Control Enhancement (M) (H)

Answer:
The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

|MA-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (2) Control Enhancement (M) (H)

Answer:
The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.

|MA-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (3) Control Enhancement (M) (H)

Answer:
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:

Verifying that there is no organizational information contained on the equipment;

Sanitizing or destroying the equipment;

Retaining the equipment within the facility; or

Obtaining an exemption from [FedRAMP Assignment: the information owner explicitly authorizes removal of the equipment from the facility].

|MA-3 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-3(3)(d):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (3) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: MA-4 Remote Maintenance (L) (M) (H)

Answer:
The organization:

Approves and monitors nonlocal maintenance and diagnostic activities;

Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;

Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;

Maintains records for nonlocal maintenance and diagnostic activities; and

Terminates session and network connections when nonlocal maintenance is completed.

|MA-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: MA-4 (2) Control Enhancement (M) (H)

Answer:
The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.

|MA-4 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-4 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-5 Maintenance Personnel (L) (M) (H)

Answer:
The organization:

Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel;

Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and

Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

|MA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: MA-5 (1) Control Enhancement (L) (M)

Answer:
The organization:

Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:

Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;

Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and

Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.

MA-5 (1) Additional FedRAMP Requirements and Guidance:

Requirement: Only MA-5 (1) (a) (1) is required by FedRAMP

|MA-5 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-5 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MA-6 Timely Maintenance (M) (H)

Answer:
The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.

|MA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-6(1):
|Parameter MA-6(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: Identification and Authentication (IA)


Question: IA-1 Identification and Authentication Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls; and

Reviews and updates the current:

Identification and authentication policy [FedRAMP Assignment: at least every three (3) years]; and

Identification and authentication procedures [FedRAMP Assignment: at least annually].

|IA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-1(a):
|Parameter IA-1(a):
|Parameter IA-1(b)(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|IA-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: IA-2 User Identification and Authentication (L) (M) (H)

Answer:
The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

|IA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (1) Control Enhancement (L) (M) (H)

Answer:
The information system implements multifactor authentication for network access to privileged accounts.

|IA-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (1) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (2) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for network access to non-privileged accounts.

|IA-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (2) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (3) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for local access to privileged accounts.

|IA-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (3) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (5) Control Enhancement (M) (H)

Answer:
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

|IA-2 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (5) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (8) Control Enhancement (M) (H)

Answer:
The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

#


Question: IA-2 (5) Control Enhancement (M) (H)

Answer:
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.

|IA-2 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (8) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (11) Control Enhancement (M) (H)

Answer:
The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [FedRAMP Assignment: FIPS 140-2, NIAP* Certification, or NSA approval].
*National Information Assurance Partnership (NIAP)

Additional FedRAMP Requirements and Guidance:

Guidance: PIV = separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials.  FIPS 140-2 means validated by the Cryptographic Module Validation Program (CMVP).

|IA-2 (11)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-2(11):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (11) What is the solution and how is it implemented?|
|---
||

#


Question: IA-2 (12) Control Enhancement (L) (M) (H)

Answer:
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials.
IA-2 (12) Additional FedRAMP Requirements and Guidance:

Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.

|IA-2 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-2 (12) What is the solution and how is it implemented?|
|---
||

#


Question: IA-3 Device Identification and Authentication (M) (H)

Answer:
The information system uniquely identifies and authenticates [Assignment: organization-defined specific and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.

|IA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-3-1:
|Parameter IA-3-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-3 What is the solution and how is it implemented?|
|---
||

#


Question: IA-4 Identifier Management (L) (M)

Answer:
The organization manages information system identifiers for users and devices by:

Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier;

Selecting an identifier that identifies an individual, group, role, or device;

Assigning the identifier to the intended individual, group, role, or device;

Preventing reuse of identifiers for [FedRAMP Assignment: at least two (2) years]; and

Disabling the identifier after [FedRAMP Assignment: ninety days for user identifiers (see additional requirements and guidance)]

IA-4e Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period of inactivity for device identifiers.
Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.

|IA-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-4(a):
|Parameter IA-4(d):
|Parameter IA-4(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-4 What is the solution and how is it implemented?|
|---
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: IA-4 (4) Control Enhancement (M) (H)

Answer:
The organization manages individual identifiers by uniquely identifying each individual as [FedRAMP Assignment: contractors; foreign nationals].

|IA-4 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-4 (4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-4 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 Authenticator Management (L) (M)

Answer:
The organization manages information system authenticators by:

Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

Establishing initial authenticator content for authenticators defined by the organization;

Ensuring that authenticators have sufficient strength of mechanism for their intended use;

Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

Changing default content of authenticators prior to information system installation;

Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type].

Protecting authenticator content from unauthorized disclosure and modification;

Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

Changing authenticators for group/role accounts when membership to those accounts changes.

IA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Authenticators must be compliant with NIST SP 800-63-3 Digital Identity Guidelines IAL, AAL, FAL level 2. Link https://pages.nist.gov/800-63-3.

|IA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(g):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|
|Part h|
|Part i|
|Part j|

#


Question: IA-5 (1) Control Enhancement (L) (M)

Answer:
The information system, for password-based authentication:

Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type];

Enforces at least the following number of changed characters when new passwords are created: [FedRAMP Assignment: at least one (1)];

Stores and transmits only cryptographically-protected passwords;

Enforces password minimum and maximum lifetime restrictions of [Assignment: organization- defined numbers for lifetime minimum, lifetime maximum];

Prohibits password reuse for [FedRAMP Assignment: twenty-four (24)] generations; and

Allows the use of a temporary password for system logons with an immediate change to a permanent password.

IA-5 (1) a and d Additional FedRAMP Requirements and Guidance:

Guidance: If password policies are compliant with NIST SP 800-63B Memorized Secret (Section 5.1.1) Guidance, the control may be considered compliant.

|IA-5 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(1)(a):
|Parameter IA-5(1)(b):
|Parameter IA-5(1)(d):
|Parameter IA-5(1)(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|

#


Question: IA-5 (2) Control Enhancement (M) (H)

Answer:
The information system, for PKI-based authentication:

Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;

Enforces authorized access to the corresponding private key;

Maps the authenticated identity to the account of the individual or group; and

Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.

|IA-5 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (2) What is the solution and how is it implemented?|
|---|
|Part a
|Part b|
|Part c|
|Part d|

#


Question: IA-5 (3) Control Enhancement (M) (H)

Answer:
The organization requires that the registration process to receive [FedRAMP Assignment: All hardware/biometric (multifactor authenticators] be conducted [FedRAMP Selection: in person] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].

|IA-5 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(3)-1:
|Parameter IA-5(3)-2:
|Parameter IA-5(3)-3:
|Parameter IA-5(3)-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (4) Control Enhancement (M)

Answer:
The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].
IA-5 (4) Additional FedRAMP Requirements and Guidance:

Guidance: If automated mechanisms which enforce password authenticator strength at creation are not used, automated mechanisms must be used to audit strength of created password authenticators.

|IA-5 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (6) Control Enhancement (M) (H)

Answer:
The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.

|IA-5 (6)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (6) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (7) Control Enhancement (M) (H)

Answer:
The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.

|IA-5 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-5 (11) Control Enhancement (L) (M) (H)

Answer:
The information system, for hardware token-based authentication, employs mechanisms that satisfy [Assignment: organization-defined token quality requirements].

|IA-5 (11)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-5(11):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-5 (11) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-6 Authenticator Feedback (L) (M) (H)

Answer:
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

|IA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-6 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-7 Cryptographic Module Authentication (L) (M) (H)

Answer:
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

|IA-7|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-7 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 Identification and Authentication (Non-Organizational Users) (L) (M) (H)

Answer:
The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).

|IA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (1) Control Enhancement (L) (M) (H)

Answer:
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.

|IA-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (2) Control Enhancement (L) (M) (H)

Answer:
The information system accepts only FICAM-approved third-party credentials.

|IA-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (3) Control Enhancement (L) (M) (H)

Answer:
The organization employs only FICAM-approved information system components in [Assignment: organization-defined information systems] to accept third-party credentials.

|IA-8 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IA-8(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: IA-8 (4) Control Enhancement (L) (M) (H)

Answer:
The information system conforms to FICAM-issued profiles.

|IA-8 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IA-8 (4) What is the solution and how is it implemented?|
|---|
||


Question: Access Control (AC)


Question: AC-1 Access Control Policy and Procedures Requirements (L) (M)

Answer:
The organization:

Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]:

An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the access control policy and associated access controls; and

Reviews and updates the current:

Access control policy [FedRAMP Assignment: at least every 3 years]; and

Access control procedures [FedRAMP Assignment: at least annually].

|AC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-1(a):
|Parameter AC-1(b)(1):
|Parameter AC-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AC-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b1|
|Part b2|

#


Question: AC-2 Account Management (L) (M)

Answer:
The organization:

Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

Assigns account managers for information system accounts;

Establishes conditions for group and role membership;

Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

Monitors the use of information system accounts;

Notifies account managers:

When accounts are no longer required;

When users are terminated or transferred; and

When individual information system usage or need-to-know changes;

Authorizes access to the information system based on:

A valid access authorization;

Intended system usage; and

Other attributes as required by the organization or associated missions/business functions;

Reviews accounts for compliance with account management requirements [FedRAMP Assignment: at least annually]; and

Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

|AC-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(a):
|Parameter AC-2(e):
|Parameter AC-2(f):
|Parameter AC-2(j):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f
|Part g
|Part h
|Part i
|Part j
|Part k

#


Question: AC-2 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the management of information system accounts.

|AC-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (2) Control Enhancement (M)

Answer:
The information system automatically [Selection: removes; disables] temporary and emergency accounts after [FedRAMP Assignment: no more than 30 days for temporary and emergency account types].

|AC-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(2)1:
|Parameter AC-2(2)2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (3) Control Enhancement (M)

Answer:
The information system automatically disables inactive accounts after [FedRAMP Assignment: ninety (90) days for user accounts].

AC-2 (3) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices).  The time periods are approved and accepted by the Joint Authorization Board (JAB)/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available.

|AC-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (4) Control Enhancement (M)

Answer:
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].

|AC-2 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (5) Control Enhancement (M)

Answer:
The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].

AC-2 (5) Additional FedRAMP Requirements and Guidance:

Guidance: Should use a shorter timeframe than AC-12

|AC-2 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(5):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (7) Control Enhancement (M)

Answer:
The organization:

Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;

Monitors privileged role assignments; and

Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.

|AC-2 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(7):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (7) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: AC-2 (9) Control Enhancement (M)

Answer:
The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts].

AC-2 (9) Additional FedRAMP Requirements and Guidance: Required if shared/group accounts are deployed.

|AC-2 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(9):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (9) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (10) Control Enhancement (M) (H)

Answer:
The information system terminates shared/group account credentials when members leave the group.

AC-2 (10) Additional FedRAMP Requirements and Guidance:

Required if shared/group accounts are deployed.

|AC-2 (10)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(10):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (10) What is the solution and how is it implemented?|
|---|
||

#