Question: CP-7 (2) Control Enhancement (M) (H)

Answer:
The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

CP-7 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-7 (3) Control Enhancement (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives).

CP-7 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-8 Telecommunications Services (M) (H)

Answer:
The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [FedRAMP Assignment: See CP-8 additional FedRAMP requirements and guidance] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

CP-8 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.

CP-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-8-1:
|Parameter CP-8-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 What is the solution and how is it implemented?|
|---|
||

1. CP-8 (1) Control Enhancement (M) (H)
The organization:

Develops primary and alternate telecommunications service agreements that contain priority- of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and

Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.

CP-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-8 (2) Control Enhancement (M) (H)

Answer:
The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.

CP-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-9 Information System Backup (L) (M) (H)

Answer:
The organization:

CP-9 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.

Conducts backups of user-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full]

CP-9 (a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online).

Conducts backups of system-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full];

CP-9 (b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online).

Conducts backups of information system documentation including security-related documentation [FedRAMP Assignment: daily incremental; weekly full ]; and

CP-9 (c) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online).

Protects the confidentiality, integrity, and availability of backup information at storage locations.

CP-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9(a):
|Parameter CP-9(b):
|Parameter CP-9(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CP-9 (1) Control Enhancement (M)

Answer:
The organization tests backup information [FedRAMP Assignment: at least annually] to verify media reliability and information integrity.

CP-9 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-9 (3) Control Enhancement (M) (H)

Answer:
The organization stores backup copies of [Assignment: organization-defined critical information system software and other security-related information] in a separate facility or in a fire-rated container that is not collocated with the operational system.

CP-9 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-9(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-9 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-10 Information System Recovery and Reconstitution (L) (M) (H)

Answer:
The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

CP-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-10 What is the solution and how is it implemented?|
|---|
||

#


Question: CP-10 (2) Control Enhancement (M) (H)

Answer:
The information system implements transaction recovery for systems that are transaction-based.

CP-10 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-10 (2) What is the solution and how is it implemented?|
|---|
||


Question: Audit and Accountability (AU)


Question: AU-1 Audit and Accountability Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and

Reviews and updates the current:

Audit and accountability policy [FedRAMP Assignment: at every 3 years]; and

Audit and accountability procedures [FedRAMP Assignment: at least annually].

|AU-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(b)(1):
|Parameter AU-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AU-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AU-2 Audit Events (L) (M) (H)

Answer:
The organization:

Determines that the information system is capable of auditing the following events: [FedRAMP Assignment: [Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.  For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes];

Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events

Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and

Determines that the following events are to be audited within the information system: [FedRAMP Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited continually for each identified event].

AU-2 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.

|AU-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(d):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: AU-2 (3) Control Enhancement (M) (H)

Answer:
The organization reviews and updates the audited events [FedRAMP Assignment: annually or whenever there is a change in the threat environment].

AU-2 (3) Additional FedRAMP Requirements and Guidance:
Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO.

|AU-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-3 Content of Audit Records (L) (M) (H)

Answer:
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

|AU-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-3 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-3 (1) Control Enhancement (M)

Answer:
The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].

AU-3 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines audit record types [FedRAMP Assignment: session, connection, transaction, or activity duration; for client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon].  The audit record types are approved and accepted by the JAB.

Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.

|AU-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-3(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-4 Audit Storage Capacity (L) (M) (H)

Answer:
The organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements].

|AU-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-4 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-5 Response to Audit Processing Failures (L) (M) (H)

Answer:
The information system:

Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure; and

Takes the following additional actions: [FedRAMP Assignment: organization-defined actions to be taken; (overwrite oldest record)].

|AU-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-5(a):
|Parameter AU-5(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-5 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-6 Audit Review, Analysis, and Reporting (L) (M) (H)

Answer:
The organization:

Reviews and analyzes information system audit records [FedRAMP Assignment: at least weekly] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and

Reports findings to [Assignment: organization-defined personnel or roles].

AU-6 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the Authorizing Official. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.

|AU-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-6(a)-1:
|Parameter AU-6(a)-2:
|Parameter AU-6(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

|AU-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-6 (3) Control Enhancement (M) (H)

Answer:
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

|AU-6 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-7 Audit Reduction and Report Generation (M) (H)

Answer:
The information system provides an audit reduction and report generation capability that:

Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

Does not alter the original content or time ordering of audit records.

|AU-7|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-7 (1) Control Enhancement (M) (H)

Answer:
The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].

|AU-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-7(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-7 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-8 Time Stamps (L) (M) (H)

Answer:
The information system:

Uses internal system clocks to generate time stamps for audit records; and

Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: one second granularity of time measurement].

|AU-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-8(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-8 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-8 (1) Control Enhancement (M) (H)

Answer:
The information system:

Compares the internal information system clocks  with [FedRAMP Assignment: authoritative time source: [http://tf.nist.gov/tf-cgi/servers.cgi] [at least hourly]]; and

Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].

AU-8 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.

Requirement:< The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.

Guidance: The service provider selects primary and secondary time servers used by the NIST Internet time service, or by a Stratum-1 time server. The secondary server is selected from a different geographic region than the primary server.

If using Windows Active Directory, all servers should synchronize time with the time source for the Windows Domain Controller. If using some other directory services (e.g., LDAP), all servers should synchronize time with the time source for the directory server. Synchronization of system clocks improves the accuracy of log analysis.

|AU-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-8(1)(a)-1:
|Parameter AU-8(1)(a)-2:
|Parameter AU-8(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-8 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-9 Protection of Audit Information (L) (M) (H)

Answer:
The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

|AU-9|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-9 (2) Control Enhancement (M) (H)

Answer:
The information system backs up audit records [FedRAMP Assignment: at least weekly] onto a physically different system or system component than the system or component being audited.

|AU-9 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-9(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-9 (4) Control Enhancement (M) (H)

Answer:
The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users].

|AU-9 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-9(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-11 Audit Record Retention (M)

Answer:
The organization retains audit records for [FedRAMP Assignment: at least ninety (90) days] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

AU-11 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements

|AU-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-11:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-11 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-12 Audit Generation (L) (M) (H)

Answer:
The information system:

Provides audit record generation capability for the auditable events defined in AU-2 a. at [FedRAMP Assignment: all information system components where audit capability is deployed/available];

Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

|AU-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-12(a):
|Parameter AU-12(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-12 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|


Question: Configuration Management (CM)


Question: CM-1 Configuration Management Policies and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and

Reviews and updates the current:

Configuration management policy [FedRAMP Assignment: at least every three (3) years]; and

Configuration management procedures [FedRAMP Assignment: at least annually].

|CM-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CM-1(a):
|Parameter CM-1(b)(1):
|Parameter CM-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|CM-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-2 Baseline Configuration (L) (M) (H)

Answer:
The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

|CM-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 What is the solution and how is it implemented?|
|---|
|Part a|

#


Question: CM-2 (1) Control Enhancement (M)

Answer:
The organization reviews and updates the baseline configuration of the information system:

[FedRAMP Assignment: at least annually];

When required due to [FedRAMP Assignment: to include when directed by the JAB]; and

As an integral part of information system component installations and upgrades.

|CM-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CM-2(1)(a):
|Parameter CM-2(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-2 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.

|CM-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-2 (3) Control Enhancement (M)

Answer:
The organization retains [Assignment: organization-defined previous versions of baseline configurations of the information system] to support rollback.

|CM-2 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-2 (7) Control Enhancement (M) (H)

Answer:
The organization:

Issues [Assignment: organization-defined information systems, system components, or devices] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and

Applies [Assignment: organization-defined security safeguards] to the devices when the individuals return.

|CM-2 (7)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-2(7)(a)-1:
|Parameter CM-2(7)(a)-2:
|Parameter CM-2(7)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (7) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-3 Configuration Change Control (M) (H)

Answer:
The organization:

(a) Determines the types of changes to the information system that are configuration-controlled;

Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

Documents configuration change decisions associated with the information system;

Implements approved configuration-controlled changes to the information system;

Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period];

CM-3 (e) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with record retention policies and procedures.

Audits and reviews activities associated with configuration-controlled changes to the information system; and

Coordinates and provides oversight for configuration change control activities through [FedRAMP Assignment: see additional FedRAMP requirements and guidance] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].

CM-3 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page).  The means of communication are approved and accepted by the JAB/AO.

|CM-3|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-3(e):
|Parameter CM-3(g)-1:
|Parameter CM-3(g)-2:
|Parameter CM-3(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-3 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: CM-4 Security Impact Analysis (L) (M) (H)

Answer:
The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

|CM-4|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-4 What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 Access Restrictions for Change (M) (H)

Answer:
The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

|CM-5|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (1) Control Enhancement (M) (H)

Answer:
The information system enforces access restrictions and supports auditing of the enforcement actions.

|CM-5 (1)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (3) Control Enhancement (M) (H)

Answer:
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

CM-5 (3) Additional FedRAMP Requirements and Guidance:

Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be used.

|CM-5 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-5(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-5 (5) Control Enhancement (M) (H)

Answer:
The organization:

Limits privileges to change information system components and system-related information within a production or operational environment; and

Reviews and reevaluates privileges [FedRAMP Assignment: at least quarterly].

|CM-5 (5)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-5(5):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-5 (5) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-6 Configuration Settings (L) (M) (H)

Answer:
The organization:

Establishes and documents configuration settings for information technology products employed within the information system using [FedRAMP Assignment: see CM-6(a) Additional FedRAMP Requirements and Guidance] that reflect the most restrictive mode consistent with operational requirements;

CM-6(a) Additional FedRAMP Requirements and Guidance:

Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) (http://scap.nist.gov/) validated or SCAP compatible (if validated checklists are not available).

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline.

Implements the configuration settings;

Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

|CM-6|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-6(a)-1:
|Parameter CM-6(a)-2:
|Parameter CM-6(c)-1:
|Parameter CM-6(c)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CM-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components].

|CM-6|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-6(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-6 What is the solution and how is it implemented?|
|---|
|Part a|

#


Question: CM-7 Least Functionality (L) (M) (H)

Answer:
The organization:

Configures the information system to provide only essential capabilities; and

Prohibits or restricts the use of the following functions, ports, protocols, and/or services [FedRAMP Assignment: United States Government Configuration Baseline (USGCB)]

CM-7 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline
Partially derived from AC-17 (8).

|CM-7|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-7 (1) Control Enhancement (M) (H)

Answer:
The organization:

Reviews the information system [FedRAMP Assignment: at least Monthly] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

Disables [Assignment: organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure].

|CM-7 (1) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(1)(a):
|Parameter CM-7(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-7 (2) Control Enhancement (M) (H)

Answer:
The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].

CM-7 (2) Additional FedRAMP Requirements and Guidance:

Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing).  This control is not to be based off of strictly written policy on what is allowed or not allowed to run.

|CM-7 (2) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-7 (5) Control Enhancement (M)

Answer:
The organization:

Identifies [Assignment: organization-defined software programs authorized to execute on the information system];

Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and

Reviews and updates the list of authorized software programs [FedRAMP Assignment: at least annually or when there is a change].

|CM-7 (5) |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-7(5)(a):
|Parameter CM-7(5)(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-7 (5) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-8 Information System Component Inventory (L) (M) (H)

Answer:
The organization:

Develops and documents an inventory of information system components that:

Accurately reflects the current information system;

Includes all components within the authorization boundary of the information system;

Is at the level of granularity deemed necessary for tracking and reporting; and

Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and

Reviews and updates the information system component inventory [FedRAMP Assignment: at least monthly].

CM-8 Additional FedRAMP Requirements and Guidance:

Requirement: Must be provided at least monthly or when there is a change.

|CM-8 |Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-8(a)(4):
|Parameter CM-8(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-8 (1) Control Enhancement (M) (H)

Answer:
The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

Instruction: A description of the inventory information is documented in Section 10.  It is not necessary to re-document it here.

Delete this and all other instructions from your final version of this document.

|CM-8 (1)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-8 (3) Control Enhancement (M) (H)

Answer:
The organization:

Employs automated mechanisms [FedRAMP Assignment: Continuously, using automated mechanisms with a maximum five-minute delay in detection] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and

Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies [Assignment: organization-defined personnel or roles]].

|CM-8 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (3) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-8 (5) Control Enhancement (M) (H)

Answer:
The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories.

|CM-8 (5)|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-8 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-9 Configuration Management Plan (M) (H)

Answer:
The organization develops, documents, and implements a configuration management plan for the information system that:

Addresses roles, responsibilities, and configuration management processes and procedures;

Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

Defines the configuration items for the information system and places the configuration items under configuration management; and

Protects the configuration management plan for unauthorized disclosure and modification.

|CM-9|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CM-10 Software Usage Restrictions (L) (M) (H)

Answer:
The organization:

Uses software and associated documentation in accordance with contract agreements and copyright laws;

Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

|CM-10|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-10 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-10 (1) Control Enhancement (M) (H)

Answer:
The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions].

CM-10|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-10(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-10 What is the solution and how is it implemented?|
|---|
||

#


Question: CM-11 User-Installed Software (M) (H)

Answer:
The organization:

Establishes [Assignment: organization-defined policies] governing the installation of software by users;

Enforces software installation policies through [Assignment: organization-defined methods]; and

Monitors policy compliance [FedRAMP Assignment: Continuously (via CM-7 (5))].

CM-11|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-11(a):
|Parameter CM-11(b):
|Parameter CM-11(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-11 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|


Question: Planning (PL)


Question: PL-1 Security Planning Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and

Reviews and updates the current:

Security planning policy [FedRAMP Assignment: at least every three (3) years]; and

Security planning procedures [FedRAMP Assignment: at least annually].

|PL-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-1(a):
|Parameter PL-1(b)(1):
|Parameter PL-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|PL-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: PL-2 System Security Plan (L) (M) (H)

Answer:
The organization:

Develops a security plan for the information system that:

Is consistent with the organization’s enterprise architecture;

Explicitly defines the authorization boundary for the system;

Describes the operational context of the information system in terms of missions and business processes;

Provides the security categorization of the information system including supporting rationale;

Describes the operational environment for the information system and relationships with or connections to other information;

Provides an overview of the security requirements for the system;

Identifies any relevant overlays, if applicable;

Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and

Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

Distributes copies of the security plan and communicates subsequent changes to the plan to [Assignment: organization-defined personnel or roles];

Reviews the security plan for the information system [FedRAMP Assignment: at least annually];

Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

Protects the security plan from unauthorized disclosure and modification.

|PL-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-2(b):
|Parameter PL-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|

#


Question: PL-2 (3) Control Enhancement (M) (H)

Answer:
The organization plans and coordinates security-related activities affecting the information system with [Assignment: organization-defined individuals or groups] before conducting such activities in order to reduce the impact on other organizational entities.

|PL-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: PL-4 Rules of Behavior (L) (M)

Answer:
The organization:

Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

Reviews and updates the rules of behavior [FedRAMP Assignment: at least every three (3) years]; and

Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.

|PL-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-4(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: PL-4 (1) Control Enhancement (M) (H)

Answer:
The organization includes in the rules of behavior, explicit restrictions on the use of social media/networking sites and posting organizational information on public websites.

|PL-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: PL-8 Information Security Architecture (M) (H)

Answer:
The organization:

Develops an information security architecture for the information system that:

Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information;

Describes how the information security architecture is integrated into and supports the enterprise architecture; and

Describes any information security assumptions about, and dependencies on, external services;

Reviews and updates the information security architecture [FedRAMP Assignment: at least annually or when a significant change occurs] to reflect updates in the enterprise architecture; and

PL-8 (b) Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, on Page F-8.

Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.

|PL-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c