Question: IR-9 (4) Control Enhancement (M) (H)

Answer:
The organization employs [Assignment: organization-defined security safeguards] for personnel exposed to information not within assigned access authorizations.

|IR-9 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (4) What is the solution and how is it implemented?|
|---|
||
---
title: Maintenance (MA)
---


Question: Maintenance (MA)

Context: Refer to the specific section and subsections for details.


Question: MA-1 System Maintenance Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls; and

Reviews and updates the current:

System maintenance policy [FedRAMP Assignment: at least every three (3) years]; and

System maintenance procedures [FedRAMP Assignment: at least annually].

|MA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-1(a):
|Parameter MA-1(b)(1):
|Parameter MA-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|MA-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MA-2 Controlled Maintenance (L) (M) (H)

Answer:
The organization:

Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.

|MA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-2(c):
|Parameter MA-2(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: MA-3 Maintenance Tools (M) (H)

Answer:
The organization approves, controls, and monitors information system maintenance tools.

|MA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (1) Control Enhancement (M) (H)

Answer:
The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.

|MA-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (2) Control Enhancement (M) (H)

Answer:
The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.

|MA-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-3 (3) Control Enhancement (M) (H)

Answer:
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:

Verifying that there is no organizational information contained on the equipment;

Sanitizing or destroying the equipment;

Retaining the equipment within the facility; or

Obtaining an exemption from [FedRAMP Assignment: the information owner explicitly authorizes removal of the equipment from the facility].

|MA-3 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-3(3)(d):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-3 (3) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: MA-4 Remote Maintenance (L) (M) (H)

Answer:
The organization:

Approves and monitors nonlocal maintenance and diagnostic activities;

Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;

Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;

Maintains records for nonlocal maintenance and diagnostic activities; and

Terminates session and network connections when nonlocal maintenance is completed.

|MA-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: MA-4 (2) Control Enhancement (M) (H)

Answer:
The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.

|MA-4 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-4 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MA-5 Maintenance Personnel (L) (M) (H)

Answer:
The organization:

Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel;

Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and

Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.

|MA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: MA-5 (1) Control Enhancement (L) (M)

Answer:
The organization:

Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:

Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;

Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and

Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.

MA-5 (1) Additional FedRAMP Requirements and Guidance:

Requirement: Only MA-5 (1) (a) (1) is required by FedRAMP

|MA-5 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-5 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MA-6 Timely Maintenance (M) (H)

Answer:
The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.

|MA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MA-6(1):
|Parameter MA-6(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MA-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
---
title: Media Protection (MP)
---


Question: Media Protection (MP)


Question: MP-1 Media Protection Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and

Reviews and updates the current:

Media protection policy [FedRAMP Assignment: at least every three (3) years]; and

Media protection procedures [FedRAMP Assignment: at least annually].

|MP-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-1(a):
|Parameter MP-1(b)(1):
|Parameter MP-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|MP-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: MP-2 Media Access (L) (M)

Answer:
The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].

|MP-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-2-1:
|Parameter MP-2-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-2 What is the solution and how is it implemented?|
|---|
||

#


Question: MP-3 Media Labeling (M) (H)

Answer:
The organization:

Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

Exempts [FedRAMP Assignment: no removable media types] from marking as long as the media remain within [Assignment: organization-defined controlled areas].

MP-3(b) Additional FedRAMP Requirements and Guidance:

Guidance: Second parameter in MP-3(b)-2 is not applicable.

|MP-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-3(b)-1:
|Parameter MP-3(b)-2:| Not applicable
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-3 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MP-4 Media Storage (M) (H)

Answer:
The organization:

Physically controls and securely stores [FedRAMP Assignment: [all types of digital and non-digital media with sensitive information]] within [FedRAMP Assignment: see additional FedRAMP requirements and guidance]; and

MP-4a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines controlled areas within facilities where the information and information system reside.

Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.

|MP-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-4(a)-1:
|Parameter MP-4(a)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MP-5 Media Transport (M) (H)

Answer:
The organization:

Protects and controls [FedRAMP Assignment: all media with sensitive information] during transport outside of controlled areas using [FedRAMP Assignment: for digital media, encryption using a FIPS 140-2 validated encryption module; for non-digital media, secured in locked container];

MP-5a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines security measures to protect digital and non-digital media in transport.  The security measures are approved and accepted by the JAB/AO.

Maintains accountability for information system media during transport outside of controlled areas;

Documents activities associated with the transport of information system media; and

Restricts the activities associated with transport of information system media to authorized personnel.

|MP-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-5(a)-1:
|Parameter MP-5(a)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: MP-5 (4) Control Enhancement (M) (H)

Answer:
The organization employs cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.

|MP-5 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-5 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: MP-6 Media Sanitization and Disposal (L) (M)

Answer:
The organization:

Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and

Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.

|MP-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-6(a)-1:
|Parameter MP-6(a)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: MP-6 (2) Control Enhancement (M)

Answer:
The organization tests sanitization equipment and procedures [FedRAMP Assignment: at least annually] to verify that the intended sanitization is being achieved.
MP-6 (2) Additional FedRAMP Requirements and Guidance:

Guidance: Equipment and procedures may be tested or evaluated for effectiveness.

|MP-6 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-6(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-6 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MP-7 Media Use (L) (M) (H)

Answer:
The organization [Selection: restricts; prohibits] the use of [Assignment: organization-defined types of information system media] on [Assignment: organization-defined information systems or system components] using [Assignment: organization-defined security safeguards].

|MP-6 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter MP-7-1:
|Parameter MP-7-2:
|Parameter MP-7-3:
|Parameter MP-7-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-6 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: MP-7 (1) Control Enhancement (M) (H)

Answer:
The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.

|MP-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|MP-7 (1) What is the solution and how is it implemented?|
|---|
||
---
title: Physical and Environmental Protection (PE)
---


Question: Physical and Environmental Protection (PE)


Question: PE-1 Physical and Environmental Protection Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls; and

Reviews and updates the current:

Physical and environmental protection policy [FedRAMP Assignment: at least every three (3) years]; and

Physical and environmental protection procedures [FedRAMP Assignment: at least annually].

|PE-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-1(a):
|Parameter PE-1(b)(1):
|Parameter PE-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|PE-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: PE-2 Physical Access Authorizations (L) (M)

Answer:
The organization:

Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides;

Issues authorization credentials for facility access;

Reviews the access list detailing authorized facility access by individuals [FedRAMP Assignment: at least annually]; and

Removes individuals from the facility access list when access is no longer required.

|PE-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: PE-3 Physical Access Control (L) (M) (H)

Answer:
The organization:

Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by:

Verifying individual access authorizations before granting access to the facility; and

Controlling ingress/egress to the facility using [FedRAMP Assignment: CSP defined physical access control systems/devices AND guards];

Maintains physical access audit logs for [Assignment: organization-defined entry/exit points];

Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

Escorts visitors and monitors visitor activity [FedRAMP Assignment: in all circumstances within restricted access area where the information system resides];

Secures keys, combinations, and other physical access devices;

Inventories [Assignment: organization-defined physical access devices] every [FedRAMP Assignment: at least annually]; and

Changes combinations and keys [FedRAMP Assignment: at least annually] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

|PE-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-3(a):
|Parameter PE-3(a)(2):
|Parameter PE-3(b):
|Parameter PE-3(c):
|Parameter PE-3(d):
|Parameter PE-3(f)-1:
|Parameter PE-3(f)-2:
|Parameter PE-3(g):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-3 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f
|Part g

#


Question: PE-4 Access Control for Transmission Medium (M) (H)

Answer:
The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].

|PE-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-4-1:
|Parameter PE-4-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-4 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-5 Access Control for Output Devices (M) (H)

Answer:
The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.

|PE-5|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-5 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-6 Monitoring Physical Access (L) (M) (H)

Answer:
The organization:

Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents;

Reviews physical access logs [FedRAMP Assignment: at least monthly] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and

Coordinates results of reviews and investigations with the organization’s incident response capability.

|PE-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-6(b)-1:
|Parameter PE-6(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: PE-6 (1) Control Enhancement (M) (H)

Answer:
The organization monitors physical intrusion alarms and surveillance equipment.

|PE-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: PE-8 Visitor Access Records (L) (M) (H)

Answer:
The organization:

Maintains visitor access records to the facility where the information system resides for [FedRAMP Assignment: for a minimum of one (1) year]; and

Reviews visitor access records [FedRAMP Assignment: at least monthly]

|PE-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-8(a):
|Parameter PE-8(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: PE-9 Power Equipment and Cabling (M) (H)

Answer:
The organization protects power equipment and power cabling for the information system from damage and destruction.

|PE-9|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-9 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-10 Emergency Shutoff (M) (H)

Answer:
The organization:

Provides the capability of shutting off power to the information system or individual system components in emergency situations;

Places emergency shutoff switches or devices in [Assignment: organization-defined location by information system or system component] to facilitate safe and easy access for personnel; and

Protects emergency power shutoff capability from unauthorized activation.

|PE-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-10(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-10 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: PE-11 Emergency Power (M) (H)

Answer:
The organization provides a short-term uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the information system; transition of the information system to long-term alternate power] in the event of a primary power source loss.

|PE-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-11:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-11 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-12 Emergency Lighting (L) (M) (H)

Answer:
The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.

|PE-12|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-12 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-13 Fire Protection (L) (M) (H)

Answer:
The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.

|PE-13|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-13 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-13 (2) Control Enhancement (M) (H)

Answer:
The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders].

|PE-13 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-13(2)-1:
|Parameter PE-13(2)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-13 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: PE-13 (3) Control Enhancement (M) (H)

Answer:
The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.

|PE-13 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-13 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: PE-14 Temperature and Humidity Controls (L) (M) (H)

Answer:
The organization:

Maintains temperature and humidity levels within the facility where the information system resides at [FedRAMP Assignment: consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled "Thermal Guidelines for Data Processing Environments]; and

PE-14 (a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider measures temperature at server inlets and humidity levels by dew point.

Monitors temperature and humidity levels [FedRAMP Assignment: continuously].

|PE-14|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-14(a):
|Parameter PE-14(b):
|Parameter PE-14(b) Additional:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-14 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: PE-14 (2) Control Enhancement (M) (H)

Answer:
The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.

|PE-14 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-14 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: PE-15 Water Damage Protection (L) (M) (H)

Answer:
The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.

|PE-15|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-15 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-16 Delivery and Removal (L) (M) (H)

Answer:
The organization authorizes, monitors, and controls [FedRAMP Assignment: all information system components] entering and exiting the facility and maintains records of those items.

|PE-16|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-16:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-16 What is the solution and how is it implemented?|
|---|
||

#


Question: PE-17 Alternate Work Site (M) (H)

Answer:
The organization:

Employs [Assignment: organization-defined security controls] at alternate work sites;

Assesses as feasible, the effectiveness of security controls at alternate work sites; and

Provides a means for employees to communicate with information security personnel in case of security incidents or problems.

|PE-17|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PE-17(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PE-17 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
---
title: Planning (PL)
---


Question: Planning (PL)


Question: PL-1 Security Planning Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and

Reviews and updates the current:

Security planning policy [FedRAMP Assignment: at least every three (3) years]; and

Security planning procedures [FedRAMP Assignment: at least annually].

|PL-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-1(a):
|Parameter PL-1(b)(1):
|Parameter PL-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|PL-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: PL-2 System Security Plan (L) (M) (H)

Answer:
The organization:

Develops a security plan for the information system that:

Is consistent with the organization’s enterprise architecture;

Explicitly defines the authorization boundary for the system;

Describes the operational context of the information system in terms of missions and business processes;

Provides the security categorization of the information system including supporting rationale;

Describes the operational environment for the information system and relationships with or connections to other information;

Provides an overview of the security requirements for the system;

Identifies any relevant overlays, if applicable;

Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and

Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

Distributes copies of the security plan and communicates subsequent changes to the plan to [Assignment: organization-defined personnel or roles];

Reviews the security plan for the information system [FedRAMP Assignment: at least annually];

Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

Protects the security plan from unauthorized disclosure and modification.

|PL-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-2(b):
|Parameter PL-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|

#


Question: PL-2 (3) Control Enhancement (M) (H)

Answer:
The organization plans and coordinates security-related activities affecting the information system with [Assignment: organization-defined individuals or groups] before conducting such activities in order to reduce the impact on other organizational entities.

|PL-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: PL-4 Rules of Behavior (L) (M)

Answer:
The organization:

Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

Reviews and updates the rules of behavior [FedRAMP Assignment: at least every three (3) years]; and

Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.

|PL-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PL-4(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: PL-4 (1) Control Enhancement (M) (H)

Answer:
The organization includes in the rules of behavior, explicit restrictions on the use of social media/networking sites and posting organizational information on public websites.

|PL-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: PL-8 Information Security Architecture (M) (H)

Answer:
The organization:

Develops an information security architecture for the information system that:

Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information;

Describes how the information security architecture is integrated into and supports the enterprise architecture; and

Describes any information security assumptions about, and dependencies on, external services;

Reviews and updates the information security architecture [FedRAMP Assignment: at least annually or when a significant change occurs] to reflect updates in the enterprise architecture; and

PL-8 (b) Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, on Page F-8.

Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.

|PL-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PL-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
---
title: POAM Template
---

# Plan of Action and Milestones

|CSP|System Name|Impact Level|POAM Date|
|--|--|--|--|
|Text|Text|Low/Moderate/High|Date|

|POAM ID|Controls|Weakness Name|Weakness Descriptio|Weakness Detector Source|Weakness Source Identifier|Asset Identifier|Point of Contac|Resources Required|Overall Remediation Plan|Original Detection Date|Scheduled Completion Date|Planned Milestones|Milestone Changes|Status Date|Vendor Dependence|Last Vendor Check-in Date|Vendor Dependent Product Name|Original Risk Rating|Adjusted Risk Rating|Risk Adjustment|False Positive|Operational Requirement|Deviation Rationale|Supporting Documents|Comments|Auto-Approve|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
V-1Example|AC-1|Open port on Example Firewall|Unprovisioned port left open on example firewall|Nessus|	12345|172.246.15.3 (80/TCP) http://vuln.gov/queries 172.246.16.17 (80/tcp)|John Doe -  Example CSP||	Implement a technical solution to the problem.|5/5/2014|8/3/2014|(1) 2014/05/23: Milestone Description
  (2) 2014-06-12: Milestone  Description|(2) Update 2014-06-18 : That milestone was delayed due to a Vendor Dependency
  (3) New 2014-06-13 : This is the details of this new milestone|8/5/2014|	Yes|8/5/2014|Example Firewall|High|Moderate|Yes|No|Pending|Risk Adjustment: The example firewall scanned is just preliminary
 Operational Requirement: The port is needed for service example.|Remediation Evidence : filename.doc
 Deviation Request : DR-123-Example-1.doc|none|no|
---
title: Personnel Security (PS)
---


Question: Personnel Security (PS)


Question: PS-1 Personnel Security Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the personnel security policy and associated personnel security controls; and

Reviews and updates the current:

Personnel security policy [FedRAMP Assignment: at least every three (3) years]; and

Personnel security procedures [FedRAMP Assignment: at least annually].

|PS-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-1(a):
|Parameter PS-1(b)(1):
|Parameter PS-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|PS-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: PS-2 Position Categorization (L) (M)

Answer:
The organization:

Assigns a risk designation to all positions;

Establishes screening criteria for individuals filling those positions; and

Reviews and revises position risk designations [FedRAMP Assignment: at least every three (3) years].

|PS-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-2 What is the solution and how is it implemented?|
|---
|Part a
|Part b
|Part c

#


Question: PS-3 Personnel Screening (L) (M) (H)

Answer:
The organization:

Screens individuals prior to authorizing access to the information system; and

Rescreens individuals according to [FedRAMP Assignment: For national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance.  For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year.  There is no reinvestigation for other moderate risk positions or any low risk positions].

|PS-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-3(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-3 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: PS-3 (3) Control Enhancement (M) (H)

Answer:
The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection:

Have valid access authorizations that are demonstrated by assigned official government duties; and

Satisfy [FedRAMP Assignment: personnel screening criteria – as required by specific information].

|PS-3 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-3 (3)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-3 (3) What is the solution and how is it implemented?|
|---
|Part a
|Part b

#


Question: PS-4 Personnel Termination (L) (M)

Answer:
The organization, upon termination of individual employment:

Disables information system access within [FedRAMP Assignment: same day];

Terminates/revokes any authenticators/credentials associated with the individual;

Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];

Retrieves all security-related organizational information system-related property;

Retains access to organizational information and information systems formerly controlled by terminated individual; and

Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].

|PS-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-4(a):
|Parameter PS-4(c):
|Parameter PS-4(f)-1:
|Parameter PS-4(f)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: PS-5 Personnel Transfer (L) (M)

Answer:
The organization:

Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization;

Initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action];

Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and

Notifies [Assignment: organization-defined personnel or roles] within [FedRAMP Assignment: within five days of the formal transfer action (DoD 24 hours)].

|PS-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-5(b)-1:
|Parameter PS-5(b)-2:
|Parameter PS-5(d)-1:
|Parameter PS-5(d)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: PS-6 Access Agreements (L) (M)

Answer:
The organization:

Develops and documents access agreements for organizational information systems;

Reviews and updates the access agreements [FedRAMP Assignment: at least annually]; and

Ensures that individuals requiring access to organizational information and information systems:

Sign appropriate access agreements prior to being granted access; and

Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [FedRAMP Assignment: at least annually].

|PS-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-6(b):
|Parameter PS-6(c)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: PS-7 Third-Party Personnel Security (L) (M)

Answer:
The organization:

Establishes personnel security requirements including security roles and responsibilities for third-party providers;

Requires third-party providers to comply with personnel security policies and procedures established by the organization;

Documents personnel security requirements;

Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [FedRAMP Assignment: same day]; and

Monitors provider compliance.

|PS-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-7(d)-1:
|Parameter PS-7(d)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-7 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: PS-8 Personnel Sanctions (L) (M)

Answer:
The organization:

Employs a formal sanctions process for personnel failing to comply with established information security policies and procedures; and

Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.

|PS-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter PS-8(b)-1:
|Parameter PS-8(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|PS-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
---
title: Risk Assessment (RA)
---


Question: Risk Assessment (RA)


Question: RA-1 Risk Assessment Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls; and

Reviews and updates the current:

Risk assessment policy [FedRAMP Assignment: at least every three (3) years]; and

Risk assessment procedures [FedRAMP Assignment: at least annually].

|RA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-1(a):
|Parameter RA-1(b)(1):
|Parameter RA-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|RA-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: RA-2 Security Categorization (L) (M) (H)

Answer:
The organization:

Categorizes information and the information system in accordance with applicable Federal Laws, Executive Orders, directives, policies, regulations, standards, and guidance;

Documents the security categorization results (including supporting rationale) in the security plan for the information system; and

Ensures the security categorization decision is reviewed and approved by the AO or authorizing official designated representative.

|RA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: RA-3 Risk Assessment (L) (M)

Answer:
The organization:

Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits;

Documents risk assessment results in [Selection: security plan; risk assessment report; [FedRAMP Assignment: security assessment report]];

Reviews risk assessment results [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs];

Disseminates risk assessment results to [Assignment: organization-defined personnel or roles]; and

Updates the risk assessment [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

RA-3 Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F
RA-3 (d) Requirement: Include all Authorizing Officials; for JAB authorizations to include FedRAMP.

|RA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-3(b):
|Parameter RA-3(c):
|Parameter RA-3(d):
|Parameter RA-3(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-3 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: RA-5 Vulnerability Scanning (L) (M) (H)

Answer:
The organization:

Scans for vulnerabilities in the information system and hosted applications [FedRAMP Assignment: monthly operating system/infrastructure; monthly web applications and databases] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

RA-5 (a) Additional FedRAMP Requirements and Guidance:

Requirement: An accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.

Employs vulnerability scanning tools and techniques that promote interoperability among tools and automate parts of the vulnerability management process by using standards for:

Enumerating platforms, software flaws, and improper configurations;

Formatting and making transparent, checklists and test procedures; and

Measuring vulnerability impact;

Analyzes vulnerability scan reports and results from security control assessments

Remediates legitimate vulnerabilities; [FedRAMP Assignment: high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery], in accordance with an organizational assessment of risk; and

Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

RA-5 (e) Additional FedRAMP Requirements and Guidance:

Requirement: To include all Authorizing Officials; for JAB authorizations to include FedRAMP.

RA-5 Additional FedRAMP Requirements and Guidance
Guidance: See the FedRAMP Documents page under Key Cloud Service Provider (CSP) Documents Vulnerability Scanning Requirements

https://www.FedRAMP.gov/documents/

|RA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-5(a):
|Parameter RA-5(d):
|Parameter RA-5(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: RA-5 (1) Control Enhancement (M) (H)

Answer:
The organization employs vulnerability scanning tools that include the capability to readily update the list of information system vulnerabilities to be scanned.

|RA-5 (1)|Control Summary Information|
|---|---|
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-5 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: RA-5 (2) Control Enhancement (M) (H)

Answer:
The organization updates the information system vulnerabilities scanned [Selection (one or more): [FedRAMP Assignment: prior to a new scan]].

|RA-5 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-5(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-5 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: RA-5 (3) Control Enhancement (M) (H)

Answer:
The organization employs vulnerability scanning procedures that can demonstrate the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).

|RA-5 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-5(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-5 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: RA-5 (5) Control Enhancement (M) (H)

Answer:
The organization includes privileged access authorization to [FedRAMP Assignment: operating systems, databases, web applications] for selected [FedRAMP Assignment: all scans].

|RA-5 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter RA-5(5)-1:
|Parameter RA-5(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-5 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: RA-5 (6) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.

|RA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-6 What is the solution and how is it implemented?|
|---|
||

#


Question: RA-5 (8) Control Enhancement (L) (M) (H)

Answer:
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
RA-5 (8) Additional FedRAMP Requirements and Guidance:

Requirement: This enhancement is required for all high vulnerability scan findings.
Guidance: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.

|RA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|RA-8 What is the solution and how is it implemented?|
|---|
||
---
title: System and Services Acquisition (SA)
---


Question: System and Services Acquisition (SA)


Question: SA-1 System and Services Acquisition Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and

Reviews and updates the current:

System and services acquisition policy [FedRAMP Assignment: at least every three (3) years]; and

System and services acquisition procedures [FedRAMP Assignment: at least annually].

|SA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-1(a):
|Parameter SA-1(b)(1):
|Parameter SA-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AC-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SA-2 Allocation of Resources (L) (M) (H)

Answer:
The organization:

Determines information security requirements for the information system or information system service in mission/business process planning;

Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

Establishes a discrete line item for information security in organizational programming and budgeting documentation.

|SA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: SA-3 System Development Life Cycle (L) (M) (H)

Answer:
The organization:

Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations;

Defines and documents information security roles and responsibilities throughout the system development life cycle;

Identifies individuals having information security roles and responsibilities; and

Integrates the organizational information security risk management process into system development life cycle activities.

|SA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-3(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-3 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SA-4 Acquisitions Process (L) (M) (H)

Answer:
The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs:

Security functional requirements;

Security strength requirements;

Security assurance requirements;

Security-related documentation requirements;

Requirements for protecting security-related documentation;

Description of the information system development environment and environment in which the system is intended to operate; and

Acceptance criteria.

Additional FedRAMP Requirements and Guidance:

Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred.
See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.

|SA-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f
|Part g

#


Question: SA-4 (1) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.

|SA-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-4 (2) Control Enhancement (L) (M)

Answer:
The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [FedRAMP Selection (one or more): to include security-relevant external system interfaces, and high-level design]; [Assignment: organization-defined design/implementation information] at [Assignment: organization-defined level of detail].

|SA-4 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-4-1:
|Parameter SA-4-2:
|Parameter SA-4-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-4 (8) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [FedRAMP Assignment: at least the minimum requirement as defined in control CA-7].

SA-4 (8) Additional FedRAMP Requirements and Guidance:

Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.

|SA-4 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-4(8):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 (8) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-4 (9) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.

|SA-4 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 (9) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-4 (10) Control Enhancement (M) (H)

Answer:
The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.

|SA-4 (10)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-4 (10) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-5 Information System Documentation (L) (M)

Answer:
The organization:

Obtains administrator documentation for the information system, system component, or information system service that describes:

Secure configuration, installation, and operation of the system, component, or service;

Effective use and maintenance of security functions/mechanisms; and

Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;

Obtains user documentation for the information system, system component, or information system service that describes:

User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;

Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and

User responsibilities in maintaining the security of the system, component, or service;

Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and [Assignment: organization-defined actions] in response;

Protects documentation as required, in accordance with the risk management strategy; and

Distributes documentation to [Assignment: organization-defined personnel or roles)].

|SA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-5(c):
|Parameter SA-5(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: SA-8 Security Engineering Principles (M) (H)

Answer:
The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.

|SA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-8 What is the solution and how is it implemented?|
|---|
||

#


Question: SA-9 External Information System Services (L) (M) (H)

Answer:
The organization:

Requires that providers of external information system services comply with organizational information security requirements and employ [FedRAMP Assignment: FedRAMP Security Controls Baseline(s) if Federal information is processed or stored within the external system] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;

Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and

Employs [FedRAMP Assignment: Federal/FedRAMP Continuous Monitoring requirements must be met for external systems where Federal information is processed or stored] to monitor security control compliance by external service providers on an ongoing basis.

Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service Provider (CSP) Documents> Continuous Monitoring Strategy Guide
https://www.FedRAMP.gov/documents

Guidance: Independent Assessors should assess the risk associated with the use of external services. See the FedRAMP page under Key Cloud Service Provider (CSP) Documents>FedRAMP Authorization Boundary Guidance

|SA-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-9(a):
|Parameter SA-9(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-9 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#