Question: AC-2 (12) Control Enhancement (M)

Answer:
The organization:

Monitors information system accounts for [Assignment: organization-defined atypical use]; and

Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].

AC-2 (12) (a) and AC-2 (12) (b) Additional FedRAMP Requirements and Guidance: Required for privileged accounts.

|AC-2 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(12)(a):
|Parameter AC-2(12)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (12) What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-3 Access Enforcement (L) (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

|AC-3|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-3 What is the solution and how is it implemented?|
|---|
|Part a


Question: AC-4 Information Flow Enforcement (M) (H)

Answer:
The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

|AC-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-4
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-4 What is the solution and how is it implemented?|
|---|
||

#


Question: AC-4 (21) Control Enhancement (M) (H)

Answer:
The information system separates information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].

|AC-4 (21)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-4(21)-1
|Parameter AC-4(21)-2
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-4 What is the solution and how is it implemented?|
|---|
||


Question: AC-5 Separation of Duties (M) (H)

Answer:
The organization:

Separates [Assignment: organization-defined duties of individuals];

Documents separation of duties of individuals; and

Defines information system access authorizations to support separation of duties.

AC-5 Additional FedRAMP Requirements and Guidance:

Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP.  Directions for attaching the Separation of Duties Matrix document may be found in Section Error: Reference source not found Error: Reference source not found.

|AC-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-5(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c


Question: AC-6 Least Privilege (M) (H)

Answer:
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

|AC-6|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (1) Control Enhancement (M)

Answer:
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

|AC-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(1)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (2) Control Enhancement (M) (H)

Answer:
The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing non-security functions.

AC-6 (2) Additional FedRAMP Requirements and Guidance:

Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.

|AC-6 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(2)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC 6 (5) Control Enhancement (M) (H)

Answer:
The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

|AC-6 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(5)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (9) Control Enhancement (M) (H)

Answer:
The information system audits the execution of privileged functions.

|AC-6 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (9) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (10) Control Enhancement (M) (H)

Answer:
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

|AC-6 (10)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (10) What is the solution and how is it implemented?|
|---|
||


Question: AC-7 Unsuccessful Login Attempts (L) (M)

Answer:
The organization:

Enforces a limit of [FedRAMP Assignment: not more than three (3)] consecutive invalid logon attempts by a user during a [FedRAMP Assignment: fifteen (15) minutes]; and

Automatically [Selection: locks the account/node for a [FedRAMP Assignment: thirty (30) minutes]; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.

|AC-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-7(a)-1:
|Parameter AC-7(a)-2:
|Parameter AC-7(b)-1:
|Parameter AC-7(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-7 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-8 System Use Notification (L) (M) (H)

Answer:
The information system:

Displays to users [Assignment: organization-defined system use notification message or banner (FedRAMP Assignment: see additional Requirements and Guidance)] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

Users are accessing a U.S. Government information system;

Information system usage may be monitored, recorded, and subject to audit;

Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

Use of the information system indicates consent to monitoring and recording;

Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

For publicly accessible systems:

Displays system use information [Assignment: organization-defined conditions (FedRAMP Assignment: see additional Requirements and Guidance)], before granting further access;

Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

Includes a description of the authorized uses of the system.

AC-8 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control.  The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO.

Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check.  The System Use Notification verification and periodicity are approved and accepted by the JAB/AO.

Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.

Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider.  The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.

|AC-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-8(a)-1:
|Parameter AC-8(c)-1:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

Additional FedRAMP Requirements and Guidance

Requirement 1: The service provider shall determine elements of the cloud environment that require the System Use Notification control.  The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO.

Requirement 2: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check.  The System Use Notification verification and periodicity are approved and accepted by the JAB/AO.  If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.

Requirement 3: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider.  The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.

|AC-8 Req.|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-8 What is the solution and how is it implemented?|
|---|
|Req 1
|Req 2
|Req 3


Question: AC-10 Concurrent Session Control (M) (H)

Answer:
The information system limits the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [FedRAMP Assignment: three (3) sessions for privileged access and two (2) sessions for non-privileged access].

|AC-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-10-1:
|Parameter AC-10-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-10 What is the solution and how is it implemented?|
|---|
||


Question: AC-11 Session Lock (M) (H)

Answer:
The information system:

Prevents further access to the system by initiating a session lock after [FedRAMP Assignment: fifteen (15) minutes] of inactivity or upon receiving a request from a user; and

Retains the session lock until the user reestablishes access using established identification and authentication procedures.

|AC-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-11(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-11 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-11 (1) Control Enhancement (M) (H)

Answer:
The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

|AC-11 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-11(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-11 (1) What is the solution and how is it implemented?|
|---|
||


Question: AC-12 Session Termination (M) (H)

Answer:
The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].

|AC-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-12 What is the solution and how is it implemented?|
|---|
||


Question: AC-14 Permitted Actions without Identification or Authentication (L) (M) (H)

Answer:
The organization:

Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

|AC-14|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-14 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-17 Remote Access (L) (M) (H)

Answer:
The organization:

Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

Authorizes remote access to the information system prior to allowing such connections.

|AC-17|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-17 (1) Control Enhancement (M) (H)

Answer:
The information system monitors and controls remote access methods.

|AC-17 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (2) Control Enhancement (M) (H)

Answer:
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

|AC-17 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (3) Control Enhancement (M) (H)

Answer:
The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.

|AC-17 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (4) Control Enhancement (M) (H)

Answer:
The organization:

Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and

Documents the rationale for such access in the security plan for the information system.

|AC-17 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(4)(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (4) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-17 (9) Control Enhancement (M) (H)

Answer:
The organization provides the capability to expeditiously disconnect or disable remote access to the information system within [FedRAMP Assignment: fifteen (15) minutes].

|AC-17 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(9):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (9) What is the solution and how is it implemented?|
|---|
||


Question: AC-18 Wireless Access Restrictions (L) (M) (H)

Answer:
The organization:

 Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

Authorizes wireless access to the information system prior to allowing such connections.

|AC-18|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-18:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-18 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-18 (1) Control Enhancement (M) (H)

Answer:
The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

|AC-18 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-18 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-18 (1) What is the solution and how is it implemented?|
|---|
||


Question: AC-19 Access Control for Portable and Mobile Systems (L) (M) (H)

Answer:
The organization:

Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

Authorizes the connection of mobile devices to organizational information systems.

|AC-19|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-19 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-19 (5) Control Enhancement (M) (H)

Answer:
The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

|AC-19 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-19(5)-1:
|Parameter AC-19(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-19 (5) What is the solution and how is it implemented?|
|---|
||


Question: AC-20 Use of External Information Systems (L) (M) (H)

Answer:
The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:

Access the information system from external information systems; and

Process, store, or transmit organization-controlled information using external information systems.

|AC-20|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-20 (1) Control Enhancement (M) (H)

Answer:
The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or

Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

|AC-20 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-20 (2) Control Enhancement (M) (H)

Answer:
The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.

|AC-20 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-20(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 (2) What is the solution and how is it implemented?|
|---|
||


Question: AC-21 Information Sharing (M) (H)

Answer:
The organization:

Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and

Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.

|AC-21|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-21(a):
|Parameter AC-21(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-21 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-22 Publicly Accessible Content (L) (M) (H)

Answer:
The organization:

Designates individuals authorized to post information onto a publicly accessible information system;

Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and

Reviews the content on the publicly accessible information system for nonpublic information [FedRAMP Assignment: at least quarterly] and removes such information, if discovered.

|AC-22|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-22
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-22 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
---
title: Awareness and Training (AT)
---


Question: Awareness and Training (AT)


Question: AT-1 Security Awareness and Training Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and

Reviews and updates the current:

Security awareness and training policy [FedRAMP Assignment: at least every 3 years]; and

Security awareness and training procedures [FedRAMP Assignment: at least annually].

|AC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-1(a):
|Parameter AT-1(b)(1):
|Parameter AT-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AT-1 What is the solution and how is it implemented?|
|---
|Part a:
|Part b1:
|Part b2:

#


Question: AT-2 Security Awareness (L) (M) (H)

Answer:
The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

As part of initial training for new users;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|AT-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-2 What is the solution and how is it implemented?|
|---
|Part a:
|Part b1:
|Part b2:

#


Question: AT-2 (2) Control Enhancement (M) (H)

Answer:
The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

|AT-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-2 (2) What is the solution and how is it implemented?|
|---
|Part a:

#


Question: AT-3 Role-Based Security Training (L) (M) (H)

Answer:
The organization provides role-based security training to personnel with assigned security roles and responsibilities:

Before authorizing access to the information system or performing assigned duties;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|AT-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-3 What is the solution and how is it implemented?|
|---
|Part a:
|Part b:
|Part c:

#


Question: AT-4 Security Training Records (L) (M)

Answer:
The organization:

Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Retains individual training records for [FedRAMP Assignment: at least one year].

|AT-4(b)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-4(b)(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-4 What is the solution and how is it implemented?|
|---
|Part a:
|Part b:
---
title: Audit and Accountability (AU)
---


Question: Audit and Accountability (AU)


Question: AU-1 Audit and Accountability Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and

Reviews and updates the current:

Audit and accountability policy [FedRAMP Assignment: at every 3 years]; and

Audit and accountability procedures [FedRAMP Assignment: at least annually].

|AU-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(b)(1):
|Parameter AU-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AU-1 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AU-2 Audit Events (L) (M) (H)

Answer:
The organization:

Determines that the information system is capable of auditing the following events: [FedRAMP Assignment: [Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events.  For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes];

Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events

Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and

Determines that the following events are to be audited within the information system: [FedRAMP Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited continually for each identified event].

AU-2 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.

|AU-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(d):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: AU-2 (3) Control Enhancement (M) (H)

Answer:
The organization reviews and updates the audited events [FedRAMP Assignment: annually or whenever there is a change in the threat environment].

AU-2 (3) Additional FedRAMP Requirements and Guidance:
Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO.

|AU-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-3 Content of Audit Records (L) (M) (H)

Answer:
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

|AU-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-3 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-3 (1) Control Enhancement (M)

Answer:
The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].

AU-3 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines audit record types [FedRAMP Assignment: session, connection, transaction, or activity duration; for client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon].  The audit record types are approved and accepted by the JAB.

Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.

|AU-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-3(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-4 Audit Storage Capacity (L) (M) (H)

Answer:
The organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements].

|AU-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-4 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-5 Response to Audit Processing Failures (L) (M) (H)

Answer:
The information system:

Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure; and

Takes the following additional actions: [FedRAMP Assignment: organization-defined actions to be taken; (overwrite oldest record)].

|AU-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-5(a):
|Parameter AU-5(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-5 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-6 Audit Review, Analysis, and Reporting (L) (M) (H)

Answer:
The organization:

Reviews and analyzes information system audit records [FedRAMP Assignment: at least weekly] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and

Reports findings to [Assignment: organization-defined personnel or roles].

AU-6 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the Authorizing Official. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.

|AU-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-6(a)-1:
|Parameter AU-6(a)-2:
|Parameter AU-6(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.

|AU-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-6 (3) Control Enhancement (M) (H)

Answer:
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

|AU-6 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-6 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-7 Audit Reduction and Report Generation (M) (H)

Answer:
The information system provides an audit reduction and report generation capability that:

Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

Does not alter the original content or time ordering of audit records.

|AU-7|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-7 (1) Control Enhancement (M) (H)

Answer:
The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].

|AU-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-7(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-7 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-8 Time Stamps (L) (M) (H)

Answer:
The information system:

Uses internal system clocks to generate time stamps for audit records; and

Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: one second granularity of time measurement].

|AU-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-8(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-8 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-8 (1) Control Enhancement (M) (H)

Answer:
The information system:

Compares the internal information system clocks  with [FedRAMP Assignment: authoritative time source: [http://tf.nist.gov/tf-cgi/servers.cgi] [at least hourly]]; and

Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].

AU-8 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.

Requirement:< The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.

Guidance: The service provider selects primary and secondary time servers used by the NIST Internet time service, or by a Stratum-1 time server. The secondary server is selected from a different geographic region than the primary server.

If using Windows Active Directory, all servers should synchronize time with the time source for the Windows Domain Controller. If using some other directory services (e.g., LDAP), all servers should synchronize time with the time source for the directory server. Synchronization of system clocks improves the accuracy of log analysis.

|AU-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-8(1)(a)-1:
|Parameter AU-8(1)(a)-2:
|Parameter AU-8(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-8 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: AU-9 Protection of Audit Information (L) (M) (H)

Answer:
The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

|AU-9|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-9 (2) Control Enhancement (M) (H)

Answer:
The information system backs up audit records [FedRAMP Assignment: at least weekly] onto a physically different system or system component than the system or component being audited.

|AU-9 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-9(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-9 (4) Control Enhancement (M) (H)

Answer:
The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users].

|AU-9 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-9(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-9 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: AU-11 Audit Record Retention (M)

Answer:
The organization retains audit records for [FedRAMP Assignment: at least ninety (90) days] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

AU-11 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements

|AU-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-11:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-11 What is the solution and how is it implemented?|
|---|
||

#


Question: AU-12 Audit Generation (L) (M) (H)

Answer:
The information system:

Provides audit record generation capability for the auditable events defined in AU-2 a. at [FedRAMP Assignment: all information system components where audit capability is deployed/available];

Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

|AU-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AU-12(a):
|Parameter AU-12(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AU-12 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
---
title: Security Assessment and Authorization (CA)
---


Question: Security Assessment and Authorization (CA)


Question: CA-1 Certification, Authorization, Security Assessment Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls; and

Reviews and updates the current:

Security assessment and authorization policy [FedRAMP Assignment: at least every three (3) years]; and

Security assessment and authorization procedures [FedRAMP Assignment: at least annually].

|CA-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-1(a):
|Parameter CA-1(b)(1):
|Parameter CA-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|CA-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CA-2 Security Assessments (L) (M) (H)

Answer:
The organization:

Develops a security assessment plan that describes the scope of the assessment including:

Security controls and control enhancements under assessment;

Assessment procedures to be used to determine security control effectiveness; and

Assessment environment, assessment team, and assessment roles and responsibilities;

Assesses the security controls in the information system and its environment of operation [FedRAMP Assignment: at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

Produces a security assessment report that documents the results of the assessment; and

Provides the results of the security control assessment to [FedRAMP Assignment: individuals or roles to include the FedRAMP Program Management Office (PMO)].

CA-2 Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Annual Assessment Guidance https://www.fedramp.gov/documents/

|CA-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-2(b):
|Parameter CA-2(d):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|

#


Question: CA-2 (1) Control Enhancement (L) (M) (H)

Answer:
The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to conduct security control assessments.

CA-2 (1) Additional FedRAMP Requirements and Guidance:

Requirement: For JAB Authorization, must use an accredited Third Party Assessment Organization (3PAO).

|CA-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-2(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-2 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-2 (2) Control Enhancement (M) (H)

Answer:
The organization includes as part of security control assessments, [FedRAMP Assignment: at least annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: organization-defined other forms of security assessment]].

CA-2 (2) Additional FedRAMP Requirements and Guidance:

Requirement: To include 'announced', 'vulnerability scanning’ to occur at least annually.

|CA-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-2(2)-1:
|Parameter CA-2(2)-2:
|Parameter CA-2(2)-3:
|Parameter CA-2(2)-4:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-2 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-2 (3) Control Enhancement (M) (H)

Answer:
The organization accepts the results of an assessment of [FedRAMP Assignment: organization-defined information system] performed by [FedRAMP Assignment: any FedRAMP Accredited 3PAO] when the assessment meets [FedRAMP Assignment: the conditions of the JAB/AO in the FedRAMP Repository].

|CA-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-2(3)-1:
|Parameter CA-2(3)-2:
|Parameter CA-2(3)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-3 System Interconnections (L) (M) (H)

Answer:
The organization:

Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements;

Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and

Reviews and updates Interconnection Security Agreements [FedRAMP Assignment: at least annually and on input from FedRAMP].

|Authorized Connections Information System Name|Name of Organization CSP Name System Connects To|Role and Name of Person Who Signed Connection Agreement|Name and Date of Interconnection Agreement|
|---|---|---|---|
|Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|
|Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|
|Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|

|CA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-3 What is the solution and how is it implemented?|
|---|
|Part a: See System Interconnections for information about implementation.|
|Part b: See Table Control Origination and Definitions and Table System Interconnections for information about implementation.|
|Part c|

#


Question: CA-3 (3) Control Enhancement (M) (H)

Answer:
The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [FedRAMP Assignment: boundary protections which meet Trusted Internet Connection (TIC) requirements].

CA-3 (3) Additional FedRAMP Requirements and Guidance:

Guidance: Refer to Appendix H – Cloud Considerations of the TIC Reference Architecture document. Link: https://www.dhs.gov/publication/tic-reference-architecture-22

|CA-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-3 What is the solution and how is it implemented?|
|---|
|Part a: See System Interconnections for information about implementation.|
|Part b: See Table Control Origination and Definitions and Table System Interconnections for information about implementation.|
|Part c|

#


Question: CA-3 (3) Control Enhancement (M) (H)

Answer:
The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [FedRAMP Assignment: boundary protections which meet Trusted Internet Connection (TIC) requirements].

CA-3 (3) Additional FedRAMP Requirements and Guidance:

Guidance: Refer to Appendix H – Cloud Considerations of the TIC Reference Architecture document. Link: https://www.dhs.gov/publication/tic-reference-architecture-22

|CA-3 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-3(3)-1:
|Parameter CA-3(3)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-3 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-3 (5) Control Enhancement (M)

Answer:
The organization employs [Selection: allow-all, deny-by-exception, deny-all, permit by exception] policy for allowing [Assignment: organization-defined information systems] to connect to external information systems.

CA-3 (5) Additional FedRAMP Requirements and Guidance:

Guidance: For JAB Authorization, CSPs shall include details of this control in their architecture briefing.

|CA-3 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-3(5)-1:
|Parameter CA-3(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-3 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-5 Plan of Action and Milestones (L) (M) (H)

Answer:
The organization:

Develops a plan of action and milestones for the information system to document the organization’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and

Updates existing plan of action and milestones [FedRAMP Assignment: at least monthly] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.

CA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Plan of Action & Milestones (POA&M) must be provided at least monthly.
Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Plan of Action and Milestones (POA&M) Template Completion Guide
https://www.FedRAMP.gov/documents/

|CA-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-5(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-5 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CA-6 Security Authorization (L) (M) (H)

Answer:
The organization:

Assigns a senior-level executive or manager as the authorizing official for the information system;

Ensures that the authorizing official authorizes the information system for processing before commencing operations; and

Updates the security authorization [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs].

CA-6c Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F (SP 800-37).  The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture.  The types of changes are approved and accepted by the JAB/AO.

|CA-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-6(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CA-7 Continuous Monitoring (L) (M) (H)

Answer:
The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

Establishment of [Assignment: organization-defined metrics] to be monitored;

Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

Correlation and analysis of security-related information generated by assessments and monitoring;

Response actions to address results of the analysis of security-related information; and

Reporting the security status of organization and the information system to [FedRAMP Assignment: to meet Federal and FedRAMP requirements] [Assignment: organization-defined frequency].

CA-7 Additional FedRAMP Requirements and Guidance:

Requirement: Operating System Scans: at least monthly. Database and Web Application Scans: at least monthly. All scans performed by Independent Assessor: at least annually.

Guidance: CSPs must provide evidence of closure and remediation of a high vulnerability within the timeframe for standard POA&M updates.

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Continuous Monitoring Strategy Guide
https://www.fedramp.gov/documents/

|CA-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-7(a):
|Parameter CA-7(b)-1:
|Parameter CA-7(b)-2:
|Parameter CA-7(g)-1:
|Parameter CA-7(g)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

CA-7 Additional FedRAMP Requirements and Guidance:

Requirement 1: Operating System Scans: at least monthly

Requirement 2: Database and Web Application Scans: at least monthly

Requirement 3: All scans performed by Independent Assessor: at least annually

|CA-7 Req.|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 What is the solution and how is it implemented?|
|---|
|Req. 1|
|Req. 2|
|Req. 3|

#


Question: CA-7 (1) Control Enhancement (M) (H)

Answer:
The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to monitor the security controls in the information system on an ongoing basis.

|CA-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-7(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-8 Penetration Testing (M) (H)

Answer:
The organization conducts penetration testing [FedRAMP Assignment: at least annually] on [Assignment: organization-defined information systems or system components].

CA-8 Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Penetration Test Guidance
https://www.fedramp.gov/documents/

|CA-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-8-1:
|Parameter CA-8-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-8 What is the solution and how is it implemented?|
|---|
||

#


Question: CA-8 (1) Control Enhancement (M) (H)

Answer:
The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.

|CA-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CA-9 Internal System Connections (L) (M) (H)

Answer:
The organization:

Authorizes internal connections of [Assignment: organization-defined information system components or classes of components] to the information system; and

Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.

|CA-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CA-9(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CA-9 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
---
title: Configuration Management (CM)
---


Question: Configuration Management (CM)


Question: CM-1 Configuration Management Policies and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and

Reviews and updates the current:

Configuration management policy [FedRAMP Assignment: at least every three (3) years]; and

Configuration management procedures [FedRAMP Assignment: at least annually].

|CM-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CM-1(a):
|Parameter CM-1(b)(1):
|Parameter CM-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|CM-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-2 Baseline Configuration (L) (M) (H)

Answer:
The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

|CM-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 What is the solution and how is it implemented?|
|---|
|Part a|

#


Question: CM-2 (1) Control Enhancement (M)

Answer:
The organization reviews and updates the baseline configuration of the information system:

[FedRAMP Assignment: at least annually];

When required due to [FedRAMP Assignment: to include when directed by the JAB]; and

As an integral part of information system component installations and upgrades.

|CM-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CM-2(1)(a):
|Parameter CM-2(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (1) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CM-2 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.

|CM-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-2 (3) Control Enhancement (M)

Answer:
The organization retains [Assignment: organization-defined previous versions of baseline configurations of the information system] to support rollback.

|CM-2 (3)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CM-2 (7) Control Enhancement (M) (H)

Answer:
The organization:

Issues [Assignment: organization-defined information systems, system components, or devices] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and

Applies [Assignment: organization-defined security safeguards] to the devices when the individuals return.

|CM-2 (7)|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-2(7)(a)-1:
|Parameter CM-2(7)(a)-2:
|Parameter CM-2(7)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-2 (7) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CM-3 Configuration Change Control (M) (H)

Answer:
The organization:

(a) Determines the types of changes to the information system that are configuration-controlled;

Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

Documents configuration change decisions associated with the information system;

Implements approved configuration-controlled changes to the information system;

Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period];

CM-3 (e) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with record retention policies and procedures.

Audits and reviews activities associated with configuration-controlled changes to the information system; and

Coordinates and provides oversight for configuration change control activities through [FedRAMP Assignment: see additional FedRAMP requirements and guidance] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].

CM-3 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page).  The means of communication are approved and accepted by the JAB/AO.

|CM-3|Control Summary Information|
|---|--|
|Responsible Role:
|Parameter CM-3(e):
|Parameter CM-3(g)-1:
|Parameter CM-3(g)-2:
|Parameter CM-3(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-3 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: CM-4 Security Impact Analysis (L) (M) (H)

Answer:
The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

|CM-4|Control Summary Information|
|---|--|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CM-4 What is the solution and how is it implemented?|
|---|
||

#