Question: AC-7 Unsuccessful Login Attempts (L) (M)

Answer:
The organization:

Enforces a limit of [FedRAMP Assignment: not more than three (3)] consecutive invalid logon attempts by a user during a [FedRAMP Assignment: fifteen (15) minutes]; and

Automatically [Selection: locks the account/node for a [FedRAMP Assignment: thirty (30) minutes]; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.

|AC-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-7(a)-1:
|Parameter AC-7(a)-2:
|Parameter AC-7(b)-1:
|Parameter AC-7(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-7 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-8 System Use Notification (L) (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The information system:

Displays to users [Assignment: organization-defined system use notification message or banner (FedRAMP Assignment: see additional Requirements and Guidance)] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that:

Users are accessing a U.S. Government information system;

Information system usage may be monitored, recorded, and subject to audit;

Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and

Use of the information system indicates consent to monitoring and recording;

Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and

For publicly accessible systems:

Displays system use information [Assignment: organization-defined conditions (FedRAMP Assignment: see additional Requirements and Guidance)], before granting further access;

Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and

Includes a description of the authorized uses of the system.

AC-8 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control.  The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO.

Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check.  The System Use Notification verification and periodicity are approved and accepted by the JAB/AO.

Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.

Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider.  The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.

|AC-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-8(a)-1:
|Parameter AC-8(c)-1:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

Additional FedRAMP Requirements and Guidance

Requirement 1: The service provider shall determine elements of the cloud environment that require the System Use Notification control.  The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO.

Requirement 2: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check.  The System Use Notification verification and periodicity are approved and accepted by the JAB/AO.  If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.

Requirement 3: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider.  The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.

|AC-8 Req.|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-8 What is the solution and how is it implemented?|
|---|
|Req 1
|Req 2
|Req 3


Question: AC-10 Concurrent Session Control (M) (H)

Answer:
The information system limits the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [FedRAMP Assignment: three (3) sessions for privileged access and two (2) sessions for non-privileged access].

|AC-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-10-1:
|Parameter AC-10-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-10 What is the solution and how is it implemented?|
|---|
||


Question: AC-11 Session Lock (M) (H)

Answer:
The information system:

Prevents further access to the system by initiating a session lock after [FedRAMP Assignment: fifteen (15) minutes] of inactivity or upon receiving a request from a user; and

Retains the session lock until the user reestablishes access using established identification and authentication procedures.

|AC-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-11(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-11 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-11 (1) Control Enhancement (M) (H)

Answer:
The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.

|AC-11 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-11(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-11 (1) What is the solution and how is it implemented?|
|---|
||


Question: AC-12 Session Termination (M) (H)

Answer:
The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].

|AC-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-12 What is the solution and how is it implemented?|
|---|
||


Question: AC-14 Permitted Actions without Identification or Authentication (L) (M) (H)

Answer:
The organization:

Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.

|AC-14|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-14 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-17 Remote Access (L) (M) (H)

Answer:
The organization:

Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

Authorizes remote access to the information system prior to allowing such connections.

|AC-17|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-17 (1) Control Enhancement (M) (H)

Answer:
The information system monitors and controls remote access methods.

|AC-17 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (2) Control Enhancement (M) (H)

Answer:
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

|AC-17 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (3) Control Enhancement (M) (H)

Answer:
The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.

|AC-17 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-17 (4) Control Enhancement (M) (H)

Answer:
The organization:

Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and

Documents the rationale for such access in the security plan for the information system.

|AC-17 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(4)(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (4) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-17 (9) Control Enhancement (M) (H)

Answer:
The organization provides the capability to expeditiously disconnect or disable remote access to the information system within [FedRAMP Assignment: fifteen (15) minutes].

|AC-17 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-17(9):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-17 (9) What is the solution and how is it implemented?|
|---|
||


Question: AC-18 Wireless Access Restrictions (L) (M) (H)

Answer:
The organization:

 Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

Authorizes wireless access to the information system prior to allowing such connections.

|AC-18|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-18:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-18 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-18 (1) Control Enhancement (M) (H)

Answer:
The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.

|AC-18 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-18 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-18 (1) What is the solution and how is it implemented?|
|---|
||


Question: AC-19 Access Control for Portable and Mobile Systems (L) (M) (H)

Answer:
The organization:

Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

Authorizes the connection of mobile devices to organizational information systems.

|AC-19|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-19 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-19 (5) Control Enhancement (M) (H)

Answer:
The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].

|AC-19 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-19(5)-1:
|Parameter AC-19(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-19 (5) What is the solution and how is it implemented?|
|---|
||


Question: AC-20 Use of External Information Systems (L) (M) (H)

Answer:
The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:

Access the information system from external information systems; and

Process, store, or transmit organization-controlled information using external information systems.

|AC-20|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-20 (1) Control Enhancement (M) (H)

Answer:
The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or

Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.

|AC-20 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 (1) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: AC-20 (2) Control Enhancement (M) (H)

Answer:
The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.

|AC-20 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-20(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-20 (2) What is the solution and how is it implemented?|
|---|
||


Question: AC-21 Information Sharing (M) (H)

Answer:
The organization:

Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and

Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.

|AC-21|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-21(a):
|Parameter AC-21(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-21 What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-22 Publicly Accessible Content (L) (M) (H)

Answer:
The organization:

Designates individuals authorized to post information onto a publicly accessible information system;

Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and

Reviews the content on the publicly accessible information system for nonpublic information [FedRAMP Assignment: at least quarterly] and removes such information, if discovered.

|AC-22|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-22
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-22 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d


Question: System and Information Integrity (SI)


Question: SI-1 System and Information Integrity Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls; and

Reviews and updates the current:

System and information integrity policy [FedRAMP Assignment: at least every three (3) years]; and

System and information integrity procedures [FedRAMP Assignment: at least at least annually].

|SI-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-1(a):
|Parameter SI-1(b)(1):
|Parameter SI-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|SI-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-2 Flaw Remediation (L) (M) (H)

Answer:
The organization:

Identifies, reports, and corrects information system flaws;

Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;

Installs security-relevant software and firmware updates within [FedRAMP Assignment: thirty 30 days of release of updates] of the release of the updates; and

Incorporates flaw remediation into the organizational configuration management process.

|SI-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2(&#99):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-2 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms [FedRAMP Assignment: at least monthly] to determine the state of information system components with regard to flaw remediation.

|SI-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-2 (3) Control Enhancement (M) (H)

Answer:
The organization:

Measures the time between flaw identification and flaw remediation; and

Establishes [Assignment: organization-defined benchmarks] for taking corrective actions.

|SI-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2(3)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 (3) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-3 Malicious Code Protection (L) (M)

Answer:
The organization:

Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

Configures malicious code protection mechanisms to:

Perform periodic scans of the information system [FedRAMP Assignment: at least weekly] and real-time scans of files from external sources at [FedRAMP Assignment: to include endpoints] as the files are downloaded, opened, or executed in accordance with organizational security policy; and

[FedRAMP Assignment: to include alerting administrator or defined security personnel] in response to malicious code detection; and

Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

|SI-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-3(&#99)(1)-1:
|Parameter SI-3(&#99)(1)-2:
|Parameter SI-3(&#99)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 (3) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: 1. SI-3 (1) Control Enhancement (M) (H)

Answer:
The organization centrally manages malicious code protection mechanisms.

|SI-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-3 (2) Control Enhancement (M) (H)

Answer:
The information system automatically updates malicious code protection mechanisms.

|SI-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-3 (7) Control Enhancement (M) (H)

Answer:
The information system implements nonsignature-based malicious code detection mechanisms.

|SI-3 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 Information System Monitoring (L) (M) (H)

Answer:
The organization:

Monitors the information system to detect:

Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and

Unauthorized local, network, and remote connections;

Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods];

Deploys monitoring devices (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;

Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

SI-4 Additional FedRAMP Requirements and Guidance:
Guidance: See US-CERT Incident Response Reporting Guidelines.

|SI-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: SI-4 (1) Control Enhancement (M) (H)

Answer:
The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

|SI-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: 1. SI-4 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated tools to support near real-time analysis of events.

|SI-4 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (4) Control Enhancement (M) (H)

Answer:
The information system monitors inbound and outbound communications traffic [FedRAMP Assignment: continuously] for unusual or unauthorized activities or conditions.

|SI-4 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: 1. SI-4 (5) Control Enhancement (M) (H)

Answer:
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].

SI-4(5) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with the incident response plan.

|SI-4 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(5)-1:
|Parameter SI-4(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (14) Control Enhancement (M) (H)

Answer:
The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.

|SI-4 (14)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (14) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (16) Control Enhancement (M) (H)

Answer:
The organization correlates information from monitoring tools employed throughout the information system.

|SI-4 (16)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (16) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (23) Control Enhancement (M) (H)

Answer:
The organization implements [Assignment: organization-defined host-based monitoring mechanisms] at [Assignment: organization-defined information system components].

|SI-4 (23)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(23)-1:
|Parameter SI-4(23)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (23) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-5 Security Alerts & Advisories (L) (M) (H)

Answer:
The organization:

Receives information system security alerts, advisories, and directives from [FedRAMP Assignment: to include US-CERT] on an ongoing basis;

Generates internal security alerts, advisories, and directives as deemed necessary;

Disseminates security alerts, advisories, and directives to [FedRAMP Assignment: to include system security personnel and administrators with configuration/patch-management responsibilities]; and

Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.

|SI-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-5(a):
|Parameter SI-5(&#99):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-6 Security Functionality Verification (M) (H)

Answer:
The information system:

Verifies the correct operation of [Assignment: organization-defined security functions];

Performs this verification [FedRAMP Assignment: to include upon system startup and/or restart at least monthly];

Notifies [FedRAMP Assignment: to include system administrators and security personnel] of failed security verification tests; and

[Selection (one or more): shuts the information system down; restarts the information system; [FedRAMP Assignment: to include notification of system administrators and security personnel] when anomalies are discovered.

|SI-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-6(a):
|Parameter SI-6(b):
|Parameter SI-6(&#99):
|Parameter SI-6(d)-1:
|Parameter SI-6(d)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-7 Software & Information Integrity (M) (H)

Answer:
The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].

|SI-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-7 (1) Control Enhancement (M) (H)

Answer:
The information system performs an integrity check of [Assignment: organization-defined software, firmware, and information] [FedRAMP Selection (one or more): at startup; at [FedRAMP Assignment: to include security-relevant events]; [FedRAMP Assignment: at least monthly]].

|SI-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7(1)-1:
|Parameter SI-7(1)-2:
|Parameter SI-7(1)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-7 (7) Control Enhancement (M) (H)

Answer:
The organization incorporates the detection of unauthorized [Assignment: organization-defined security-relevant changes to the information system] into the organizational incident response capability.

|SI-7 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7 (7):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-8 Spam Protection (M) (H)

Answer:
The organization:

Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and

Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policies and procedures.

|SI-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-8:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SI-8 (1) Control Enhancement (M) (H)

Answer:
The organization centrally manages spam protection mechanisms.

|SI-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-8 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-8 (2) Control Enhancement (M) (H)

Answer:
The organization automatically updates spam protection mechanisms.

|SI-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-10 Information Input Validation (M) (H)

Answer:
The information system checks the validity of [Assignment: organization-defined information inputs].

|SI-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-10 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-11 Error Handling (M) (H)

Answer:
The information system:

Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and

Reveals error messages only to [Assignment: organization-defined personnel or roles].

|SI-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-11(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-11 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-12 Information Output Handling and Retention (L) (M) (H)

Answer:
The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

|SI-12|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-12 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-16 Memory Protection (M) (H)

Answer:
The information system implements [Assignment: organization-defined fail-safe procedures] to protect its memory from unauthorized code execution.

|SI-16|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-16-1:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-16 What is the solution and how is it implemented?|
|---|
||


Question: Awareness and Training (AT)


Question: AT-1 Security Awareness and Training Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and

Reviews and updates the current:

Security awareness and training policy [FedRAMP Assignment: at least every 3 years]; and

Security awareness and training procedures [FedRAMP Assignment: at least annually].

|AC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-1(a):
|Parameter AT-1(b)(1):
|Parameter AT-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AT-1 What is the solution and how is it implemented?|
|---
|Part a:
|Part b1:
|Part b2:

#


Question: AT-2 Security Awareness (L) (M) (H)

Answer:
The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

As part of initial training for new users;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|AT-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-2 What is the solution and how is it implemented?|
|---
|Part a:
|Part b1:
|Part b2:

#


Question: AT-2 (2) Control Enhancement (M) (H)

Answer:
The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

|AT-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-2 (2) What is the solution and how is it implemented?|
|---
|Part a:

#


Question: AT-3 Role-Based Security Training (L) (M) (H)

Answer:
The organization provides role-based security training to personnel with assigned security roles and responsibilities:

Before authorizing access to the information system or performing assigned duties;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|AT-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-3 What is the solution and how is it implemented?|
|---
|Part a:
|Part b:
|Part c:

#


Question: AT-4 Security Training Records (L) (M)

Answer:
The organization:

Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Retains individual training records for [FedRAMP Assignment: at least one year].

|AT-4(b)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AT-4(b)(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AT-4 What is the solution and how is it implemented?|
|---
|Part a:
|Part b:


Question: Incident Response (IR)


Question: IR-1 Incident Response Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the incident response policy and associated incident response controls; and

Reviews and updates the current:

Incident response policy [FedRAMP Assignment: at least every three (3) years]; and

Incident response procedures [FedRAMP Assignment: at least annually].

|IR-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-1(a):
|Parameter IR-1(b)(1):
|Parameter IR-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|IR-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: IR-2 Incident Response Training (L) (M)

Answer:
The organization provides incident response training to information system users consistent with assigned roles and responsibilities in accordance with NIST SP 800-53 Rev 4:

Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|IR-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-2(a):
|Parameter IR-2(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: IR-3 Incident Response Testing (M)

Answer:
The organization tests the incident response capability for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance] to determine the incident response effectiveness and documents the results.

IR-3 Additional FedRAMP Requirements and Guidance:

Requirements: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). For JAB authorization, the service provider provides test plans to the JAB/AO annually. Test plans are approved and accepted by the JAB/AO prior to the test commencing.

|IR-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-3-1:
|Parameter IR-3-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-3 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-3 (2) Control Enhancement (M) (H)

Answer:
The organization coordinates incident response testing with organizational elements responsible for related plans.

|IR-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-4 Incident Handling (L) (M) (H)

Answer:
The organization:

Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

Coordinates incident handling activities with contingency planning activities; and

Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

IR-4 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.

|IR-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-4 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: IR-4 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the incident handling process.

|IR-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-5 Incident Monitoring (L) (M) (H)

Answer:
The organization tracks and documents information system security incidents.

#


Question: IR-4 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the incident handling process.

|IR-5|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-5 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-6 Incident Reporting (L) (M) (H)

Answer:
The organization:

Requires personnel to report suspected security incidents to the organizational incident response capability within [FedRAMP Assignment: US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended)]; and

Reports security incident information to [Assignment: organization-defined authorities].

IR-6 Additional FedRAMP Requirements and Guidance

Requirement: Report security incident information according to FedRAMP Incident Communications Procedure.

|IR-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-6(a):
|Parameter IR-6(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: IR-6 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to assist in the reporting of security incidents.

|IR-6 (1) |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 Incident Response Assistance (L) (M) (H)

Answer:
The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.

|IR-7 |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to increase the availability of incident response related information and support.

|IR-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-7 (2) Control Enhancement (M) (H)

Answer:
The organization:

Establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability; and

Identifies organizational incident response team members to the external providers.

|IR-7 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-7 (2) What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: IR-8 Incident Response Plan (L) (M) (H)

Answer:
The organization:

Develops an incident response plan that:

Provides the organization with a roadmap for implementing its incident response capability;

Describes the structure and organization of the incident response capability;

Provides a high-level approach for how the incident response capability fits into the overall organization;

Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;

Defines reportable incidents;

Provides metrics for measuring the incident response capability within the organization;

Defines the resources and management support needed to effectively maintain and mature an incident response capability; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the incident response plan to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance].

IR-8(b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements.  The incident response list includes designated FedRAMP personnel.

Reviews the incident response plan [FedRAMP Assignment: at least annually];

Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing;

Communicates incident response plan changes to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance]; and

IR-8(e) Additional FedRAMP Requirements and Guidance:

Requirement:  The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements.  The incident response list includes designated FedRAMP personnel.

Protects the incident response plan from unauthorized disclosure and modification.

|IR-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-8(a)(8):
|Parameter IR-8(b):
|Parameter IR-8(c):
|Parameter IR-8(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: IR-9 Information Spillage Response (M) (H)

Answer:
The organization responds to information spills by:

Identifying the specific information involved in the information system contamination;

Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;

Isolating the contaminated information system or system component;

Eradicating the information from the contaminated information system or component;

Identifying other information systems or system components that may have been subsequently contaminated; and

Performing other [Assignment: organization-defined actions].

|IR-9|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(b):
|Parameter IR-9(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f

#


Question: IR-9 (1) Control Enhancement (M) (H)

Answer:
The organization assigns [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills.

|IR-9 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-9 (2) Control Enhancement (M)

Answer:
The organization provides information spillage response training [Assignment: organization- defined frequency].

|IR-9 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-9 (3) Control Enhancement (M) (H)

Answer:
The organization implements [Assignment: organization-defined procedures] to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

|IR-9 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: IR-9 (4) Control Enhancement (M) (H)

Answer:
The organization employs [Assignment: organization-defined security safeguards] for personnel exposed to information not within assigned access authorizations.

|IR-9 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter IR-9(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|IR-9 (4) What is the solution and how is it implemented?|
|---|
||


Question: Contingency Planning (CP)


Question: CP-1 Contingency Planning Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls; and

Reviews and updates the current:

Contingency planning policy [FedRAMP Assignment: at least every three (3) years].; and

Contingency planning procedures [FedRAMP Assignment: at least annually].

|CP-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-1(a):
|Parameter CP-1(b)(1):
|Parameter CP-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|CP-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-2 Contingency Plan (L) (M) (H)

Answer:
The organization:

Develops a contingency plan for the information system that:

Identifies essential missions and business functions and associated contingency requirements;

Provides recovery objectives, restoration priorities, and metrics;

Addresses contingency roles, responsibilities, assigned individuals with contact information;

Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];

Coordinates contingency planning activities with incident handling activities;

Reviews the contingency plan for the information system [FedRAMP Assignment: at least annually];

Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and

Protects the contingency plan from unauthorized disclosure and modification.

CP-2 Additional FedRAMP Requirements and Guidance:

Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.

|CP-2|Control Summary Information|
|---|---|
|Responsible Role
|Parameter CP-2(a)(6):
|Parameter CP-2(b):
|Parameter CP-2(d):
|Parameter CP-2(f):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-2 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: CP-2 (1) Control Enhancement (M) (H)

Answer:
The organization coordinates contingency plan development with organizational elements responsible for related plans.

|CP-2 (1)|Control Summary Information|
|---|---|
|Responsible Role
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (2) Control Enhancement (M) (H)

Answer:
The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.

|CP-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (3) Control Enhancement (M) (H)

Answer:
The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.

|CP-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

#


Question: CP-2 (8) Control Enhancement (M) (H)

Answer:
The organization identifies critical information system assets supporting essential missions and business functions.

|CP-2 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-2 (8) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-3 Contingency Training (L) (M) (H)

Answer:
The organization provides contingency training to information system users consistent with assigned roles and responsibilities:

Within [FedRAMP Assignment: ten (10) days] of assuming a contingency role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.

|CP-3|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-3(a):
|Parameter CP-3(c):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-3 What is the solution and how is it implemented?|
|---|
||

#


Question: CP-4 Contingency Plan Testing (M)

Answer:
The organization:

Tests the contingency plan for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: functional exercises] to determine the effectiveness of the plan and the organizational readiness to execute the plan;

CP-4(a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended) and provides plans to FedRAMP prior to initiating testing.  Test plans are approved and accepted by the JAB/AO prior to initiating testing.

Reviews the contingency plan test results; and

Initiates corrective actions, if needed.

|CP-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-4 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CP-4 (1) Control Enhancement (M) (H)

Answer:
The organization coordinates contingency plan testing and/or exercises with organizational elements responsible for related plans.

|CP-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-6 Alternate Storage Site (M) (H)

Answer:
The organization:

Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.

|CP-6 |Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: CP-6 (1) Control Enhancement (M) (H)

Answer:
The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.

|CP-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-6 (3) Control Enhancement (M) (H)

Answer:
The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.

CP-6 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-6 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: CP-7 Alternate Processing Site (M) (H)

Answer:
The organization:

Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [FedRAMP Assignment: see additional FedRAMP requirements and guidance] when the primary processing capabilities are unavailable;

CP-7a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.

Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

Ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.

CP-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter CP-7(a)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|

#


Question: CP-7 (1) Control Enhancement (M) (H)

Answer:
The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.

CP-7 (1) Additional FedRAMP Requirements and Guidance

Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern.  For one particular type of threat (i.e., hostile cyber-attack), the degree of separation between sites will be less relevant.

CP-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|CP-7 (1) What is the solution and how is it implemented?|
|---|
||

#