Question: SA-9 (1) Control Enhancement (M) (H)

Answer:
The organization:

Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and

Ensures that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].

|SA-9 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-9(1)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-9 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SA-9 (2) Control Enhancement (M) (H)

Context: Refer to the specific section and subsections for details.

Answer:
The organization requires providers of [FedRAMP Assignment: All external systems where Federal information is processed or stored] to identify the functions, ports, protocols, and other services required for the use of such services.

|SA-9 (2) Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-9(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-9 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-9 (4) Control Enhancement (M) (H)

Answer:
The organization employs [Assignment: organization-defined security safeguards] to ensure that the interests of [FedRAMP Assignment: All external systems where Federal information is processed or stored] are consistent with and reflect organizational interests.

|SA-9 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-9(4)-1:
|Parameter SA-9(4)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-9 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-9 (5) Control Enhancement (M) (H)

Answer:
The organization restricts the location of [FedRAMP Selection: information processing, information data, AND information services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].

Additional FedRAMP Requirements and Guidance

Guidance:  System services refer to FTP, Telnet, and TFTP, etc.

|SA-9 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-9(5)-1:
|Parameter SA-9(5)-2:
|Parameter SA-9(5)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-9 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-10 Developer Configuration Management (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to:

Perform configuration management during system, component, or service [FedRAMP Selection: development, implementation, AND operation];

Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management];

Implement only organization-approved changes to the system, component, or service;

Document approved changes to the system, component, or service and the potential security impacts of such changes; and

Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].

SA-10 (e) Additional FedRAMP Requirements and Guidance:

Requirement: For JAB authorizations, track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP.

|SA-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-10(a):
|Parameter SA-10(b):
|Parameter SA-10(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-10 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: SA-10 (1) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.

|SA-10 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-10 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-11 Developer Security Testing and Evaluation (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to:

Create and implement a security assessment plan;

Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage];

Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;

Implement a verifiable flaw remediation process; and

Correct flaws identified during security testing/evaluation.

|SA-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-11(b)-1:
|Parameter SA-11(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-11 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part e|
|Part d|

#


Question: SA-11 (1) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws and document the results of the analysis.

SA-11 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.

|SA-11 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SA-11(b)-1:
|Parameter SA-11(b)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-11 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-11 (2) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.

|SA-11 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-11 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SA-11 (8) Control Enhancement (M) (H)

Answer:
The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.

|SA-11 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SA-11 (8) What is the solution and how is it implemented?|
|---|
||
---
title: System and Communications Protection (SC)
---


Question: System and Communications Protection (SC)


Question: SC-1 System and Communications Protection Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls; and

Reviews and updates the current:

System and communications protection policy [FedRAMP Assignment: at least every three (3) years]; and

System and communications protection procedures [FedRAMP Assignment: at least annually].

|SC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-1(a):
|Parameter SC-1(b)(1):
|Parameter SC-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|SC-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SC-2 Application Partitioning (M) (H)

Answer:
The information system separates user functionality (including user interface services) from information system management functionality.

|SC-2|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-2 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-4 Information in Shared Resources (M) (H)

Answer:
The information system prevents unauthorized and unintended information transfer via shared system resources.

|SC-4|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-4 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-5 Denial of Service Protection (L) (M) (H)

Answer:
The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or reference to source for such information] by employing [Assignment: organization-defined security safeguards].

|SC-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-5-1:
|Parameter SC-5-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-5 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-6 Resource Availability (M) (H)

Answer:
The information system protects the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more); priority; quota; [Assignment: organization-defined security safeguards]].

|SC-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-6-1:
|Parameter SC-6-2:
|Parameter SC-6-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-6 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 Boundary Protection (L) (M) (H)

Answer:
The information system:

Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; and

Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and

Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with organizational security architecture.

|SC-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: SC-7 (3) Control Enhancement (M) (H)

Answer:
The organization limits the number external network connections to the information system.

|SC-7 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (3) What is the solution and how is it implemented?|
|---|
|Part a

#


Question: SC-7 (4) Control Enhancement (M)

Answer:
The organization:

Implements a managed interface for each external telecommunication service;

Establishes a traffic flow policy for each managed interface;

Protects the confidentiality and integrity of the information being transmitted across each interface;

Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and

Reviews exceptions to the traffic flow policy [FedRAMP Assignment: at least at least annually] and removes exceptions that are no longer supported by an explicit mission/business need.

|SC-7 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(4)(e):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (4) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e

#


Question: SC-7 (5) Control Enhancement (M) (H)

Answer:
The information system at managed interfaces denies network traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).

|SC-7 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (5) What is the solution and how is it implemented?|
|---|
|Part a

#


Question: SC-7 (7) Control Enhancement (M) (H)

Answer:
The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.

|SC-7 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (8) Control Enhancement (M) (H)

Answer:
The information system routes [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.

|SC-7 (8)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(8)-1:
|Parameter SC-7(8)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (8) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (12) Control Enhancement (M)

Answer:
The organization implements [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined information system components].

|SC-7 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(12)-1:
|Parameter SC-7(12)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (12) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (13) Control Enhancement (M)

Answer:
The organization isolates [FedRAMP Assignment: See SC-7 (13) additional FedRAMP Requirements and Guidance] from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

SC-7 (13) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.

|SC-7 (13)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-7(13):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (13) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-7 (18) Control Enhancement (M) (H)

Answer:
The information system fails securely in the event of an operational failure of a boundary protection device.

|SC-7 (18)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-7 (18) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-8 Transmission confidentiality and Integrity (M) (H)

Answer:
The information system protects the [FedRAMP Assignment: confidentiality AND integrity] of transmitted information.

|SC-8|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-8 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-8 (1) Control Enhancement (M) (H)

Answer:
The information system implements cryptographic mechanisms to [FedRAMP Assignment: prevent unauthorized disclosure of information AND detect changes to information] during transmission unless otherwise protected by [FedRAMP Assignment: a hardened or alarmed carrier Protective Distribution System (PDS)].

|SC-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-8 (1)-1:
|Parameter SC-8 (1)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-10 Network Disconnect (M)

Answer:
The information system terminates the network connection associated with a communications session at the end of the session or after [FedRAMP Assignment: no longer than thirty (30) minutes for RAS-based sessions and no longer than sixty (60) minutes for non-interactive user sessions] of inactivity.

|SC-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-10 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 Cryptographic Key Establishment & Management (L) (M) (H)

Answer:
The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

SC-12 Additional FedRAMP Requirements and Guidance:

Guidance: Federally approved and validated cryptography.

|SC-12|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 (2) Control Enhancement (M) (H)

Answer:
The organization produces, controls, and distributes symmetric cryptographic keys using [FedRAMP Selection: NIST FIPS-compliant] key management technology and processes.

|SC-12 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-12 (3) Control Enhancement (M) (H)

Answer:
The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3  certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and  hardware security tokens that protect the user’s private key].

|SC-12 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-12 (3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-12 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-13 Use of Cryptography (L) (M) (H)

Answer:
The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

|SC-13|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-13:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-13 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-15 Collaborative Computing Devices (M) (H)

Answer:
The information system:

Prohibits remote activation of collaborative computing devices with the following exceptions:[FedRAMP Assignment: no exceptions]; and

Provides an explicit indication of use to users physically present at the devices.

SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.

|SC-15|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-15(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-15 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.

|SC-15 req.|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-15(a):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-15 What is the solution and how is it implemented?|
|---|
|Req. 1|

#


Question: SC-17 Public Key Infrastructure Certificates (M) (H)

Answer:
The organization issues public key certificates under an [Assignment: organization-defined certificate policy] or obtains public key certificates from an approved service provider.

|SC-17|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-17:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-17 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-18 Mobile Code (M) (H)

Answer:
The organization:

Defines acceptable and unacceptable mobile code and mobile code technologies;

Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and

Authorizes, monitors, and controls the use of mobile code within the information system.

|SC-18|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-18 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

##


Question: SC-19 Voice Over Internet Protocol (M) (H)

Answer:
The organization:

Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and

Authorizes, monitors, and controls the use of VoIP within the information system.

|SC-19|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-19 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SC-20 Secure Name / Address Resolution Service (Authoritative Source) (L) (M) (H)

Answer:
The information system:

Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.

|SC-20|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-20 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver) (L) (M) (H)

Answer:
The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.

|SC-21|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-21|Control Summary Information|
|---|---|
|//date|

|SC-21 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-22 Architecture and Provisioning for Name / Address Resolution Service (L) (M) (H)

Answer:
The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.

|SC-22|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

SC-22 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-23 Session Authenticity (M) (H)

Answer:
The information system protects the authenticity of communications sessions.

|SC-23|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-23 What is the solution and how is it implemented|
|---|
||

#


Question: SC-28 Protection of Information at Rest (M) (H)

Answer:
The information system protects the [FedRAMP Selection: confidentiality AND integrity]] of [Assignment: organization-defined information at rest].
SC-28 Additional FedRAMP Requirements and Guidance:

Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest.

|SC-28|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-28-1:
|Parameter SC-28-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-28 What is the solution and how is it implemented?|
|---|
||

#


Question: SC-28 (1) Control Enhancement (M)

Answer:
The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined information] on [Assignment: organization-defined information system components]

|SC-28 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SC-28(1)-1:
|Parameter SC-28(1)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-28 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SC-39 Process Isolation (L) (M) (H)

Answer:
The information system maintains a separate execution domain for each executing process.

|SC-39|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SC-39 What is the solution and how is it implemented?|
|---|
||
---
title: System and Information Integrity (SI)
---


Question: System and Information Integrity (SI)


Question: SI-1 System and Information Integrity Policy and Procedures (L) (M)

Answer:
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls; and

Reviews and updates the current:

System and information integrity policy [FedRAMP Assignment: at least every three (3) years]; and

System and information integrity procedures [FedRAMP Assignment: at least at least annually].

|SI-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-1(a):
|Parameter SI-1(b)(1):
|Parameter SI-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|SI-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-2 Flaw Remediation (L) (M) (H)

Answer:
The organization:

Identifies, reports, and corrects information system flaws;

Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;

Installs security-relevant software and firmware updates within [FedRAMP Assignment: thirty 30 days of release of updates] of the release of the updates; and

Incorporates flaw remediation into the organizational configuration management process.

|SI-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2(&#99):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-2 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms [FedRAMP Assignment: at least monthly] to determine the state of information system components with regard to flaw remediation.

|SI-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2 (2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-2 (3) Control Enhancement (M) (H)

Answer:
The organization:

Measures the time between flaw identification and flaw remediation; and

Establishes [Assignment: organization-defined benchmarks] for taking corrective actions.

|SI-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-2(3)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 (3) What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-3 Malicious Code Protection (L) (M)

Answer:
The organization:

Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

Configures malicious code protection mechanisms to:

Perform periodic scans of the information system [FedRAMP Assignment: at least weekly] and real-time scans of files from external sources at [FedRAMP Assignment: to include endpoints] as the files are downloaded, opened, or executed in accordance with organizational security policy; and

[FedRAMP Assignment: to include alerting administrator or defined security personnel] in response to malicious code detection; and

Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

|SI-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-3(&#99)(1)-1:
|Parameter SI-3(&#99)(1)-2:
|Parameter SI-3(&#99)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-2 (3) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: 1. SI-3 (1) Control Enhancement (M) (H)

Answer:
The organization centrally manages malicious code protection mechanisms.

|SI-3 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-3 (2) Control Enhancement (M) (H)

Answer:
The information system automatically updates malicious code protection mechanisms.

|SI-3 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-3 (7) Control Enhancement (M) (H)

Answer:
The information system implements nonsignature-based malicious code detection mechanisms.

|SI-3 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-3 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 Information System Monitoring (L) (M) (H)

Answer:
The organization:

Monitors the information system to detect:

Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and

Unauthorized local, network, and remote connections;

Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods];

Deploys monitoring devices (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;

Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

SI-4 Additional FedRAMP Requirements and Guidance:
Guidance: See US-CERT Incident Response Reporting Guidelines.

|SI-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|
|Part c|
|Part d|
|Part e|
|Part f|
|Part g|

#


Question: SI-4 (1) Control Enhancement (M) (H)

Answer:
The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

|SI-4 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: 1. SI-4 (2) Control Enhancement (M) (H)

Answer:
The organization employs automated tools to support near real-time analysis of events.

|SI-4 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (4) Control Enhancement (M) (H)

Answer:
The information system monitors inbound and outbound communications traffic [FedRAMP Assignment: continuously] for unusual or unauthorized activities or conditions.

|SI-4 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: 1. SI-4 (5) Control Enhancement (M) (H)

Answer:
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].

SI-4(5) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with the incident response plan.

|SI-4 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(5)-1:
|Parameter SI-4(5)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (14) Control Enhancement (M) (H)

Answer:
The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.

|SI-4 (14)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (14) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (16) Control Enhancement (M) (H)

Answer:
The organization correlates information from monitoring tools employed throughout the information system.

|SI-4 (16)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (16) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-4 (23) Control Enhancement (M) (H)

Answer:
The organization implements [Assignment: organization-defined host-based monitoring mechanisms] at [Assignment: organization-defined information system components].

|SI-4 (23)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-4(23)-1:
|Parameter SI-4(23)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-4 (23) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-5 Security Alerts & Advisories (L) (M) (H)

Answer:
The organization:

Receives information system security alerts, advisories, and directives from [FedRAMP Assignment: to include US-CERT] on an ongoing basis;

Generates internal security alerts, advisories, and directives as deemed necessary;

Disseminates security alerts, advisories, and directives to [FedRAMP Assignment: to include system security personnel and administrators with configuration/patch-management responsibilities]; and

Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.

|SI-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-5(a):
|Parameter SI-5(&#99):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-6 Security Functionality Verification (M) (H)

Answer:
The information system:

Verifies the correct operation of [Assignment: organization-defined security functions];

Performs this verification [FedRAMP Assignment: to include upon system startup and/or restart at least monthly];

Notifies [FedRAMP Assignment: to include system administrators and security personnel] of failed security verification tests; and

[Selection (one or more): shuts the information system down; restarts the information system; [FedRAMP Assignment: to include notification of system administrators and security personnel] when anomalies are discovered.

|SI-6|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-6(a):
|Parameter SI-6(b):
|Parameter SI-6(&#99):
|Parameter SI-6(d)-1:
|Parameter SI-6(d)-2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-6 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d

#


Question: SI-7 Software & Information Integrity (M) (H)

Answer:
The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].

|SI-7|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-7 (1) Control Enhancement (M) (H)

Answer:
The information system performs an integrity check of [Assignment: organization-defined software, firmware, and information] [FedRAMP Selection (one or more): at startup; at [FedRAMP Assignment: to include security-relevant events]; [FedRAMP Assignment: at least monthly]].

|SI-7 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7(1)-1:
|Parameter SI-7(1)-2:
|Parameter SI-7(1)-3:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-7 (7) Control Enhancement (M) (H)

Answer:
The organization incorporates the detection of unauthorized [Assignment: organization-defined security-relevant changes to the information system] into the organizational incident response capability.

|SI-7 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-7 (7):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-7 (7) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-8 Spam Protection (M) (H)

Answer:
The organization:

Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and

Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policies and procedures.

|SI-8|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-8:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 What is the solution and how is it implemented?|
|---|
|Part a
|Part b

#


Question: SI-8 (1) Control Enhancement (M) (H)

Answer:
The organization centrally manages spam protection mechanisms.

|SI-8 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-8 (1):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-8 (2) Control Enhancement (M) (H)

Answer:
The organization automatically updates spam protection mechanisms.

|SI-8 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-8 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: SI-10 Information Input Validation (M) (H)

Answer:
The information system checks the validity of [Assignment: organization-defined information inputs].

|SI-10|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-10:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-10 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-11 Error Handling (M) (H)

Answer:
The information system:

Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and

Reveals error messages only to [Assignment: organization-defined personnel or roles].

|SI-11|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-11(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-11 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b|

#


Question: SI-12 Information Output Handling and Retention (L) (M) (H)

Answer:
The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

|SI-12|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-12 What is the solution and how is it implemented?|
|---|
||

#


Question: SI-16 Memory Protection (M) (H)

Answer:
The information system implements [Assignment: organization-defined fail-safe procedures] to protect its memory from unauthorized code execution.

|SI-16|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter SI-16-1:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|SI-16 What is the solution and how is it implemented?|
|---|
||


Question: Access Control (AC)


Question: AC-1 Access Control Policy and Procedures Requirements (L) (M)

Answer:
The organization:

Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]:

An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the access control policy and associated access controls; and

Reviews and updates the current:

Access control policy [FedRAMP Assignment: at least every 3 years]; and

Access control procedures [FedRAMP Assignment: at least annually].

|AC-1|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-1(a):
|Parameter AC-1(b)(1):
|Parameter AC-1(b)(2):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)

|AC-1 What is the solution and how is it implemented?|
|---|
|Part a|
|Part b1|
|Part b2|

#


Question: AC-2 Account Management (L) (M)

Answer:
The organization:

Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

Assigns account managers for information system accounts;

Establishes conditions for group and role membership;

Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

Monitors the use of information system accounts;

Notifies account managers:

When accounts are no longer required;

When users are terminated or transferred; and

When individual information system usage or need-to-know changes;

Authorizes access to the information system based on:

A valid access authorization;

Intended system usage; and

Other attributes as required by the organization or associated missions/business functions;

Reviews accounts for compliance with account management requirements [FedRAMP Assignment: at least annually]; and

Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.

|AC-2|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(a):
|Parameter AC-2(e):
|Parameter AC-2(f):
|Parameter AC-2(j):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c
|Part d
|Part e
|Part f
|Part g
|Part h
|Part i
|Part j
|Part k

#


Question: AC-2 (1) Control Enhancement (M) (H)

Answer:
The organization employs automated mechanisms to support the management of information system accounts.

|AC-2 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (2) Control Enhancement (M)

Answer:
The information system automatically [Selection: removes; disables] temporary and emergency accounts after [FedRAMP Assignment: no more than 30 days for temporary and emergency account types].

|AC-2 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(2)1:
|Parameter AC-2(2)2:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (3) Control Enhancement (M)

Answer:
The information system automatically disables inactive accounts after [FedRAMP Assignment: ninety (90) days for user accounts].

AC-2 (3) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices).  The time periods are approved and accepted by the Joint Authorization Board (JAB)/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available.

|AC-2 (3)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(3):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (3) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (4) Control Enhancement (M)

Answer:
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].

|AC-2 (4)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(4):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (4) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (5) Control Enhancement (M)

Answer:
The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].

AC-2 (5) Additional FedRAMP Requirements and Guidance:

Guidance: Should use a shorter timeframe than AC-12

|AC-2 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(5):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (7) Control Enhancement (M)

Answer:
The organization:

Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;

Monitors privileged role assignments; and

Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.

|AC-2 (7)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(7):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (7) What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c

#


Question: AC-2 (9) Control Enhancement (M)

Answer:
The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts].

AC-2 (9) Additional FedRAMP Requirements and Guidance: Required if shared/group accounts are deployed.

|AC-2 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(9):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (9) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (10) Control Enhancement (M) (H)

Answer:
The information system terminates shared/group account credentials when members leave the group.

AC-2 (10) Additional FedRAMP Requirements and Guidance:

Required if shared/group accounts are deployed.

|AC-2 (10)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(10):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (10) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-2 (12) Control Enhancement (M)

Answer:
The organization:

Monitors information system accounts for [Assignment: organization-defined atypical use]; and

Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].

AC-2 (12) (a) and AC-2 (12) (b) Additional FedRAMP Requirements and Guidance: Required for privileged accounts.

|AC-2 (12)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-2(12)(a):
|Parameter AC-2(12)(b):
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-2 (12) What is the solution and how is it implemented?|
|---|
|Part a
|Part b


Question: AC-3 Access Enforcement (L) (M) (H)

Answer:
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

|AC-3|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-3 What is the solution and how is it implemented?|
|---|
|Part a


Question: AC-4 Information Flow Enforcement (M) (H)

Answer:
The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].

|AC-4|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-4
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-4 What is the solution and how is it implemented?|
|---|
||

#


Question: AC-4 (21) Control Enhancement (M) (H)

Answer:
The information system separates information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].

|AC-4 (21)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-4(21)-1
|Parameter AC-4(21)-2
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-4 What is the solution and how is it implemented?|
|---|
||


Question: AC-5 Separation of Duties (M) (H)

Answer:
The organization:

Separates [Assignment: organization-defined duties of individuals];

Documents separation of duties of individuals; and

Defines information system access authorizations to support separation of duties.

AC-5 Additional FedRAMP Requirements and Guidance:

Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP.  Directions for attaching the Separation of Duties Matrix document may be found in Section Error: Reference source not found Error: Reference source not found.

|AC-5|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-5(a)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-5 What is the solution and how is it implemented?|
|---|
|Part a
|Part b
|Part c


Question: AC-6 Least Privilege (M) (H)

Answer:
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

|AC-6|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (1) Control Enhancement (M)

Answer:
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].

|AC-6 (1)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(1)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (1) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (2) Control Enhancement (M) (H)

Answer:
The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing non-security functions.

AC-6 (2) Additional FedRAMP Requirements and Guidance:

Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.

|AC-6 (2)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(2)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (2) What is the solution and how is it implemented?|
|---|
||

#


Question: AC 6 (5) Control Enhancement (M) (H)

Answer:
The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].

|AC-6 (5)|Control Summary Information|
|---|---|
|Responsible Role:
|Parameter AC-6(5)
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (5) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (9) Control Enhancement (M) (H)

Answer:
The information system audits the execution of privileged functions.

|AC-6 (9)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (9) What is the solution and how is it implemented?|
|---|
||

#


Question: AC-6 (10) Control Enhancement (M) (H)

Answer:
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

|AC-6 (10)|Control Summary Information|
|---|---|
|Responsible Role:
|Implementation Status (check all that apply):|☐ Implemented
☐ Partially implemented
☐ Planned
☐ Alternative implementation
☐ Not applicable
|Control Origination (check all that apply):|☐ Service Provider Corporate
☐ Service Provider System Specific
☐ Service Provider Hybrid (Corporate and System Specific)
☐ Configured by Customer (Customer System Specific)
☐ Provided by Customer (Customer System Specific)
☐ Shared (Service Provider and Customer Responsibility)
☐ Inherited from pre-existing FedRAMP Authorization for _insert text here_.

|AC-6 (10) What is the solution and how is it implemented?|
|---|
||