ArcGIS Online FedRAMP Moderate Customer Responsibility Matrix (CRM) Worksheet
Control ID
AC-3
AC-8 (a)Specific Inheritance and Customer Agency/CSP Responsibilities
Customers are responsible for managing access to their AGO Organization and for managing the AGO roles defined and any custom roles that are createdby that Customer. Customer is also responsible for providing a SAML 2.0 Identity Provider for identity integration with the application, according to theirpolicies and procedures to meet authentication requirements.
Customers are responsible for adhering to all organizational policies and procedures in regard to displaying their system use notification banner. AGO
allows customers to inject any banners or branding they might require at the application tierAC-8 (c)Customers are responsible for displaying system use information before granting further access to the publicly accessible resources in ArcGIS Online.
Display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit
those activities and including a description of the authorized uses of the system.
NOTE: If the customer has no publicly accessing resources in ArcGIS Online, then this control can be inherited from the CSP.

AC-14 (a)Customer is responsible for identifying actions that can be performed on the customer-deployed resources without identification or authentication (e.g.,such as viewing a publicly accessible services or apps or form).

AC-14 (b)Customer is responsible for providing documentation for user actions not requiring identification or authentication in the customer organization. It is theresponsibility of the customer to follow their own Rules of Behavior and policies around inviting and sharing to guests to application.

AC-21 (b)AC-22 (a)AC-22 (b)AC-22 (d)AT-2 (a)The customer is responsible for employing a process to assist users with making information sharing decisions
Customer is responsible for designating authorized personnel to post publicly accessible information in their AGO application.
Customer is responsible for training the personnel defined in AC-21. a to prevent disclosure of nonpublic customer-controlled information.
Customer is responsible for reviewing proposed content of customer-controlled information prior to posting publicly to ensure nonpublic information isnot included.
Customer is responsible for periodically reviewing publicly available customer-controlled content for nonpublic information.
Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-2 (b)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-2 (c)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-2 (d)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-2(2)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-2(3)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-3 (a)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-3 (b)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.

AT-3 (c)AT-4 (a)AT-4 (b)CA-6 (a)CA-6 (c)CA-6 (d)Customer is responsible providing training for their users, training may be developed using the AGO user guide and other online documentations.
Customer is responsible for retaining the training records for their users.
Customer is responsible for retaining the training records for their users.
Sponsoring agency must identify a senior-level executive or manager as the authorizing official for the AGO.
Agency must also determine whether the risk to the agency is acceptable. Following review of the security authorization package and discussing withagency officials and Independent Assessor/3PAO, the AO renders an authorization.
Authorizing official for the system, are responsible for ensuring authorization before commencing operations
Authorizing official is responsible for ensuring that for common controls for inheritance by organizational systems are authorizedCA-6 (e)Authorizing official agency is responsible for updating the authorizaiton in accordance with OMB A-130 requirements or when a significant change occurs

AC-22 (c)CA-6 (b)CP-9 (a)CP-9 (d)CP-9(1)
IA-2
IA-2(1)
IA-2(2)
IA-2(5)IA-2(8)IA-2(12)
IA-3
IA-5 (a)IA-5 (b)IA-5 (c)IA-5 (d)IA-5 (e)Customer is responsible for conducting backups of user-level information in customer-deployed resources at a frequency consistent with customerdefined RTOs and RPOs.
Customer is responsible for protecting the confidentiality, integrity, and availability of backup information they backed up.
Customer is responsible for backing up customer data and applications they developed. Customer is also responsible for testing those backups.
Customer is responsible for providing a SAML 2.0 configuration to federate their ArcGIS Online organization with their agency identity provider forauthentication.
Customers are responsible for MFA implementation against their Identity provide for integration with AGO.
AGO supports any SAML 2.0 compatible Identity Provider via Organization-specific logins.
Customer or agency is responsible for implementing multifactor user accounts for their ArcGIS Online application users using any SAML 2.0 compliant
identity provider
Customer is responsible for requiring individuals using group authenticators to first authenticate using individual authenticators
Customer is responsible for accepting and electronically verifying Federal Identify, Credential and Access Management-FICAM approved third-party
credentials
Customers using any SAML 2.0 compliant Identify provider (IdP) are responsible for accepting and electronically verifying Personal Identity Verification(PIV) credentials for customer users
Customers are required to ensure their information systems uniquely identify and authenticate approved device types prior to establishing a connection
with AGO
Customer is responsible for provisioning and managing their users and authenticators in accordance with their organization’s security requirements or per
FedRAMP guidance.
Customers using identity federation, are responsible for federal/customer user authenticator content.
Customers using identity federation, are responsible for federal/customer user authenticator content and password strength.
Customers using identity federation, are responsible for federal/customer user authenticator management and content.
Customer is responsible for managing their authenticators, including changing default content of authenticators prior to deployment.

800-53 Rev. 5

Version 3.7

Page 1 of 2

Control ID

IA-5 (h)Specific Inheritance and Customer Agency/CSP Responsibilities
Customer is responsible for managing their authenticators, including the establishment of minimum and maximum lifetime restrictions and reuseconditions for authenticators.
Customer is responsible for managing their authenticators, including changing and refreshing authenticators, and the corresponding time after which anupdate is required for each authenticator type.
Customer is responsible for managing and protecting their authenticator content from unauthorized disclosure and modification.

IA-5 (i)Customer is responsible for managing their authenticators, including implementing and specifying security safeguards to protect authenticators.

IA-5 (f)IA-5 (g)IA-5(2)IA-5(6)
IA-5(7)
IA-8
IA-8(1)
IA-8(2)
IA-8(4)
IA-11
IR-4 (a)IR-9 (a)IR-9 (b)IR-9 (c)IR-9(2)
SC-8
SC-13 (a)SC-13 (b)SR-8

Customer is responsible for managing their users and authenticators to align with their organization’s PKI implementation requirements or in accordancewith FedRAMP guidance
Customer is responsible for protecting authenticators commensurate with the security category of the information to which use of the authenticatorpermits access.
Customers are responsible for ensuring that they do not store authenticators for their organizational users in scripts or function keys or embed them inapplications.
Government customers are responsible for identifying and authenticating non-organizational users accessing the agency’s application
Government customers are responsible for supplying a SAML 2.0 compatible identity provider (IdP) that supports and accepts electronically verifying
Personal Identity Verification (PIV) credentials.
Government customers using SAML 2.0 compliant IdPs are responsible for ensuring it is configured to utilize external authenticators that are NIST
compliant and maintaining a list of accepted external authenticators.
Government customers are responsible for use of defined profiles conforming their organization’s requirements.
Customers configure SAML authentication in alignment with their organization-defined circumstances or situations requiring re-authentication
Government customers are responsible for subscribing to AGO information feeds to learn of incidents that may impact their operations. These feeds
include the ArcGIS Trust Center RSS feed, which is an automated method to be made aware of AGO issues and related guidance.
Government customers are responsible for responsible for developing policies and procedures for managing information spills resulting from actions
under the customer's direct control.
Government customers are responsible for responsible for developing policies and procedures to identify the specific information spilled as a result ofactions under the customer's direct control.
Government customers are responsible for responsible for developing policies and procedures for managing communication regarding information spills
resulting from actions under the customer's direct control.
Government customers are responsible for training personnel or roles per their information spillage policy using a method of communication notassociated with the spill.
Customers are responsible for ensuring that their client software is configured to only establish sessions using FIPS 140-2 compliant protocols.
Government customers are responsible for ensuring that their client software is configured to only establish sessions using FIPS 140-2 complianceprotocols. This can be accomplished by restricting access to the government customer’s internal network traffic.
Government customers are responsible for ensuring that their client software is configured to only establish sessions using FIPS 140-2 complianceprotocols.
Customers should subscribe to the RSS feed from the ArcGIS Trust Center

800-53 Rev. 5

Version 3.7

Page 2 of 2