rkreddyp/nist_800_53 huggingface dataset:
AC-7 Unsuccessful Login Attempts (L) (M)
The organization:

Enforces a limit of [FedRAMP Assignment: not more than three (3)] consecutive invalid logon attempts by a user during a [FedRAMP Assignment: fifteen (15) minutes]; and

Automatically [Selection: locks the account/node for a [FedRAMP Assignment: thirty (30) minutes]; delays next logon prompt according to [Assignment: organization-defined delay algorithm]] when the maximum number of unsuccessful attempts is exceeded.
Responsible Role:
|Parameter AC-7(a)-1:
|Parameter AC-7(a)-2:
|Parameter AC-7(b)-1:
|Parameter AC-7(b)-2:

|AC-7 What is the solution and how is it implemented?|
AC-10 Concurrent Session Control (M) (H)
The information system limits the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [FedRAMP Assignment: three (3) sessions for privileged access and two (2) sessions for non-privileged access].
Responsible Role:
|Parameter AC-10-1:
|Parameter AC-10-2:

|AC-10 What is the solution and how is it implemented?|
AC-11 Session Lock (M) (H)
The information system:

Prevents further access to the system by initiating a session lock after [FedRAMP Assignment: fifteen (15) minutes] of inactivity or upon receiving a request from a user; and

Retains the session lock until the user reestablishes access using established identification and authentication procedures.
Responsible Role:
|Parameter AC-11(a)

|AC-11 What is the solution and how is it implemented?|
#
AC-11 (1) Control Enhancement (M) (H)
The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.
Responsible Role:
|Parameter AC-11(a)

|AC-11 (1) What is the solution and how is it implemented?|
AC-12 Session Termination (M) (H)
The information system automatically terminates a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect].
Responsible Role:
|Parameter AC-12:

|AC-12 What is the solution and how is it implemented?|
AC-14 Permitted Actions without Identification or Authentication (L) (M) (H)
The organization:

Identifies [Assignment: organization-defined user actions] that can be performed on the information system without identification or authentication consistent with organizational missions/business functions; and

Documents and provides supporting rationale in the security plan for the information system, user actions not requiring identification or authentication.
Responsible Role:
|Parameter AC-12:

|AC-14 What is the solution and how is it implemented?|
AC-17 Remote Access (L) (M) (H)
The organization:

Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and

Authorizes remote access to the information system prior to allowing such connections.
Responsible Role:
|Parameter AC-17:

|AC-17 What is the solution and how is it implemented?|
#
AC-17 (1) Control Enhancement (M) (H)
The information system monitors and controls remote access methods.
Responsible Role:
|Parameter AC-17 (1):

|AC-17 (1) What is the solution and how is it implemented?|
#
AC-17 (2) Control Enhancement (M) (H)
The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Responsible Role:
|Parameter AC-17 (2):

|AC-17 (2) What is the solution and how is it implemented?|
#
AC-17 (3) Control Enhancement (M) (H)
The information system routes all remote accesses through [Assignment: organization-defined number] managed network access control points.
Responsible Role:
|Parameter AC-17(3):

|AC-17 (3) What is the solution and how is it implemented?|
#
AC-17 (4) Control Enhancement (M) (H)
The organization:

Authorizes the execution of privileged commands and access to security-relevant information via remote access only for [Assignment: organization-defined needs]; and

Documents the rationale for such access in the security plan for the information system.
Responsible Role:
|Parameter AC-17(4)(a):

|AC-17 (4) What is the solution and how is it implemented?|
#
AC-17 (9) Control Enhancement (M) (H)
The organization provides the capability to expeditiously disconnect or disable remote access to the information system within [FedRAMP Assignment: fifteen (15) minutes].
Responsible Role:
|Parameter AC-17(9):

|AC-17 (9) What is the solution and how is it implemented?|
AC-18 Wireless Access Restrictions (L) (M) (H)
The organization:

Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and

Authorizes wireless access to the information system prior to allowing such connections.
Responsible Role:
|Parameter AC-18:

|AC-18 What is the solution and how is it implemented?|
#
AC-18 (1) Control Enhancement (M) (H)
The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
Responsible Role:
|Parameter AC-18 (1):

|AC-18 (1) What is the solution and how is it implemented?|
AC-19 Access Control for Portable and Mobile Systems (L) (M) (H)
The organization:

Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and

Authorizes the connection of mobile devices to organizational information systems.
Responsible Role:

|AC-19 What is the solution and how is it implemented?|
#
AC-19 (5) Control Enhancement (M) (H)
The organization employs [Selection: full-device encryption; container encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].
Responsible Role:
|Parameter AC-19(5)-1:
|Parameter AC-19(5)-2:

|AC-19 (5) What is the solution and how is it implemented?|
AC-20 Use of External Information Systems (L) (M) (H)
The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to:

Access the information system from external information systems; and

Process, store, or transmit organization-controlled information using external information systems.
Responsible Role:

|AC-20 What is the solution and how is it implemented?|
#
AC-20 (1) Control Enhancement (M) (H)
The organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

Verifies the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or

Retains approved information system connection or processing agreements with the organizational entity hosting the external information system.
Responsible Role:

|AC-20 (1) What is the solution and how is it implemented?|
#
AC-20 (2) Control Enhancement (M) (H)
The organization [Selection: restricts; prohibits] the use of organization-controlled portable storage devices by authorized individuals on external information systems.
Responsible Role:
|Parameter AC-20(2):

|AC-20 (2) What is the solution and how is it implemented?|
AC-21 Information Sharing (M) (H)
The organization:

Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [Assignment: organization-defined information sharing circumstances where user discretion is required]; and

Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.
Responsible Role:
|Parameter AC-21(a):
|Parameter AC-21(b):

|AC-21 What is the solution and how is it implemented?|
AC-22 Publicly Accessible Content (L) (M) (H)
The organization:

Designates individuals authorized to post information onto a publicly accessible information system;

Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and

Reviews the content on the publicly accessible information system for nonpublic information [FedRAMP Assignment: at least quarterly] and removes such information, if discovered.
Responsible Role:
|Parameter AC-22

|AC-22 What is the solution and how is it implemented?|
---
title: Awareness and Training (AT)
---
Awareness and Training (AT)
#
AT-1 Security Awareness and Training Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and

Reviews and updates the current:

Security awareness and training policy [FedRAMP Assignment: at least every 3 years]; and

Security awareness and training procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter AT-1(a):
|Parameter AT-1(b)(1):
|Parameter AT-1(b)(2):

|AT-1 What is the solution and how is it implemented?|
Part a:
|Part b1:
|Part b2:

#
AT-2 Security Awareness (L) (M) (H)
The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

As part of initial training for new users;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.
Responsible Role:
|Parameter AT-2(c):

|AT-2 What is the solution and how is it implemented?|
Part a:
|Part b1:
|Part b2:

#
AT-2 (2) Control Enhancement (M) (H)
The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
Responsible Role:
|Parameter AT-2(c):

|AT-2 (2) What is the solution and how is it implemented?|
Part a:

#
AT-3 Role-Based Security Training (L) (M) (H)
The organization provides role-based security training to personnel with assigned security roles and responsibilities:

Before authorizing access to the information system or performing assigned duties;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.
Responsible Role:
|Parameter AT-3(c):

|AT-3 What is the solution and how is it implemented?|
Part a:
|Part b:
|Part c:

#
AT-4 Security Training Records (L) (M)
The organization:

Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Retains individual training records for [FedRAMP Assignment: at least one year].
Responsible Role:
|Parameter AT-4(b)(c):

|AT-4 What is the solution and how is it implemented?|
Part a:
|Part b:
---
title: Audit and Accountability (AU)
---
Audit and Accountability (AU)
#
AU-1 Audit and Accountability Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An audit and accountability policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls; and

Reviews and updates the current:

Audit and accountability policy [FedRAMP Assignment: at every 3 years]; and

Audit and accountability procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(b)(1):
|Parameter AU-1(b)(2):

|AU-1 What is the solution and how is it implemented?|
#
AU-2 Audit Events (L) (M) (H)
The organization:

Determines that the information system is capable of auditing the following events: [FedRAMP Assignment: [Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes];

Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events

Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and

Determines that the following events are to be audited within the information system: [FedRAMP Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited continually for each identified event].

AU-2 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.
Responsible Role:
|Parameter AU-1(a):
|Parameter AU-1(d):

|AU-2 What is the solution and how is it implemented?|
#
AU-2 (3) Control Enhancement (M) (H)
The organization reviews and updates the audited events [FedRAMP Assignment: annually or whenever there is a change in the threat environment].

AU-2 (3) Additional FedRAMP Requirements and Guidance:
Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO.
Responsible Role:
|Parameter AU-2(3):

|AU-2 (3) What is the solution and how is it implemented?|
#
AU-3 Content of Audit Records (L) (M) (H)
The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.
Responsible Role:
|Parameter AU-3:

|AU-3 What is the solution and how is it implemented?|
#
AU-3 (1) Control Enhancement (M)
The information system generates audit records containing the following additional information: [Assignment: organization-defined additional, more detailed information].

AU-3 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines audit record types [FedRAMP Assignment: session, connection, transaction, or activity duration; for client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon]. The audit record types are approved and accepted by the JAB.

Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.
Responsible Role:
|Parameter AU-3(1):

|AU-3 (1) What is the solution and how is it implemented?|
#
AU-4 Audit Storage Capacity (L) (M) (H)
The organization allocates audit record storage capacity in accordance with [Assignment: organization-defined audit record storage requirements].
Responsible Role:
|Parameter AU-4:

|AU-4 What is the solution and how is it implemented?|
#
AU-5 Response to Audit Processing Failures (L) (M) (H)
The information system:

Alerts [Assignment: organization-defined personnel or roles] in the event of an audit processing failure; and

Takes the following additional actions: [FedRAMP Assignment: organization-defined actions to be taken; (overwrite oldest record)].
Responsible Role:
|Parameter AU-5(a):
|Parameter AU-5(b):

|AU-5 What is the solution and how is it implemented?|
#
AU-6 Audit Review, Analysis, and Reporting (L) (M) (H)
The organization:

Reviews and analyzes information system audit records [FedRAMP Assignment: at least weekly] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and

Reports findings to [Assignment: organization-defined personnel or roles].

AU-6 Additional FedRAMP Requirements and Guidance:

Requirement: Coordination between service provider and consumer shall be documented and accepted by the Authorizing Official. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.
Responsible Role:
|Parameter AU-6(a)-1:
|Parameter AU-6(a)-2:
|Parameter AU-6(b):

|AU-6 What is the solution and how is it implemented?|
#
AU-6 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities.
Responsible Role:

|AU-6 (1) What is the solution and how is it implemented?|
#
AU-6 (3) Control Enhancement (M) (H)
The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.
Responsible Role:

|AU-6 (3) What is the solution and how is it implemented?|
#
AU-7 Audit Reduction and Report Generation (M) (H)
The information system provides an audit reduction and report generation capability that:

Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

Does not alter the original content or time ordering of audit records.
Responsible Role:

|AU-7 What is the solution and how is it implemented?|
#
AU-7 (1) Control Enhancement (M) (H)
The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].
Responsible Role:
|Parameter AU-7(1):

|AU-7 (1) What is the solution and how is it implemented?|
#
AU-8 Time Stamps (L) (M) (H)
The information system:

Uses internal system clocks to generate time stamps for audit records; and

Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: one second granularity of time measurement].
Responsible Role:
|Parameter AU-8(b):

|AU-8 What is the solution and how is it implemented?|
#
AU-8 (1) Control Enhancement (M) (H)
The information system:

Compares the internal information system clocks with [FedRAMP Assignment: authoritative time source: [http://tf.nist.gov/tf-cgi/servers.cgi] [at least hourly]]; and

Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].

AU-8 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.

Requirement:< The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.

Guidance: The service provider selects primary and secondary time servers used by the NIST Internet time service, or by a Stratum-1 time server. The secondary server is selected from a different geographic region than the primary server.

If using Windows Active Directory, all servers should synchronize time with the time source for the Windows Domain Controller. If using some other directory services (e.g., LDAP), all servers should synchronize time with the time source for the directory server. Synchronization of system clocks improves the accuracy of log analysis.
Responsible Role:
|Parameter AU-8(1)(a)-1:
|Parameter AU-8(1)(a)-2:
|Parameter AU-8(1)(b):

|AU-8 (1) What is the solution and how is it implemented?|
#
AU-9 Protection of Audit Information (L) (M) (H)
The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
Responsible Role:

|AU-9 What is the solution and how is it implemented?|
#
AU-9 (2) Control Enhancement (M) (H)
The information system backs up audit records [FedRAMP Assignment: at least weekly] onto a physically different system or system component than the system or component being audited.
Responsible Role:
|Parameter AU-9(2):

|AU-9 (2) What is the solution and how is it implemented?|
#
AU-9 (4) Control Enhancement (M) (H)
The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users].
Responsible Role:
|Parameter AU-9(4):

|AU-9 (4) What is the solution and how is it implemented?|
#
AU-11 Audit Record Retention (M)
The organization retains audit records for [FedRAMP Assignment: at least ninety (90) days] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

AU-11 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements
Responsible Role:
|Parameter AU-11:

|AU-11 What is the solution and how is it implemented?|
#
AU-12 Audit Generation (L) (M) (H)
The information system:

Provides audit record generation capability for the auditable events defined in AU-2 a. at [FedRAMP Assignment: all information system components where audit capability is deployed/available];

Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Responsible Role:
|Parameter AU-12(a):
|Parameter AU-12(b):

|AU-12 What is the solution and how is it implemented?|
---
title: Security Assessment and Authorization (CA)
---
CA-9 Internal System Connections (L) (M) (H)
The organization:

Authorizes internal connections of [Assignment: organization-defined information system components or classes of components] to the information system; and

Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.
Responsible Role:
|Parameter CA-9(a):

|CA-9 What is the solution and how is it implemented?|
---
title: Configuration Management (CM)
---
Configuration Management (CM)
#
CM-1 Configuration Management Policies and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and

Reviews and updates the current:

Configuration management policy [FedRAMP Assignment: at least every three (3) years]; and

Configuration management procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter CM-1(a):
|Parameter CM-1(b)(1):
|Parameter CM-1(b)(2):

|CM-1 What is the solution and how is it implemented?|
#
CM-2 Baseline Configuration (L) (M) (H)
The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
Responsible Role:

|CM-2 What is the solution and how is it implemented?|
#
CM-2 (1) Control Enhancement (M)
The organization reviews and updates the baseline configuration of the information system:

[FedRAMP Assignment: at least annually];

When required due to [FedRAMP Assignment: to include when directed by the JAB]; and

As an integral part of information system component installations and upgrades.
Responsible Role:
|Parameter CM-2(1)(a):
|Parameter CM-2(1)(b):

|CM-2 (1) What is the solution and how is it implemented?|
#
CM-2 (2) Control Enhancement (M) (H)
The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.
Responsible Role:

|CM-2 (2) What is the solution and how is it implemented?|
#
CM-2 (3) Control Enhancement (M)
The organization retains [Assignment: organization-defined previous versions of baseline configurations of the information system] to support rollback.
Responsible Role:
|Parameter CM-2(3):

|CM-2 (3) What is the solution and how is it implemented?|
#
CM-2 (7) Control Enhancement (M) (H)
The organization:

Issues [Assignment: organization-defined information systems, system components, or devices] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and

Applies [Assignment: organization-defined security safeguards] to the devices when the individuals return.
Responsible Role:
|Parameter CM-2(7)(a)-1:
|Parameter CM-2(7)(a)-2:
|Parameter CM-2(7)(b):

|CM-2 (7) What is the solution and how is it implemented?|
#
CM-3 Configuration Change Control (M) (H)
The organization:

(a) Determines the types of changes to the information system that are configuration-controlled;

Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

Documents configuration change decisions associated with the information system;

Implements approved configuration-controlled changes to the information system;

Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period];

CM-3 (e) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with record retention policies and procedures.
Audits and reviews activities associated with configuration-controlled changes to the information system; and

Coordinates and provides oversight for configuration change control activities through [FedRAMP Assignment: see additional FedRAMP requirements and guidance] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].

CM-3 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the JAB/AO.
Responsible Role:
|Parameter CM-3(e):
|Parameter CM-3(g)-1:
|Parameter CM-3(g)-2:
|Parameter CM-3(g)-3:

|CM-3 What is the solution and how is it implemented?|
#
CM-4 Security Impact Analysis (L) (M) (H)
The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
Responsible Role:

|CM-4 What is the solution and how is it implemented?|
#
CM-5 Access Restrictions for Change (M) (H)
The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
Responsible Role:

|CM-5 What is the solution and how is it implemented?|
#
CM-5 (1) Control Enhancement (M) (H)
The information system enforces access restrictions and supports auditing of the enforcement actions.
Responsible Role:

|CM-5 (1) What is the solution and how is it implemented?|
#
CM-5 (3) Control Enhancement (M) (H)
The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

CM-5 (3) Additional FedRAMP Requirements and Guidance:

Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be used.
Responsible Role:
|Parameter CM-5(3):

|CM-5 (3) What is the solution and how is it implemented?|
#
CM-5 (5) Control Enhancement (M) (H)
The organization:

Limits privileges to change information system components and system-related information within a production or operational environment; and

Reviews and reevaluates privileges [FedRAMP Assignment: at least quarterly].
Responsible Role:
|Parameter CM-5(5):

|CM-5 (5) What is the solution and how is it implemented?|
#
CM-6 Configuration Settings (L) (M) (H)
The organization:

Establishes and documents configuration settings for information technology products employed within the information system using [FedRAMP Assignment: see CM-6(a) Additional FedRAMP Requirements and Guidance] that reflect the most restrictive mode consistent with operational requirements;

CM-6(a) Additional FedRAMP Requirements and Guidance:

Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) (http://scap.nist.gov/) validated or SCAP compatible (if validated checklists are not available).

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline.

Implements the configuration settings;

Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
Responsible Role:
|Parameter CM-6(a)-1:
|Parameter CM-6(a)-2:
|Parameter CM-6(c)-1:
|Parameter CM-6(c)-2:

|CM-6 What is the solution and how is it implemented?|
#
CM-6 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components].
Responsible Role:
|Parameter CM-6(1):

|CM-6 What is the solution and how is it implemented?|
#
CM-7 Least Functionality (L) (M) (H)
The organization:

Configures the information system to provide only essential capabilities; and

Prohibits or restricts the use of the following functions, ports, protocols, and/or services [FedRAMP Assignment: United States Government Configuration Baseline (USGCB)]

CM-7 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. If no recognized USGCB is available for the technology in use, the CSP should create their own baseline and include a justification statement as to how they came up with the baseline configuration settings.

Guidance: Information on the USGCB checklists can be found at: https://csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline
Partially derived from AC-17 (8).
Responsible Role:
|Parameter CM-7:

|CM-7 What is the solution and how is it implemented?|
#
CM-7 (1) Control Enhancement (M) (H)
The organization:

Reviews the information system [FedRAMP Assignment: at least Monthly] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and

Disables [Assignment: organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure].
Responsible Role:
|Parameter CM-7(1)(a):
|Parameter CM-7(1)(b):

|CM-7 (1) What is the solution and how is it implemented?|
#
CM-7 (2) Control Enhancement (M) (H)
The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].

CM-7 (2) Additional FedRAMP Requirements and Guidance:

Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run.
Responsible Role:
|Parameter CM-7(2):

|CM-7 (2) What is the solution and how is it implemented?|
#
CM-7 (5) Control Enhancement (M)
The organization:

Identifies [Assignment: organization-defined software programs authorized to execute on the information system];

Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and

Reviews and updates the list of authorized software programs [FedRAMP Assignment: at least annually or when there is a change].
Responsible Role:
|Parameter CM-7(5)(a):
|Parameter CM-7(5)(c):

|CM-7 (5) What is the solution and how is it implemented?|
#
CM-8 Information System Component Inventory (L) (M) (H)
The organization:

Develops and documents an inventory of information system components that:

Accurately reflects the current information system;

Includes all components within the authorization boundary of the information system;

Is at the level of granularity deemed necessary for tracking and reporting; and

Includes [Assignment: organization-defined information deemed necessary to achieve effective information system component accountability]; and

Reviews and updates the information system component inventory [FedRAMP Assignment: at least monthly].

CM-8 Additional FedRAMP Requirements and Guidance:

Requirement: Must be provided at least monthly or when there is a change.
Responsible Role:
|Parameter CM-8(a)(4):
|Parameter CM-8(b):

|CM-8 What is the solution and how is it implemented?|
#
CM-8 (1) Control Enhancement (M) (H)
The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

Instruction: A description of the inventory information is documented in Section 10. It is not necessary to re-document it here.

Delete this and all other instructions from your final version of this document.
Responsible Role:

|CM-8 (1) What is the solution and how is it implemented?|
#
CM-8 (3) Control Enhancement (M) (H)
The organization:

Employs automated mechanisms [FedRAMP Assignment: Continuously, using automated mechanisms with a maximum five-minute delay in detection] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and

Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies [Assignment: organization-defined personnel or roles]].
Responsible Role:

|CM-8 (3) What is the solution and how is it implemented?|
#
CM-8 (5) Control Enhancement (M) (H)
The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories.
Responsible Role:

|CM-8 (5) What is the solution and how is it implemented?|
#
CM-9 Configuration Management Plan (M) (H)
The organization develops, documents, and implements a configuration management plan for the information system that:

Addresses roles, responsibilities, and configuration management processes and procedures;

Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

Defines the configuration items for the information system and places the configuration items under configuration management; and

Protects the configuration management plan for unauthorized disclosure and modification.
Responsible Role:

|CM-9 What is the solution and how is it implemented?|
#
CM-10 Software Usage Restrictions (L) (M) (H)
The organization:

Uses software and associated documentation in accordance with contract agreements and copyright laws;

Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
Responsible Role:

|CM-10 What is the solution and how is it implemented?|
#
CM-10 (1) Control Enhancement (M) (H)
The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions].
Responsible Role:
|Parameter CM-10(1):

|CM-10 What is the solution and how is it implemented?|
#
CM-11 User-Installed Software (M) (H)
The organization:

Establishes [Assignment: organization-defined policies] governing the installation of software by users;

Enforces software installation policies through [Assignment: organization-defined methods]; and

Monitors policy compliance [FedRAMP Assignment: Continuously (via CM-7 (5))].
Responsible Role:
|Parameter CM-11(a):
|Parameter CM-11(b):
|Parameter CM-11(c):

|CM-11 What is the solution and how is it implemented?|
---
title: Contingency Planning (CP)
---
Contingency Planning (CP)
#
CP-1 Contingency Planning Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls; and

Reviews and updates the current:

Contingency planning policy [FedRAMP Assignment: at least every three (3) years].; and

Contingency planning procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter CP-1(a):
|Parameter CP-1(b)(1):
|Parameter CP-1(b)(2):

|CP-1 What is the solution and how is it implemented?|
#
CP-2 Contingency Plan (L) (M) (H)
The organization:

Develops a contingency plan for the information system that:

Identifies essential missions and business functions and associated contingency requirements;

Provides recovery objectives, restoration priorities, and metrics;

Addresses contingency roles, responsibilities, assigned individuals with contact information;

Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure;

Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements];

Coordinates contingency planning activities with incident handling activities;

Reviews the contingency plan for the information system [FedRAMP Assignment: at least annually];

Updates the contingency plan to address changes to the organization, information system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing;

Communicates contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; and

Protects the contingency plan from unauthorized disclosure and modification.

CP-2 Additional FedRAMP Requirements and Guidance:

Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.
Responsible Role
|Parameter CP-2(a)(6):
|Parameter CP-2(b):
|Parameter CP-2(d):
|Parameter CP-2(f):

|CP-2 What is the solution and how is it implemented?|
#
CP-2 (1) Control Enhancement (M) (H)
The organization coordinates contingency plan development with organizational elements responsible for related plans.
Responsible Role

#
CP-2 (2) Control Enhancement (M) (H)
The organization conducts capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.
Responsible Role:

#
CP-2 (3) Control Enhancement (M) (H)
The organization plans for the resumption of essential missions and business functions within [Assignment: organization-defined time period] of contingency plan activation.
Responsible Role:
|Parameter CP-2(3):

#
CP-2 (8) Control Enhancement (M) (H)
The organization identifies critical information system assets supporting essential missions and business functions.
Responsible Role:

|CP-2 (8) What is the solution and how is it implemented?|
#
CP-3 Contingency Training (L) (M) (H)
The organization provides contingency training to information system users consistent with assigned roles and responsibilities:

Within [FedRAMP Assignment: ten (10) days] of assuming a contingency role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.
Responsible Role:
|Parameter CP-3(a):
|Parameter CP-3(c):

|CP-3 What is the solution and how is it implemented?|
#
CP-4 Contingency Plan Testing (M)
The organization:

Tests the contingency plan for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: functional exercises] to determine the effectiveness of the plan and the organizational readiness to execute the plan;

CP-4(a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended) and provides plans to FedRAMP prior to initiating testing. Test plans are approved and accepted by the JAB/AO prior to initiating testing.
Reviews the contingency plan test results; and

Initiates corrective actions, if needed.
Responsible Role:

|CP-4 What is the solution and how is it implemented?|
#
CP-4 (1) Control Enhancement (M) (H)
The organization coordinates contingency plan testing and/or exercises with organizational elements responsible for related plans.
Responsible Role:

|CP-4 (1) What is the solution and how is it implemented?|
#
CP-6 Alternate Storage Site (M) (H)
The organization:

Establishes an alternate storage site including necessary agreements to permit the storage and retrieval of information system backup information; and

Ensures that the alternate storage site provides information security safeguards equivalent to that of the primary site.
Responsible Role:

|CP-6 What is the solution and how is it implemented?|
#
CP-6 (1) Control Enhancement (M) (H)
The organization identifies an alternate storage site that is separated from the primary storage site to reduce susceptibility to the same threats.
Responsible Role:

|CP-6 (1) What is the solution and how is it implemented?|
#
CP-6 (3) Control Enhancement (M) (H)
The organization identifies potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
Responsible Role:

|CP-6 (3) What is the solution and how is it implemented?|
#
CP-7 Alternate Processing Site (M) (H)
The organization:

Establishes an alternate processing site including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined information system operations] for essential missions/business functions within [FedRAMP Assignment: see additional FedRAMP requirements and guidance] when the primary processing capabilities are unavailable;

CP-7a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
Ensures that equipment and supplies required to transfer and resume operations are available at the alternate processing site or contracts are in place to support delivery to the site within the organization-defined time period for transfer/resumption; and

Ensures that the alternate processing site provides information security safeguards equivalent to that of the primary site.
Responsible Role:
|Parameter CP-7(a)-2:

|CP-7 What is the solution and how is it implemented?|
#
CP-7 (1) Control Enhancement (M) (H)
The organization identifies an alternate processing site that is separated from the primary processing site to reduce susceptibility to the same threats.

CP-7 (1) Additional FedRAMP Requirements and Guidance

Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber-attack), the degree of separation between sites will be less relevant.
Responsible Role:

|CP-7 (1) What is the solution and how is it implemented?|
#
CP-7 (2) Control Enhancement (M) (H)
The organization identifies potential accessibility problems to the alternate processing site in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.
Responsible Role:

|CP-7 (2) What is the solution and how is it implemented?|
#
CP-7 (3) Control Enhancement (M) (H)
The organization develops alternate processing site agreements that contain priority-of-service provisions in accordance with organizational availability requirements (including recovery time objectives).
Responsible Role:

|CP-7 (3) What is the solution and how is it implemented?|
#
CP-8 Telecommunications Services (M) (H)
The organization establishes alternate telecommunications services including necessary agreements to permit the resumption of [Assignment: organization-defined information system operations] for essential missions and business functions within [FedRAMP Assignment: See CP-8 additional FedRAMP requirements and guidance] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites.

CP-8 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
Responsible Role:
|Parameter CP-8-1:
|Parameter CP-8-2:

|CP-8 What is the solution and how is it implemented?|
1. CP-8 (1) Control Enhancement (M) (H)
The organization:

Develops primary and alternate telecommunications service agreements that contain priority- of-service provisions in accordance with organizational availability requirements (including recovery time objectives); and

Requests Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness in the event that the primary and/or alternate telecommunications services are provided by a common carrier.
Responsible Role:

|CP-8 (1) What is the solution and how is it implemented?|
#
CP-8 (2) Control Enhancement (M) (H)
The organization obtains alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.
Responsible Role:

|CP-8 (2) What is the solution and how is it implemented?|
#