rkreddyp/nist_800_53 huggingface dataset:
CA-3 (5) Control Enhancement (M)
The organization employs [Selection: allow-all, deny-by-exception, deny-all, permit by exception] policy for allowing [Assignment: organization-defined information systems] to connect to external information systems.

CA-3 (5) Additional FedRAMP Requirements and Guidance:

Guidance: For JAB Authorization, CSPs shall include details of this control in their architecture briefing.
Responsible Role:
|Parameter CA-3(5)-1:
|Parameter CA-3(5)-2:

|CA-3 (5) What is the solution and how is it implemented?|
#
CA-5 Plan of Action and Milestones (L) (M) (H)
The organization:

Develops a plan of action and milestones for the information system to document the organization’s planned remedial actions to correct weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system; and

Updates existing plan of action and milestones [FedRAMP Assignment: at least monthly] based on the findings from security controls assessments, security impact analyses, and continuous monitoring activities.

CA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Plan of Action & Milestones (POA&M) must be provided at least monthly.
Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Plan of Action and Milestones (POA&M) Template Completion Guide
https://www.FedRAMP.gov/documents/
Responsible Role:
|Parameter CA-5(b):

|CA-5 What is the solution and how is it implemented?|
#
CA-6 Security Authorization (L) (M) (H)
The organization:

Assigns a senior-level executive or manager as the authorizing official for the information system;

Ensures that the authorizing official authorizes the information system for processing before commencing operations; and

Updates the security authorization [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs].

CA-6c Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F (SP 800-37). The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
Responsible Role:
|Parameter CA-6(c):

|CA-6 What is the solution and how is it implemented?|
#
CA-7 Continuous Monitoring (L) (M) (H)
The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

Establishment of [Assignment: organization-defined metrics] to be monitored;

Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

Correlation and analysis of security-related information generated by assessments and monitoring;

Response actions to address results of the analysis of security-related information; and

Reporting the security status of organization and the information system to [FedRAMP Assignment: to meet Federal and FedRAMP requirements] [Assignment: organization-defined frequency].

CA-7 Additional FedRAMP Requirements and Guidance:

Requirement: Operating System Scans: at least monthly. Database and Web Application Scans: at least monthly. All scans performed by Independent Assessor: at least annually.

Guidance: CSPs must provide evidence of closure and remediation of a high vulnerability within the timeframe for standard POA&M updates.

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Continuous Monitoring Strategy Guide
https://www.fedramp.gov/documents/
Responsible Role:
|Parameter CA-7(a):
|Parameter CA-7(b)-1:
|Parameter CA-7(b)-2:
|Parameter CA-7(g)-1:
|Parameter CA-7(g)-2:

|CA-7 What is the solution and how is it implemented?|
CA-7 Additional FedRAMP Requirements and Guidance:

Requirement 1: Operating System Scans: at least monthly

Requirement 2: Database and Web Application Scans: at least monthly

Requirement 3: All scans performed by Independent Assessor: at least annually
Responsible Role:

|CA-7 What is the solution and how is it implemented?|
Req. 1|
|Req. 2|
|Req. 3|

#
CA-7 (1) Control Enhancement (M) (H)
The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to monitor the security controls in the information system on an ongoing basis.
Responsible Role:
|Parameter CA-7(1):

|CA-7 (1) What is the solution and how is it implemented?|
#
CA-8 Penetration Testing (M) (H)
The organization conducts penetration testing [FedRAMP Assignment: at least annually] on [Assignment: organization-defined information systems or system components].

CA-8 Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Penetration Test Guidance
https://www.fedramp.gov/documents/
Responsible Role:
|Parameter CA-8-1:
|Parameter CA-8-2:

|CA-8 What is the solution and how is it implemented?|
#
CA-8 (1) Control Enhancement (M) (H)
The organization employs an independent penetration agent or penetration team to perform penetration testing on the information system or system components.
Responsible Role:

|CA-8 (1) What is the solution and how is it implemented?|
#
CA-9 Internal System Connections (L) (M) (H)
The organization:

Authorizes internal connections of [Assignment: organization-defined information system components or classes of components] to the information system; and

Documents, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.
Responsible Role:
|Parameter CA-9(a):

|CA-9 What is the solution and how is it implemented?|
System and Communications Protection (SC)
#
SC-1 System and Communications Protection Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and communications protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls; and

Reviews and updates the current:

System and communications protection policy [FedRAMP Assignment: at least every three (3) years]; and

System and communications protection procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter SC-1(a):
|Parameter SC-1(b)(1):
|Parameter SC-1(b)(2):

|SC-1 What is the solution and how is it implemented?|
#
SC-2 Application Partitioning (M) (H)
The information system separates user functionality (including user interface services) from information system management functionality.
Responsible Role:

|SC-2 What is the solution and how is it implemented?|
#
SC-4 Information in Shared Resources (M) (H)
The information system prevents unauthorized and unintended information transfer via shared system resources.
Responsible Role:

|SC-4 What is the solution and how is it implemented?|
#
SC-5 Denial of Service Protection (L) (M) (H)
The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or reference to source for such information] by employing [Assignment: organization-defined security safeguards].
Responsible Role:
|Parameter SC-5-1:
|Parameter SC-5-2:

|SC-5 What is the solution and how is it implemented?|
#
SC-6 Resource Availability (M) (H)
The information system protects the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more); priority; quota; [Assignment: organization-defined security safeguards]].
Responsible Role:
|Parameter SC-6-1:
|Parameter SC-6-2:
|Parameter SC-6-3:

|SC-6 What is the solution and how is it implemented?|
#
SC-7 Boundary Protection (L) (M) (H)
The information system:

Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; and

Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and

Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with organizational security architecture.
Responsible Role:
|Parameter SC-7(b):

|SC-7 What is the solution and how is it implemented?|
Part c

#
SC-7 (3) Control Enhancement (M) (H)
The organization limits the number external network connections to the information system.
Responsible Role:

|SC-7 (3) What is the solution and how is it implemented?|
Part a

#
SC-7 (4) Control Enhancement (M)
The organization:

Implements a managed interface for each external telecommunication service;

Establishes a traffic flow policy for each managed interface;

Protects the confidentiality and integrity of the information being transmitted across each interface;

Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and

Reviews exceptions to the traffic flow policy [FedRAMP Assignment: at least at least annually] and removes exceptions that are no longer supported by an explicit mission/business need.
Responsible Role:
|Parameter SC-7(4)(e):

|SC-7 (4) What is the solution and how is it implemented?|
Part e

#
SC-7 (5) Control Enhancement (M) (H)
The information system at managed interfaces denies network traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
Responsible Role:

|SC-7 (5) What is the solution and how is it implemented?|
Part a

#
SC-7 (7) Control Enhancement (M) (H)
The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.
Responsible Role:

|SC-7 (7) What is the solution and how is it implemented?|
#
SC-7 (8) Control Enhancement (M) (H)
The information system routes [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
Responsible Role:
|Parameter SC-7(8)-1:
|Parameter SC-7(8)-2:

|SC-7 (8) What is the solution and how is it implemented?|
#
SC-7 (12) Control Enhancement (M)
The organization implements [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined information system components].
Responsible Role:
|Parameter SC-7(12)-1:
|Parameter SC-7(12)-2:

|SC-7 (12) What is the solution and how is it implemented?|
#
SC-7 (13) Control Enhancement (M)
The organization isolates [FedRAMP Assignment: See SC-7 (13) additional FedRAMP Requirements and Guidance] from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

SC-7 (13) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.
Responsible Role:
|Parameter SC-7(13):

|SC-7 (13) What is the solution and how is it implemented?|
#
SC-7 (18) Control Enhancement (M) (H)
The information system fails securely in the event of an operational failure of a boundary protection device.
Responsible Role:

|SC-7 (18) What is the solution and how is it implemented?|
#
SC-8 Transmission confidentiality and Integrity (M) (H)
The information system protects the [FedRAMP Assignment: confidentiality AND integrity] of transmitted information.
Responsible Role:

|SC-8 What is the solution and how is it implemented?|
#
SC-8 (1) Control Enhancement (M) (H)
The information system implements cryptographic mechanisms to [FedRAMP Assignment: prevent unauthorized disclosure of information AND detect changes to information] during transmission unless otherwise protected by [FedRAMP Assignment: a hardened or alarmed carrier Protective Distribution System (PDS)].
Responsible Role:
|Parameter SC-8 (1)-1:
|Parameter SC-8 (1)-2:

|SC-8 (1) What is the solution and how is it implemented?|
#
SC-10 Network Disconnect (M)
The information system terminates the network connection associated with a communications session at the end of the session or after [FedRAMP Assignment: no longer than thirty (30) minutes for RAS-based sessions and no longer than sixty (60) minutes for non-interactive user sessions] of inactivity.
Responsible Role:
|Parameter SC-10:

|SC-10 What is the solution and how is it implemented?|
#
SC-12 Cryptographic Key Establishment & Management (L) (M) (H)
The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

SC-12 Additional FedRAMP Requirements and Guidance:

Guidance: Federally approved and validated cryptography.
Responsible Role:
|Parameter SC-12:

|SC-12 What is the solution and how is it implemented?|
#
SC-12 (2) Control Enhancement (M) (H)
The organization produces, controls, and distributes symmetric cryptographic keys using [FedRAMP Selection: NIST FIPS-compliant] key management technology and processes.
Responsible Role:
|Parameter SC-12 (2):

|SC-12 (2) What is the solution and how is it implemented?|
#
SC-12 (3) Control Enhancement (M) (H)
The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user’s private key].
Responsible Role:
|Parameter SC-12 (3):

|SC-12 (3) What is the solution and how is it implemented?|
#
SC-13 Use of Cryptography (L) (M) (H)
The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Responsible Role:
|Parameter SC-13:

|SC-13 What is the solution and how is it implemented?|
#
SC-15 Collaborative Computing Devices (M) (H)
The information system:

Prohibits remote activation of collaborative computing devices with the following exceptions:[FedRAMP Assignment: no exceptions]; and

Provides an explicit indication of use to users physically present at the devices.

SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.
Responsible Role:
|Parameter SC-15(a):

|SC-15 What is the solution and how is it implemented?|
SC-15 Additional FedRAMP Requirements and Guidance:

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.
Responsible Role:
|Parameter SC-15(a):

|SC-15 What is the solution and how is it implemented?|
Req. 1|

#
SC-17 Public Key Infrastructure Certificates (M) (H)
The organization issues public key certificates under an [Assignment: organization-defined certificate policy] or obtains public key certificates from an approved service provider.
Responsible Role:
|Parameter SC-17:

|SC-17 What is the solution and how is it implemented?|
#
SC-18 Mobile Code (M) (H)
The organization:

Defines acceptable and unacceptable mobile code and mobile code technologies;

Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and

Authorizes, monitors, and controls the use of mobile code within the information system.
Responsible Role:

|SC-18 What is the solution and how is it implemented?|
Part c

##
SC-19 Voice Over Internet Protocol (M) (H)
The organization:

Establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and

Authorizes, monitors, and controls the use of VoIP within the information system.
Responsible Role:

|SC-19 What is the solution and how is it implemented?|
#
SC-20 Secure Name / Address Resolution Service (Authoritative Source) (L) (M) (H)
The information system:

Provides additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and

Provides the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
Responsible Role:

|SC-20 What is the solution and how is it implemented?|
#
SC-21 Secure Name / Address Resolution Service (Recursive or Caching Resolver) (L) (M) (H)
The information system requests and performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Responsible Role:
//date|

|SC-21 What is the solution and how is it implemented?|
#
SC-22 Architecture and Provisioning for Name / Address Resolution Service (L) (M) (H)
The information systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal/external role separation.
Responsible Role:

SC-22 What is the solution and how is it implemented?|
#
SC-23 Session Authenticity (M) (H)
The information system protects the authenticity of communications sessions.
Responsible Role:

|SC-23 What is the solution and how is it implemented|
#
SC-28 Protection of Information at Rest (M) (H)
The information system protects the [FedRAMP Selection: confidentiality AND integrity]] of [Assignment: organization-defined information at rest].
SC-28 Additional FedRAMP Requirements and Guidance:

Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest.
Responsible Role:
|Parameter SC-28-1:
|Parameter SC-28-2:

|SC-28 What is the solution and how is it implemented?|
#
SC-28 (1) Control Enhancement (M)
The information system implements cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined information] on [Assignment: organization-defined information system components]
Responsible Role:
|Parameter SC-28(1)-1:
|Parameter SC-28(1)-2:

|SC-28 (1) What is the solution and how is it implemented?|
#
SC-39 Process Isolation (L) (M) (H)
The information system maintains a separate execution domain for each executing process.
Responsible Role:

|SC-39 What is the solution and how is it implemented?|
Maintenance (MA)
#
MA-1 System Maintenance Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system maintenance policy and associated system maintenance controls; and

Reviews and updates the current:

System maintenance policy [FedRAMP Assignment: at least every three (3) years]; and

System maintenance procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter MA-1(a):
|Parameter MA-1(b)(1):
|Parameter MA-1(b)(2):

|MA-1 What is the solution and how is it implemented?|
#
MA-2 Controlled Maintenance (L) (M) (H)
The organization:

Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;

Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;

Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;

Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;

Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and

Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.
Responsible Role:
|Parameter MA-2(c):
|Parameter MA-2(f):

|MA-2 What is the solution and how is it implemented?|
#
MA-3 Maintenance Tools (M) (H)
The organization approves, controls, and monitors information system maintenance tools.
Responsible Role:

|MA-3 What is the solution and how is it implemented?|
#
MA-3 (1) Control Enhancement (M) (H)
The organization inspects the maintenance tools carried into a facility by maintenance personnel for improper or unauthorized modifications.
Responsible Role:

|MA-3 (1) What is the solution and how is it implemented?|
#
MA-3 (2) Control Enhancement (M) (H)
The organization checks media containing diagnostic and test programs for malicious code before the media are used in the information system.
Responsible Role:

|MA-3 (2) What is the solution and how is it implemented?|
#
MA-3 (3) Control Enhancement (M) (H)
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:

Verifying that there is no organizational information contained on the equipment;

Sanitizing or destroying the equipment;

Retaining the equipment within the facility; or

Obtaining an exemption from [FedRAMP Assignment: the information owner explicitly authorizes removal of the equipment from the facility].
Responsible Role:
|Parameter MA-3(3)(d):

|MA-3 (3) What is the solution and how is it implemented?|
#
MA-4 Remote Maintenance (L) (M) (H)
The organization:

Approves and monitors nonlocal maintenance and diagnostic activities;

Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system;

Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions;

Maintains records for nonlocal maintenance and diagnostic activities; and

Terminates session and network connections when nonlocal maintenance is completed.
Responsible Role:

|MA-4 What is the solution and how is it implemented?|
Part e

#
MA-4 (2) Control Enhancement (M) (H)
The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections.
Responsible Role:

|MA-4 (2) What is the solution and how is it implemented?|
#
MA-5 Maintenance Personnel (L) (M) (H)
The organization:

Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel;

Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and

Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Responsible Role:

|MA-5 What is the solution and how is it implemented?|
Part c

#
MA-5 (1) Control Enhancement (L) (M)
The organization:

Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:

Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;

Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and

Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.

MA-5 (1) Additional FedRAMP Requirements and Guidance:

Requirement: Only MA-5 (1) (a) (1) is required by FedRAMP
Responsible Role:

|MA-5 (1) What is the solution and how is it implemented?|
#
MA-6 Timely Maintenance (M) (H)
The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.
Responsible Role:
|Parameter MA-6(1):
|Parameter MA-6(2):

|MA-6 What is the solution and how is it implemented?|
Identification and Authentication (IA)
#
IA-1 Identification and Authentication Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls; and

Reviews and updates the current:

Identification and authentication policy [FedRAMP Assignment: at least every three (3) years]; and

Identification and authentication procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter IA-1(a):
|Parameter IA-1(a):
|Parameter IA-1(b)(1):

|IA-1 What is the solution and how is it implemented?|
#
IA-2 User Identification and Authentication (L) (M) (H)
The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
Responsible Role:

|IA-2 What is the solution and how is it implemented?|
#
IA-2 (1) Control Enhancement (L) (M) (H)
The information system implements multifactor authentication for network access to privileged accounts.
Responsible Role:

|IA-2 (1) What is the solution and how is it implemented?|
#
IA-2 (2) Control Enhancement (M) (H)
The information system implements multifactor authentication for network access to non-privileged accounts.
Responsible Role:

|IA-2 (2) What is the solution and how is it implemented?|
#
IA-2 (3) Control Enhancement (M) (H)
The information system implements multifactor authentication for local access to privileged accounts.
Responsible Role:

|IA-2 (3) What is the solution and how is it implemented?|
#
IA-2 (5) Control Enhancement (M) (H)
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
Responsible Role:

|IA-2 (5) What is the solution and how is it implemented?|
#
IA-2 (8) Control Enhancement (M) (H)
The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.

#
IA-2 (5) Control Enhancement (M) (H)
The organization requires individuals to be authenticated with an individual authenticator when a group authenticator is employed.
Responsible Role:

|IA-2 (8) What is the solution and how is it implemented?|
#
IA-2 (11) Control Enhancement (M) (H)
The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [FedRAMP Assignment: FIPS 140-2, NIAP* Certification, or NSA approval].
*National Information Assurance Partnership (NIAP)

Additional FedRAMP Requirements and Guidance:

Guidance: PIV = separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials. FIPS 140-2 means validated by the Cryptographic Module Validation Program (CMVP).
Responsible Role:
|Parameter IA-2(11):

|IA-2 (11) What is the solution and how is it implemented?|
#
IA-2 (12) Control Enhancement (L) (M) (H)
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials.
IA-2 (12) Additional FedRAMP Requirements and Guidance:

Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.
Responsible Role:

|IA-2 (12) What is the solution and how is it implemented?|
#
IA-3 Device Identification and Authentication (M) (H)
The information system uniquely identifies and authenticates [Assignment: organization-defined specific and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection.
Responsible Role:
|Parameter IA-3-1:
|Parameter IA-3-2:

|IA-3 What is the solution and how is it implemented?|
#
IA-4 Identifier Management (L) (M)
The organization manages information system identifiers for users and devices by:

Receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, or device identifier;

Selecting an identifier that identifies an individual, group, role, or device;

Assigning the identifier to the intended individual, group, role, or device;

Preventing reuse of identifiers for [FedRAMP Assignment: at least two (2) years]; and

Disabling the identifier after [FedRAMP Assignment: ninety days for user identifiers (see additional requirements and guidance)]

IA-4e Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period of inactivity for device identifiers.
Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.
Responsible Role:
|Parameter IA-4(a):
|Parameter IA-4(d):
|Parameter IA-4(e):

|IA-4 What is the solution and how is it implemented?|
Part e

#
IA-4 (4) Control Enhancement (M) (H)
The organization manages individual identifiers by uniquely identifying each individual as [FedRAMP Assignment: contractors; foreign nationals].
Responsible Role:
|Parameter IA-4 (4):

|IA-4 (4) What is the solution and how is it implemented?|
#
IA-5 Authenticator Management (L) (M)
The organization manages information system authenticators by:

Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

Establishing initial authenticator content for authenticators defined by the organization;

Ensuring that authenticators have sufficient strength of mechanism for their intended use;

Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

Changing default content of authenticators prior to information system installation;

Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type].

Protecting authenticator content from unauthorized disclosure and modification;

Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

Changing authenticators for group/role accounts when membership to those accounts changes.

IA-5 Additional FedRAMP Requirements and Guidance:

Requirement: Authenticators must be compliant with NIST SP 800-63-3 Digital Identity Guidelines IAL, AAL, FAL level 2. Link https://pages.nist.gov/800-63-3.
Responsible Role:
|Parameter IA-5(g):

|IA-5 What is the solution and how is it implemented?|
#
IA-5 (1) Control Enhancement (L) (M)
The information system, for password-based authentication:

Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type];

Enforces at least the following number of changed characters when new passwords are created: [FedRAMP Assignment: at least one (1)];

Stores and transmits only cryptographically-protected passwords;

Enforces password minimum and maximum lifetime restrictions of [Assignment: organization- defined numbers for lifetime minimum, lifetime maximum];

Prohibits password reuse for [FedRAMP Assignment: twenty-four (24)] generations; and

Allows the use of a temporary password for system logons with an immediate change to a permanent password.

IA-5 (1) a and d Additional FedRAMP Requirements and Guidance:

Guidance: If password policies are compliant with NIST SP 800-63B Memorized Secret (Section 5.1.1) Guidance, the control may be considered compliant.
Responsible Role:
|Parameter IA-5(1)(a):
|Parameter IA-5(1)(b):
|Parameter IA-5(1)(d):
|Parameter IA-5(1)(e):

|IA-5 (1) What is the solution and how is it implemented?|
#
IA-5 (2) Control Enhancement (M) (H)
The information system, for PKI-based authentication:

Validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information;

Enforces authorized access to the corresponding private key;

Maps the authenticated identity to the account of the individual or group; and

Implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
Responsible Role:

|IA-5 (2) What is the solution and how is it implemented?|
#
IA-5 (3) Control Enhancement (M) (H)
The organization requires that the registration process to receive [FedRAMP Assignment: All hardware/biometric (multifactor authenticators] be conducted [FedRAMP Selection: in person] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter IA-5(3)-1:
|Parameter IA-5(3)-2:
|Parameter IA-5(3)-3:
|Parameter IA-5(3)-4:

|IA-5 (3) What is the solution and how is it implemented?|
#
IA-5 (4) Control Enhancement (M)
The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].
IA-5 (4) Additional FedRAMP Requirements and Guidance:

Guidance: If automated mechanisms which enforce password authenticator strength at creation are not used, automated mechanisms must be used to audit strength of created password authenticators.
Responsible Role:
|Parameter IA-5(4):

|IA-5 (4) What is the solution and how is it implemented?|
#
IA-5 (6) Control Enhancement (M) (H)
The organization protects authenticators commensurate with the security category of the information to which use of the authenticator permits access.
Responsible Role:

|IA-5 (6) What is the solution and how is it implemented?|
#
IA-5 (7) Control Enhancement (M) (H)
The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.
Responsible Role:

|IA-5 (7) What is the solution and how is it implemented?|
#
IA-5 (11) Control Enhancement (L) (M) (H)
The information system, for hardware token-based authentication, employs mechanisms that satisfy [Assignment: organization-defined token quality requirements].
Responsible Role:
|Parameter IA-5(11):

|IA-5 (11) What is the solution and how is it implemented?|
#
IA-6 Authenticator Feedback (L) (M) (H)
The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
Responsible Role:

|IA-6 What is the solution and how is it implemented?|
#
IA-7 Cryptographic Module Authentication (L) (M) (H)
The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
Responsible Role:

|IA-7 What is the solution and how is it implemented?|
#
IA-8 Identification and Authentication (Non-Organizational Users) (L) (M) (H)
The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
Responsible Role:

|IA-8 What is the solution and how is it implemented?|
#
IA-8 (1) Control Enhancement (L) (M) (H)
The information system accepts and electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.
Responsible Role:

|IA-8 (1) What is the solution and how is it implemented?|
#
IA-8 (2) Control Enhancement (L) (M) (H)
The information system accepts only FICAM-approved third-party credentials.
Responsible Role:

|IA-8 (2) What is the solution and how is it implemented?|
#
IA-8 (3) Control Enhancement (L) (M) (H)
The organization employs only FICAM-approved information system components in [Assignment: organization-defined information systems] to accept third-party credentials.
Responsible Role:
|Parameter IA-8(3):

|IA-8 (3) What is the solution and how is it implemented?|
#
IA-8 (4) Control Enhancement (L) (M) (H)
The information system conforms to FICAM-issued profiles.
Responsible Role:

|IA-8 (4) What is the solution and how is it implemented?|
Access Control (AC)
#
AC-1 Access Control Policy and Procedures Requirements (L) (M)
The organization:

Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]:

An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the access control policy and associated access controls; and

Reviews and updates the current:

Access control policy [FedRAMP Assignment: at least every 3 years]; and

Access control procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter AC-1(a):
|Parameter AC-1(b)(1):
|Parameter AC-1(b)(2):

|AC-1 What is the solution and how is it implemented?|
Part b1|
|Part b2|

#
AC-2 Account Management (L) (M)
The organization:

Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];

Assigns account managers for information system accounts;

Establishes conditions for group and role membership;

Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account;

Requires approvals by [Assignment: organization-defined personnel or roles] for requests to create information system accounts;

Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];

Monitors the use of information system accounts;

Notifies account managers:

When accounts are no longer required;

When users are terminated or transferred; and

When individual information system usage or need-to-know changes;

Authorizes access to the information system based on:

A valid access authorization;

Intended system usage; and

Other attributes as required by the organization or associated missions/business functions;

Reviews accounts for compliance with account management requirements [FedRAMP Assignment: at least annually]; and

Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
Responsible Role:
|Parameter AC-2(a):
|Parameter AC-2(e):
|Parameter AC-2(f):
|Parameter AC-2(j):

|AC-2 What is the solution and how is it implemented?|
Part k

#
AC-2 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to support the management of information system accounts.
Responsible Role:

|AC-2 (1) What is the solution and how is it implemented?|
#
AC-2 (2) Control Enhancement (M)
The information system automatically [Selection: removes; disables] temporary and emergency accounts after [FedRAMP Assignment: no more than 30 days for temporary and emergency account types].
Responsible Role:
|Parameter AC-2(2)1:
|Parameter AC-2(2)2:

|AC-2 (2) What is the solution and how is it implemented?|
#
AC-2 (3) Control Enhancement (M)
The information system automatically disables inactive accounts after [FedRAMP Assignment: ninety (90) days for user accounts].

AC-2 (3) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the Joint Authorization Board (JAB)/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available.
Responsible Role:
|Parameter AC-2(3):

|AC-2 (3) What is the solution and how is it implemented?|
#
AC-2 (4) Control Enhancement (M)
The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter AC-2(4):

|AC-2 (4) What is the solution and how is it implemented?|
#
AC-2 (5) Control Enhancement (M)
The organization requires that users log out when [Assignment: organization-defined time-period of expected inactivity or description of when to log out].

AC-2 (5) Additional FedRAMP Requirements and Guidance:

Guidance: Should use a shorter timeframe than AC-12
Responsible Role:
|Parameter AC-2(5):

|AC-2 (5) What is the solution and how is it implemented?|
#
AC-2 (7) Control Enhancement (M)
The organization:

Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles;

Monitors privileged role assignments; and

Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate.
Responsible Role:
|Parameter AC-2(7):

|AC-2 (7) What is the solution and how is it implemented?|
Part c

#
AC-2 (9) Control Enhancement (M)
The organization only permits the use of shared/group accounts that meet [Assignment: organization-defined conditions for establishing shared/group accounts].

AC-2 (9) Additional FedRAMP Requirements and Guidance: Required if shared/group accounts are deployed.
Responsible Role:
|Parameter AC-2(9):

|AC-2 (9) What is the solution and how is it implemented?|
#
AC-2 (10) Control Enhancement (M) (H)
The information system terminates shared/group account credentials when members leave the group.

AC-2 (10) Additional FedRAMP Requirements and Guidance:

Required if shared/group accounts are deployed.
Responsible Role:
|Parameter AC-2(10):

|AC-2 (10) What is the solution and how is it implemented?|
#
AC-2 (12) Control Enhancement (M)
The organization:

Monitors information system accounts for [Assignment: organization-defined atypical use]; and

Reports atypical usage of information system accounts to [Assignment: organization-defined personnel or roles].

AC-2 (12) (a) and AC-2 (12) (b) Additional FedRAMP Requirements and Guidance: Required for privileged accounts.
Responsible Role:
|Parameter AC-2(12)(a):
|Parameter AC-2(12)(b):

|AC-2 (12) What is the solution and how is it implemented?|
AC-3 Access Enforcement (L) (M) (H)
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Responsible Role:

|AC-3 What is the solution and how is it implemented?|
Part a
AC-4 Information Flow Enforcement (M) (H)
The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [Assignment: organization-defined information flow control policies].
Responsible Role:
|Parameter AC-4

|AC-4 What is the solution and how is it implemented?|
#
AC-4 (21) Control Enhancement (M) (H)
The information system separates information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].
Responsible Role:
|Parameter AC-4(21)-1
|Parameter AC-4(21)-2

|AC-4 What is the solution and how is it implemented?|
AC-5 Separation of Duties (M) (H)
The organization:

Separates [Assignment: organization-defined duties of individuals];

Documents separation of duties of individuals; and

Defines information system access authorizations to support separation of duties.

AC-5 Additional FedRAMP Requirements and Guidance:

Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP. Directions for attaching the Separation of Duties Matrix document may be found in Section Error: Reference source not found Error: Reference source not found.
Responsible Role:
|Parameter AC-5(a)

|AC-5 What is the solution and how is it implemented?|
Part c
AC-6 Least Privilege (M) (H)
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
Responsible Role:

|AC-6 What is the solution and how is it implemented?|
#
AC-6 (1) Control Enhancement (M)
The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information].
Responsible Role:
|Parameter AC-6(1)

|AC-6 (1) What is the solution and how is it implemented?|
#
AC-6 (2) Control Enhancement (M) (H)
The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing non-security functions.

AC-6 (2) Additional FedRAMP Requirements and Guidance:

Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.
Responsible Role:
|Parameter AC-6(2)

|AC-6 (2) What is the solution and how is it implemented?|
#
AC 6 (5) Control Enhancement (M) (H)
The organization restricts privileged accounts on the information system to [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter AC-6(5)

|AC-6 (5) What is the solution and how is it implemented?|
#
AC-6 (9) Control Enhancement (M) (H)
The information system audits the execution of privileged functions.
Responsible Role:

|AC-6 (9) What is the solution and how is it implemented?|
#
AC-6 (10) Control Enhancement (M) (H)
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
Responsible Role:

|AC-6 (10) What is the solution and how is it implemented?|