rkreddyp/nist_800_53 huggingface dataset:
Personnel Security (PS)
#
PS-1 Personnel Security Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A personnel security policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the personnel security policy and associated personnel security controls; and

Reviews and updates the current:

Personnel security policy [FedRAMP Assignment: at least every three (3) years]; and

Personnel security procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter PS-1(a):
|Parameter PS-1(b)(1):
|Parameter PS-1(b)(2):

|PS-1 What is the solution and how is it implemented?|
#
PS-2 Position Categorization (L) (M)
The organization:

Assigns a risk designation to all positions;

Establishes screening criteria for individuals filling those positions; and

Reviews and revises position risk designations [FedRAMP Assignment: at least every three (3) years].
Responsible Role:
|Parameter PS-2(c):

|PS-2 What is the solution and how is it implemented?|
Part c

#
PS-3 Personnel Screening (L) (M) (H)
The organization:

Screens individuals prior to authorizing access to the information system; and

Rescreens individuals according to [FedRAMP Assignment: For national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year. There is no reinvestigation for other moderate risk positions or any low risk positions].
Responsible Role:
|Parameter PS-3(b):

|PS-3 What is the solution and how is it implemented?|
#
PS-3 (3) Control Enhancement (M) (H)
The organization ensures that individuals accessing an information system processing, storing, or transmitting information requiring special protection:

Have valid access authorizations that are demonstrated by assigned official government duties; and

Satisfy [FedRAMP Assignment: personnel screening criteria – as required by specific information].
Responsible Role:
|Parameter PS-3 (3)(b):

|PS-3 (3) What is the solution and how is it implemented?|
|---

#
PS-4 Personnel Termination (L) (M)
The organization, upon termination of individual employment:

Disables information system access within [FedRAMP Assignment: same day];

Terminates/revokes any authenticators/credentials associated with the individual;

Conducts exit interviews that include a discussion of [Assignment: organization-defined information security topics];

Retrieves all security-related organizational information system-related property;

Retains access to organizational information and information systems formerly controlled by terminated individual; and

Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
Responsible Role:
|Parameter PS-4(a):
|Parameter PS-4(c):
|Parameter PS-4(f)-1:
|Parameter PS-4(f)-2:

|PS-4 What is the solution and how is it implemented?|
#
PS-5 Personnel Transfer (L) (M)
The organization:

Reviews and confirms ongoing operational need for current logical and physical access authorizations to information systems/facilities when individuals are reassigned or transferred to other positions within the organization;

Initiates [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action];

Modifies access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and

Notifies [Assignment: organization-defined personnel or roles] within [FedRAMP Assignment: within five days of the formal transfer action (DoD 24 hours)].
Responsible Role:
|Parameter PS-5(b)-1:
|Parameter PS-5(b)-2:
|Parameter PS-5(d)-1:
|Parameter PS-5(d)-2:

|PS-5 What is the solution and how is it implemented?|
#
PS-6 Access Agreements (L) (M)
The organization:

Develops and documents access agreements for organizational information systems;

Reviews and updates the access agreements [FedRAMP Assignment: at least annually]; and

Ensures that individuals requiring access to organizational information and information systems:

Sign appropriate access agreements prior to being granted access; and

Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter PS-6(b):
|Parameter PS-6(c)(2):

|PS-6 What is the solution and how is it implemented?|
Part c

#
PS-7 Third-Party Personnel Security (L) (M)
The organization:

Establishes personnel security requirements including security roles and responsibilities for third-party providers;

Requires third-party providers to comply with personnel security policies and procedures established by the organization;

Documents personnel security requirements;

Requires third-party providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [FedRAMP Assignment: same day]; and

Monitors provider compliance.
Responsible Role:
|Parameter PS-7(d)-1:
|Parameter PS-7(d)-2:

|PS-7 What is the solution and how is it implemented?|
Part e

#
PS-8 Personnel Sanctions (L) (M)
The organization:

Employs a formal sanctions process for personnel failing to comply with established information security policies and procedures; and

Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
Responsible Role:
|Parameter PS-8(b)-1:
|Parameter PS-8(b)-2:

|PS-8 What is the solution and how is it implemented?|
Media Protection (MP)
#
MP-1 Media Protection Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the media protection policy and associated media protection controls; and

Reviews and updates the current:

Media protection policy [FedRAMP Assignment: at least every three (3) years]; and

Media protection procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter MP-1(a):
|Parameter MP-1(b)(1):
|Parameter MP-1(b)(2):

|MP-1 What is the solution and how is it implemented?|
#
MP-2 Media Access (L) (M)
The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter MP-2-1:
|Parameter MP-2-2:

|MP-2 What is the solution and how is it implemented?|
#
MP-3 Media Labeling (M) (H)
The organization:

Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and

Exempts [FedRAMP Assignment: no removable media types] from marking as long as the media remain within [Assignment: organization-defined controlled areas].

MP-3(b) Additional FedRAMP Requirements and Guidance:

Guidance: Second parameter in MP-3(b)-2 is not applicable.
Responsible Role:
|Parameter MP-3(b)-1:
|Parameter MP-3(b)-2:| Not applicable

|MP-3 What is the solution and how is it implemented?|
#
MP-4 Media Storage (M) (H)
The organization:

Physically controls and securely stores [FedRAMP Assignment: [all types of digital and non-digital media with sensitive information]] within [FedRAMP Assignment: see additional FedRAMP requirements and guidance]; and

MP-4a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines controlled areas within facilities where the information and information system reside.
Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
Responsible Role:
|Parameter MP-4(a)-1:
|Parameter MP-4(a)-2:

|MP-4 What is the solution and how is it implemented?|
#
MP-5 Media Transport (M) (H)
The organization:

Protects and controls [FedRAMP Assignment: all media with sensitive information] during transport outside of controlled areas using [FedRAMP Assignment: for digital media, encryption using a FIPS 140-2 validated encryption module; for non-digital media, secured in locked container];

MP-5a Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines security measures to protect digital and non-digital media in transport. The security measures are approved and accepted by the JAB/AO.
Maintains accountability for information system media during transport outside of controlled areas;

Documents activities associated with the transport of information system media; and

Restricts the activities associated with transport of information system media to authorized personnel.
Responsible Role:
|Parameter MP-5(a)-1:
|Parameter MP-5(a)-2:

|MP-5 What is the solution and how is it implemented?|
#
MP-5 (4) Control Enhancement (M) (H)
The organization employs cryptographic mechanisms to protect the confidentiality and integrity of information stored on digital media during transport outside of controlled areas.
Responsible Role:

|MP-5 (4) What is the solution and how is it implemented?|
#
MP-6 Media Sanitization and Disposal (L) (M)
The organization:

Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and

Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Responsible Role:
|Parameter MP-6(a)-1:
|Parameter MP-6(a)-2:

|MP-6 What is the solution and how is it implemented?|
#
MP-6 (2) Control Enhancement (M)
The organization tests sanitization equipment and procedures [FedRAMP Assignment: at least annually] to verify that the intended sanitization is being achieved.
MP-6 (2) Additional FedRAMP Requirements and Guidance:

Guidance: Equipment and procedures may be tested or evaluated for effectiveness.
Responsible Role:
|Parameter MP-6(2):

|MP-6 (2) What is the solution and how is it implemented?|
#
MP-7 Media Use (L) (M) (H)
The organization [Selection: restricts; prohibits] the use of [Assignment: organization-defined types of information system media] on [Assignment: organization-defined information systems or system components] using [Assignment: organization-defined security safeguards].
Responsible Role:
|Parameter MP-7-1:
|Parameter MP-7-2:
|Parameter MP-7-3:
|Parameter MP-7-4:

|MP-6 (2) What is the solution and how is it implemented?|
#
MP-7 (1) Control Enhancement (M) (H)
The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
Responsible Role:

|MP-7 (1) What is the solution and how is it implemented?|
Risk Assessment (RA)
#
RA-1 Risk Assessment Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls; and

Reviews and updates the current:

Risk assessment policy [FedRAMP Assignment: at least every three (3) years]; and

Risk assessment procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter RA-1(a):
|Parameter RA-1(b)(1):
|Parameter RA-1(b)(2):

|RA-1 What is the solution and how is it implemented?|
#
RA-2 Security Categorization (L) (M) (H)
The organization:

Categorizes information and the information system in accordance with applicable Federal Laws, Executive Orders, directives, policies, regulations, standards, and guidance;

Documents the security categorization results (including supporting rationale) in the security plan for the information system; and

Ensures the security categorization decision is reviewed and approved by the AO or authorizing official designated representative.
Responsible Role:

|RA-2 What is the solution and how is it implemented?|
Part c

#
RA-3 Risk Assessment (L) (M)
The organization:

Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits;

Documents risk assessment results in [Selection: security plan; risk assessment report; [FedRAMP Assignment: security assessment report]];

Reviews risk assessment results [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs];

Disseminates risk assessment results to [Assignment: organization-defined personnel or roles]; and

Updates the risk assessment [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.

RA-3 Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F
RA-3 (d) Requirement: Include all Authorizing Officials; for JAB authorizations to include FedRAMP.
Responsible Role:
|Parameter RA-3(b):
|Parameter RA-3(c):
|Parameter RA-3(d):
|Parameter RA-3(e):

|RA-3 What is the solution and how is it implemented?|
Part e

#
RA-5 Vulnerability Scanning (L) (M) (H)
The organization:

Scans for vulnerabilities in the information system and hosted applications [FedRAMP Assignment: monthly operating system/infrastructure; monthly web applications and databases] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

RA-5 (a) Additional FedRAMP Requirements and Guidance:

Requirement: An accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.
Employs vulnerability scanning tools and techniques that promote interoperability among tools and automate parts of the vulnerability management process by using standards for:

Enumerating platforms, software flaws, and improper configurations;

Formatting and making transparent, checklists and test procedures; and

Measuring vulnerability impact;

Analyzes vulnerability scan reports and results from security control assessments

Remediates legitimate vulnerabilities; [FedRAMP Assignment: high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery], in accordance with an organizational assessment of risk; and

Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

RA-5 (e) Additional FedRAMP Requirements and Guidance:

Requirement: To include all Authorizing Officials; for JAB authorizations to include FedRAMP.

RA-5 Additional FedRAMP Requirements and Guidance
Guidance: See the FedRAMP Documents page under Key Cloud Service Provider (CSP) Documents Vulnerability Scanning Requirements

https://www.FedRAMP.gov/documents/
Responsible Role:
|Parameter RA-5(a):
|Parameter RA-5(d):
|Parameter RA-5(e):

|RA-5 What is the solution and how is it implemented?|
Part e

#
RA-5 (1) Control Enhancement (M) (H)
The organization employs vulnerability scanning tools that include the capability to readily update the list of information system vulnerabilities to be scanned.
RA-5 (1) What is the solution and how is it implemented?|
#
RA-5 (2) Control Enhancement (M) (H)
The organization updates the information system vulnerabilities scanned [Selection (one or more): [FedRAMP Assignment: prior to a new scan]].
Responsible Role:
|Parameter RA-5(2):

|RA-5 (2) What is the solution and how is it implemented?|
#
RA-5 (3) Control Enhancement (M) (H)
The organization employs vulnerability scanning procedures that can demonstrate the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
Responsible Role:
|Parameter RA-5(2):

|RA-5 (3) What is the solution and how is it implemented?|
#
RA-5 (5) Control Enhancement (M) (H)
The organization includes privileged access authorization to [FedRAMP Assignment: operating systems, databases, web applications] for selected [FedRAMP Assignment: all scans].
Responsible Role:
|Parameter RA-5(5)-1:
|Parameter RA-5(5)-2:

|RA-5 (5) What is the solution and how is it implemented?|
#
RA-5 (6) Control Enhancement (M) (H)
The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.
Responsible Role:

|RA-6 What is the solution and how is it implemented?|
#
RA-5 (8) Control Enhancement (L) (M) (H)
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
RA-5 (8) Additional FedRAMP Requirements and Guidance:

Requirement: This enhancement is required for all high vulnerability scan findings.
Guidance: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.
Responsible Role:

|RA-8 What is the solution and how is it implemented?|
System and Services Acquisition (SA)
#
SA-1 System and Services Acquisition Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls; and

Reviews and updates the current:

System and services acquisition policy [FedRAMP Assignment: at least every three (3) years]; and

System and services acquisition procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter SA-1(a):
|Parameter SA-1(b)(1):
|Parameter SA-1(b)(2):

|AC-1 What is the solution and how is it implemented?|
#
SA-2 Allocation of Resources (L) (M) (H)
The organization:

Determines information security requirements for the information system or information system service in mission/business process planning;

Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and

Establishes a discrete line item for information security in organizational programming and budgeting documentation.
Responsible Role:

|SA-2 What is the solution and how is it implemented?|
Part c

#
SA-3 System Development Life Cycle (L) (M) (H)
The organization:

Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations;

Defines and documents information security roles and responsibilities throughout the system development life cycle;

Identifies individuals having information security roles and responsibilities; and

Integrates the organizational information security risk management process into system development life cycle activities.
Responsible Role:
|Parameter SA-3(a):

|SA-3 What is the solution and how is it implemented?|
#
SA-4 Acquisitions Process (L) (M) (H)
The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs:

Security functional requirements;

Security strength requirements;

Security assurance requirements;

Security-related documentation requirements;

Requirements for protecting security-related documentation;

Description of the information system development environment and environment in which the system is intended to operate; and

Acceptance criteria.

Additional FedRAMP Requirements and Guidance:

Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred.
See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.
Responsible Role:

|SA-4 What is the solution and how is it implemented?|
Part g

#
SA-4 (1) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to provide a description of the functional properties of the security controls to be employed.
Responsible Role:

|SA-4 (1) What is the solution and how is it implemented?|
#
SA-4 (2) Control Enhancement (L) (M)
The organization requires the developer of the information system, system component, or information system service to provide design and implementation information for the security controls to be employed that includes: [FedRAMP Selection (one or more): to include security-relevant external system interfaces, and high-level design]; [Assignment: organization-defined design/implementation information] at [Assignment: organization-defined level of detail].
Responsible Role:
|Parameter SA-4-1:
|Parameter SA-4-2:
|Parameter SA-4-3:

|SA-4 (2) What is the solution and how is it implemented?|
#
SA-4 (8) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to produce a plan for the continuous monitoring of security control effectiveness that contains [FedRAMP Assignment: at least the minimum requirement as defined in control CA-7].

SA-4 (8) Additional FedRAMP Requirements and Guidance:

Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.
Responsible Role:
|Parameter SA-4(8):

|SA-4 (8) What is the solution and how is it implemented?|
#
SA-4 (9) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to identify early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.
Responsible Role:

|SA-4 (9) What is the solution and how is it implemented?|
#
SA-4 (10) Control Enhancement (M) (H)
The organization employs only information technology products on the FIPS 201-approved products list for Personal Identity Verification (PIV) capability implemented within organizational information systems.
Responsible Role:

|SA-4 (10) What is the solution and how is it implemented?|
#
SA-5 Information System Documentation (L) (M)
The organization:

Obtains administrator documentation for the information system, system component, or information system service that describes:

Secure configuration, installation, and operation of the system, component, or service;

Effective use and maintenance of security functions/mechanisms; and

Known vulnerabilities regarding configuration and use of administrative (i.e., privileged) functions;

Obtains user documentation for the information system, system component, or information system service that describes:

User-accessible security functions/mechanisms and how to effectively use those security functions/mechanisms;

Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner; and

User responsibilities in maintaining the security of the system, component, or service;

Documents attempts to obtain information system, system component, or information system service documentation when such documentation is either unavailable or nonexistent and [Assignment: organization-defined actions] in response;

Protects documentation as required, in accordance with the risk management strategy; and

Distributes documentation to [Assignment: organization-defined personnel or roles)].
Responsible Role:
|Parameter SA-5(c):
|Parameter SA-5(e):

|SA-5 What is the solution and how is it implemented?|
Part e

#
SA-8 Security Engineering Principles (M) (H)
The organization applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.
Responsible Role:

|SA-8 What is the solution and how is it implemented?|
#
SA-9 External Information System Services (L) (M) (H)
The organization:

Requires that providers of external information system services comply with organizational information security requirements and employ [FedRAMP Assignment: FedRAMP Security Controls Baseline(s) if Federal information is processed or stored within the external system] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance;

Defines and documents government oversight and user roles and responsibilities with regard to external information system services; and

Employs [FedRAMP Assignment: Federal/FedRAMP Continuous Monitoring requirements must be met for external systems where Federal information is processed or stored] to monitor security control compliance by external service providers on an ongoing basis.

Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service Provider (CSP) Documents> Continuous Monitoring Strategy Guide
https://www.FedRAMP.gov/documents

Guidance: Independent Assessors should assess the risk associated with the use of external services. See the FedRAMP page under Key Cloud Service Provider (CSP) Documents>FedRAMP Authorization Boundary Guidance
Responsible Role:
|Parameter SA-9(a):
|Parameter SA-9(c):

|SA-9 What is the solution and how is it implemented?|
Part c

#
SA-9 (1) Control Enhancement (M) (H)
The organization:

Conducts an organizational assessment of risk prior to the acquisition or outsourcing of dedicated information security services; and

Ensures that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter SA-9(1)(b):

|SA-9 What is the solution and how is it implemented?|
#
SA-9 (2) Control Enhancement (M) (H)
The organization requires providers of [FedRAMP Assignment: All external systems where Federal information is processed or stored] to identify the functions, ports, protocols, and other services required for the use of such services.
Responsible Role:
|Parameter SA-9(2):

|SA-9 (2) What is the solution and how is it implemented?|
#
SA-9 (4) Control Enhancement (M) (H)
The organization employs [Assignment: organization-defined security safeguards] to ensure that the interests of [FedRAMP Assignment: All external systems where Federal information is processed or stored] are consistent with and reflect organizational interests.
Responsible Role:
|Parameter SA-9(4)-1:
|Parameter SA-9(4)-2:

|SA-9 (4) What is the solution and how is it implemented?|
#
SA-9 (5) Control Enhancement (M) (H)
The organization restricts the location of [FedRAMP Selection: information processing, information data, AND information services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].

Additional FedRAMP Requirements and Guidance

Guidance: System services refer to FTP, Telnet, and TFTP, etc.
Responsible Role:
|Parameter SA-9(5)-1:
|Parameter SA-9(5)-2:
|Parameter SA-9(5)-3:

|SA-9 (5) What is the solution and how is it implemented?|
#
SA-10 Developer Configuration Management (M) (H)
The organization requires the developer of the information system, system component, or information system service to:

Perform configuration management during system, component, or service [FedRAMP Selection: development, implementation, AND operation];

Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management];

Implement only organization-approved changes to the system, component, or service;

Document approved changes to the system, component, or service and the potential security impacts of such changes; and

Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].

SA-10 (e) Additional FedRAMP Requirements and Guidance:

Requirement: For JAB authorizations, track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP.
Responsible Role:
|Parameter SA-10(a):
|Parameter SA-10(b):
|Parameter SA-10(e):

|SA-10 What is the solution and how is it implemented?|
Part e

#
SA-10 (1) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components.
Responsible Role:

|SA-10 (1) What is the solution and how is it implemented?|
#
SA-11 Developer Security Testing and Evaluation (M) (H)
The organization requires the developer of the information system, system component, or information system service to:

Create and implement a security assessment plan;

Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage];

Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;

Implement a verifiable flaw remediation process; and

Correct flaws identified during security testing/evaluation.
Responsible Role:
|Parameter SA-11(b)-1:
|Parameter SA-11(b)-2:

|SA-11 What is the solution and how is it implemented?|
#
SA-11 (1) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws and document the results of the analysis.

SA-11 (1) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.
Responsible Role:
|Parameter SA-11(b)-1:
|Parameter SA-11(b)-2:

|SA-11 (1) What is the solution and how is it implemented?|
#
SA-11 (2) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to perform threat and vulnerability analyses and subsequent testing/evaluation of the as-built system, component, or service.
Responsible Role:

|SA-11 (2) What is the solution and how is it implemented?|
#
SA-11 (8) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
Responsible Role:

|SA-11 (8) What is the solution and how is it implemented?|
Physical and Environmental Protection (PE)
#
PE-1 Physical and Environmental Protection Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls; and

Reviews and updates the current:

Physical and environmental protection policy [FedRAMP Assignment: at least every three (3) years]; and

Physical and environmental protection procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter PE-1(a):
|Parameter PE-1(b)(1):
|Parameter PE-1(b)(2):

|PE-1 What is the solution and how is it implemented?|
#
PE-2 Physical Access Authorizations (L) (M)
The organization:

Develops, approves, and maintains a list of individuals with authorized access to the facility where the information system resides;

Issues authorization credentials for facility access;

Reviews the access list detailing authorized facility access by individuals [FedRAMP Assignment: at least annually]; and

Removes individuals from the facility access list when access is no longer required.
Responsible Role:
|Parameter PE-2(c):

|PE-2 What is the solution and how is it implemented?|
#
PE-3 Physical Access Control (L) (M) (H)
The organization:

Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by:

Verifying individual access authorizations before granting access to the facility; and

Controlling ingress/egress to the facility using [FedRAMP Assignment: CSP defined physical access control systems/devices AND guards];

Maintains physical access audit logs for [Assignment: organization-defined entry/exit points];

Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible;

Escorts visitors and monitors visitor activity [FedRAMP Assignment: in all circumstances within restricted access area where the information system resides];

Secures keys, combinations, and other physical access devices;

Inventories [Assignment: organization-defined physical access devices] every [FedRAMP Assignment: at least annually]; and

Changes combinations and keys [FedRAMP Assignment: at least annually] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
Responsible Role:
|Parameter PE-3(a):
|Parameter PE-3(a)(2):
|Parameter PE-3(b):
|Parameter PE-3(c):
|Parameter PE-3(d):
|Parameter PE-3(f)-1:
|Parameter PE-3(f)-2:
|Parameter PE-3(g):

|PE-3 What is the solution and how is it implemented?|
Part g

#
PE-4 Access Control for Transmission Medium (M) (H)
The organization controls physical access to [Assignment: organization-defined information system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security safeguards].
Responsible Role:
|Parameter PE-4-1:
|Parameter PE-4-2:

|PE-4 What is the solution and how is it implemented?|
#
PE-5 Access Control for Output Devices (M) (H)
The organization controls physical access to information system output devices to prevent unauthorized individuals from obtaining the output.
Responsible Role:

|PE-5 What is the solution and how is it implemented?|
#
PE-6 Monitoring Physical Access (L) (M) (H)
The organization:

Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents;

Reviews physical access logs [FedRAMP Assignment: at least monthly] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and

Coordinates results of reviews and investigations with the organization’s incident response capability.
Responsible Role:
|Parameter PE-6(b)-1:
|Parameter PE-6(b)-2:

|PE-6 What is the solution and how is it implemented?|
Part c

#
PE-6 (1) Control Enhancement (M) (H)
The organization monitors physical intrusion alarms and surveillance equipment.
Responsible Role:

|PE-6 (1) What is the solution and how is it implemented?|
#
PE-8 Visitor Access Records (L) (M) (H)
The organization:

Maintains visitor access records to the facility where the information system resides for [FedRAMP Assignment: for a minimum of one (1) year]; and

Reviews visitor access records [FedRAMP Assignment: at least monthly]
Responsible Role:
|Parameter PE-8(a):
|Parameter PE-8(b):

|PE-8 What is the solution and how is it implemented?|
#
PE-9 Power Equipment and Cabling (M) (H)
The organization protects power equipment and power cabling for the information system from damage and destruction.
Responsible Role:

|PE-9 What is the solution and how is it implemented?|
#
PE-10 Emergency Shutoff (M) (H)
The organization:

Provides the capability of shutting off power to the information system or individual system components in emergency situations;

Places emergency shutoff switches or devices in [Assignment: organization-defined location by information system or system component] to facilitate safe and easy access for personnel; and

Protects emergency power shutoff capability from unauthorized activation.
Responsible Role:
|Parameter PE-10(b):

|PE-10 What is the solution and how is it implemented?|
Part c

#
PE-11 Emergency Power (M) (H)
The organization provides a short-term uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the information system; transition of the information system to long-term alternate power] in the event of a primary power source loss.
Responsible Role:
|Parameter PE-11:

|PE-11 What is the solution and how is it implemented?|
#
PE-12 Emergency Lighting (L) (M) (H)
The organization employs and maintains automatic emergency lighting for the information system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility.
Responsible Role:

|PE-12 What is the solution and how is it implemented?|
#
PE-13 Fire Protection (L) (M) (H)
The organization employs and maintains fire suppression and detection devices/systems for the information system that are supported by an independent energy source.
Responsible Role:

|PE-13 What is the solution and how is it implemented?|
#
PE-13 (2) Control Enhancement (M) (H)
The organization employs fire suppression devices/systems for the information system that provide automatic notification of any activation [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders].
Responsible Role:
|Parameter PE-13(2)-1:
|Parameter PE-13(2)-2:

|PE-13 (2) What is the solution and how is it implemented?|
#
PE-13 (3) Control Enhancement (M) (H)
The organization employs an automatic fire suppression capability for the information system when the facility is not staffed on a continuous basis.
Responsible Role:

|PE-13 (3) What is the solution and how is it implemented?|
#
PE-14 Temperature and Humidity Controls (L) (M) (H)
The organization:

Maintains temperature and humidity levels within the facility where the information system resides at [FedRAMP Assignment: consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled "Thermal Guidelines for Data Processing Environments]; and

PE-14 (a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider measures temperature at server inlets and humidity levels by dew point.
Monitors temperature and humidity levels [FedRAMP Assignment: continuously].
Responsible Role:
|Parameter PE-14(a):
|Parameter PE-14(b):
|Parameter PE-14(b) Additional:

|PE-14 What is the solution and how is it implemented?|
#
PE-14 (2) Control Enhancement (M) (H)
The organization employs temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment.
Responsible Role:

|PE-14 (2) What is the solution and how is it implemented?|
#
PE-15 Water Damage Protection (L) (M) (H)
The organization protects the information system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel.
Responsible Role:

|PE-15 What is the solution and how is it implemented?|
#
PE-16 Delivery and Removal (L) (M) (H)
The organization authorizes, monitors, and controls [FedRAMP Assignment: all information system components] entering and exiting the facility and maintains records of those items.
Responsible Role:
|Parameter PE-16:

|PE-16 What is the solution and how is it implemented?|
#
PE-17 Alternate Work Site (M) (H)
The organization:

Employs [Assignment: organization-defined security controls] at alternate work sites;

Assesses as feasible, the effectiveness of security controls at alternate work sites; and

Provides a means for employees to communicate with information security personnel in case of security incidents or problems.
Responsible Role:
|Parameter PE-17(a):

|PE-17 What is the solution and how is it implemented?|
Part c
Security Assessment and Authorization (CA)
#
CA-1 Certification, Authorization, Security Assessment Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security assessment and authorization policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security assessment and authorization policy and associated security assessment and authorization controls; and

Reviews and updates the current:

Security assessment and authorization policy [FedRAMP Assignment: at least every three (3) years]; and

Security assessment and authorization procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter CA-1(a):
|Parameter CA-1(b)(1):
|Parameter CA-1(b)(2):

|CA-1 What is the solution and how is it implemented?|
#
CA-2 Security Assessments (L) (M) (H)
The organization:

Develops a security assessment plan that describes the scope of the assessment including:

Security controls and control enhancements under assessment;

Assessment procedures to be used to determine security control effectiveness; and

Assessment environment, assessment team, and assessment roles and responsibilities;

Assesses the security controls in the information system and its environment of operation [FedRAMP Assignment: at least annually] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

Produces a security assessment report that documents the results of the assessment; and

Provides the results of the security control assessment to [FedRAMP Assignment: individuals or roles to include the FedRAMP Program Management Office (PMO)].

CA-2 Additional FedRAMP Requirements and Guidance

Guidance: See the FedRAMP Documents page under Key Cloud Service
Provider (CSP) Documents> Annual Assessment Guidance https://www.fedramp.gov/documents/
Responsible Role:
|Parameter CA-2(b):
|Parameter CA-2(d):

|CA-2 What is the solution and how is it implemented?|
#
CA-2 (1) Control Enhancement (L) (M) (H)
The organization employs assessors or assessment teams with [Assignment: organization-defined level of independence] to conduct security control assessments.

CA-2 (1) Additional FedRAMP Requirements and Guidance:

Requirement: For JAB Authorization, must use an accredited Third Party Assessment Organization (3PAO).
Responsible Role:
|Parameter CA-2(1):

|CA-2 (1) What is the solution and how is it implemented?|
#
CA-2 (2) Control Enhancement (M) (H)
The organization includes as part of security control assessments, [FedRAMP Assignment: at least annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: organization-defined other forms of security assessment]].

CA-2 (2) Additional FedRAMP Requirements and Guidance:

Requirement: To include 'announced', 'vulnerability scanning’ to occur at least annually.
Responsible Role:
|Parameter CA-2(2)-1:
|Parameter CA-2(2)-2:
|Parameter CA-2(2)-3:
|Parameter CA-2(2)-4:

|CA-2 (2) What is the solution and how is it implemented?|
#
CA-2 (3) Control Enhancement (M) (H)
The organization accepts the results of an assessment of [FedRAMP Assignment: organization-defined information system] performed by [FedRAMP Assignment: any FedRAMP Accredited 3PAO] when the assessment meets [FedRAMP Assignment: the conditions of the JAB/AO in the FedRAMP Repository].
Responsible Role:
|Parameter CA-2(3)-1:
|Parameter CA-2(3)-2:
|Parameter CA-2(3)-3:

|CA-2 (3) What is the solution and how is it implemented?|
#
CA-3 System Interconnections (L) (M) (H)
The organization:

Authorizes connections from the information system to other information systems through the use of Interconnection Security Agreements;

Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and

Reviews and updates Interconnection Security Agreements [FedRAMP Assignment: at least annually and on input from FedRAMP].

|Authorized Connections Information System Name|Name of Organization CSP Name System Connects To|Role and Name of Person Who Signed Connection Agreement|Name and Date of Interconnection Agreement|
Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|
|Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|
|Authorized Connections System Name|Name Org CSP System Connects To|Role and Name Signed Connection Agreement|Name and Date of Interconnection Agreement|
Responsible Role:
|Parameter CA-3(c):

|CA-3 What is the solution and how is it implemented?|
Part a: See System Interconnections for information about implementation.|
|Part b: See Table Control Origination and Definitions and Table System Interconnections for information about implementation.|

#
CA-3 (3) Control Enhancement (M) (H)
The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [FedRAMP Assignment: boundary protections which meet Trusted Internet Connection (TIC) requirements].

CA-3 (3) Additional FedRAMP Requirements and Guidance:

Guidance: Refer to Appendix H – Cloud Considerations of the TIC Reference Architecture document. Link: https://www.dhs.gov/publication/tic-reference-architecture-22
Responsible Role:
|Parameter CA-3(c):

|CA-3 What is the solution and how is it implemented?|
Part a: See System Interconnections for information about implementation.|
|Part b: See Table Control Origination and Definitions and Table System Interconnections for information about implementation.|

#
CA-3 (3) Control Enhancement (M) (H)
The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [FedRAMP Assignment: boundary protections which meet Trusted Internet Connection (TIC) requirements].

CA-3 (3) Additional FedRAMP Requirements and Guidance:

Guidance: Refer to Appendix H – Cloud Considerations of the TIC Reference Architecture document. Link: https://www.dhs.gov/publication/tic-reference-architecture-22
Responsible Role:
|Parameter CA-3(3)-1:
|Parameter CA-3(3)-2:

|CA-3 (3) What is the solution and how is it implemented?|
#