rkreddyp/nist_800_53 huggingface dataset:
CP-9 Information System Backup (L) (M) (H)
The organization:

CP-9 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.
Conducts backups of user-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full]

CP-9 (a) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online).
Conducts backups of system-level information contained in the information system [FedRAMP Assignment: daily incremental; weekly full];

CP-9 (b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online).
Conducts backups of information system documentation including security-related documentation [FedRAMP Assignment: daily incremental; weekly full ]; and

CP-9 (c) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online).
Protects the confidentiality, integrity, and availability of backup information at storage locations.
Responsible Role:
|Parameter CP-9(a):
|Parameter CP-9(b):
|Parameter CP-9(c):

|CP-9 What is the solution and how is it implemented?|
#
CP-9 (1) Control Enhancement (M)
The organization tests backup information [FedRAMP Assignment: at least annually] to verify media reliability and information integrity.
Responsible Role:
|Parameter CP-9 (1):

|CP-9 (1) What is the solution and how is it implemented?|
#
CP-9 (3) Control Enhancement (M) (H)
The organization stores backup copies of [Assignment: organization-defined critical information system software and other security-related information] in a separate facility or in a fire-rated container that is not collocated with the operational system.
Responsible Role:
|Parameter CP-9(3):

|CP-9 (3) What is the solution and how is it implemented?|
#
CP-10 Information System Recovery and Reconstitution (L) (M) (H)
The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.
Responsible Role:
|Parameter CP-10:

|CP-10 What is the solution and how is it implemented?|
#
CP-10 (2) Control Enhancement (M) (H)
The information system implements transaction recovery for systems that are transaction-based.
Responsible Role:

|CP-10 (2) What is the solution and how is it implemented?|
---
title: Identification and Authentication (IA)
---
IA-8 (4) Control Enhancement (L) (M) (H)
The information system conforms to FICAM-issued profiles.
Responsible Role:

|IA-8 (4) What is the solution and how is it implemented?|
---
title: Incident Response (IR)
---
Incident Response (IR)
#
IR-1 Incident Response Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

An incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the incident response policy and associated incident response controls; and

Reviews and updates the current:

Incident response policy [FedRAMP Assignment: at least every three (3) years]; and

Incident response procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter IR-1(a):
|Parameter IR-1(b)(1):
|Parameter IR-1(b)(2):

|IR-1 What is the solution and how is it implemented?|
#
IR-2 Incident Response Training (L) (M)
The organization provides incident response training to information system users consistent with assigned roles and responsibilities in accordance with NIST SP 800-53 Rev 4:

Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility;

When required by information system changes; and

[FedRAMP Assignment: at least annually] thereafter.
Responsible Role:
|Parameter IR-2(a):
|Parameter IR-2(c):

|IR-2 What is the solution and how is it implemented?|
#
IR-3 Incident Response Testing (M)
The organization tests the incident response capability for the information system [FedRAMP Assignment: at least annually] using [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance] to determine the incident response effectiveness and documents the results.

IR-3 Additional FedRAMP Requirements and Guidance:

Requirements: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). For JAB authorization, the service provider provides test plans to the JAB/AO annually. Test plans are approved and accepted by the JAB/AO prior to the test commencing.
Responsible Role:
|Parameter IR-3-1:
|Parameter IR-3-2:

|IR-3 What is the solution and how is it implemented?|
#
IR-3 (2) Control Enhancement (M) (H)
The organization coordinates incident response testing with organizational elements responsible for related plans.
Responsible Role:

|IR-3 (2) What is the solution and how is it implemented?|
#
IR-4 Incident Handling (L) (M) (H)
The organization:

Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

Coordinates incident handling activities with contingency planning activities; and

Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing/exercises, and implements the resulting changes accordingly.

IR-4 Additional FedRAMP Requirements and Guidance:

Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.
Responsible Role:

|IR-4 What is the solution and how is it implemented?|
Part c

#
IR-4 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to support the incident handling process.
Responsible Role:

|IR-4 (1) What is the solution and how is it implemented?|
#
IR-5 Incident Monitoring (L) (M) (H)
The organization tracks and documents information system security incidents.

#
IR-4 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to support the incident handling process.
Responsible Role:

|IR-5 What is the solution and how is it implemented?|
#
IR-6 Incident Reporting (L) (M) (H)
The organization:

Requires personnel to report suspected security incidents to the organizational incident response capability within [FedRAMP Assignment: US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended)]; and

Reports security incident information to [Assignment: organization-defined authorities].

IR-6 Additional FedRAMP Requirements and Guidance

Requirement: Report security incident information according to FedRAMP Incident Communications Procedure.
Responsible Role:
|Parameter IR-6(a):
|Parameter IR-6(b):

|IR-6 What is the solution and how is it implemented?|
#
IR-6 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to assist in the reporting of security incidents.
Responsible Role:

|IR-6 (1) What is the solution and how is it implemented?|
#
IR-7 Incident Response Assistance (L) (M) (H)
The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for the handling and reporting of security incidents.
Responsible Role:

|IR-7 What is the solution and how is it implemented?|
#
IR-7 (1) Control Enhancement (M) (H)
The organization employs automated mechanisms to increase the availability of incident response related information and support.
Responsible Role:

|IR-7 (1) What is the solution and how is it implemented?|
#
IR-7 (2) Control Enhancement (M) (H)
The organization:

Establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability; and

Identifies organizational incident response team members to the external providers.
Responsible Role:

|IR-7 (2) What is the solution and how is it implemented?|
#
IR-8 Incident Response Plan (L) (M) (H)
The organization:

Develops an incident response plan that:

Provides the organization with a roadmap for implementing its incident response capability;

Describes the structure and organization of the incident response capability;

Provides a high-level approach for how the incident response capability fits into the overall organization;

Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;

Defines reportable incidents;

Provides metrics for measuring the incident response capability within the organization;

Defines the resources and management support needed to effectively maintain and mature an incident response capability; and

Is reviewed and approved by [Assignment: organization-defined personnel or roles];

Distributes copies of the incident response plan to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance].

IR-8(b) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
Reviews the incident response plan [FedRAMP Assignment: at least annually];

Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing;

Communicates incident response plan changes to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance]; and

IR-8(e) Additional FedRAMP Requirements and Guidance:

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
Protects the incident response plan from unauthorized disclosure and modification.
Responsible Role:
|Parameter IR-8(a)(8):
|Parameter IR-8(b):
|Parameter IR-8(c):
|Parameter IR-8(e):

|IR-8 What is the solution and how is it implemented?|
#
IR-9 Information Spillage Response (M) (H)
The organization responds to information spills by:

Identifying the specific information involved in the information system contamination;

Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;

Isolating the contaminated information system or system component;

Eradicating the information from the contaminated information system or component;

Identifying other information systems or system components that may have been subsequently contaminated; and

Performing other [Assignment: organization-defined actions].
Responsible Role:
|Parameter IR-9(b):
|Parameter IR-9(f):

|IR-9 What is the solution and how is it implemented?|
#
IR-9 (1) Control Enhancement (M) (H)
The organization assigns [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills.
Responsible Role:
|Parameter IR-9(1):

|IR-9 (1) What is the solution and how is it implemented?|
#
IR-9 (2) Control Enhancement (M)
The organization provides information spillage response training [Assignment: organization- defined frequency].
Responsible Role:
|Parameter IR-9(2):

|IR-9 (2) What is the solution and how is it implemented?|
#
IR-9 (3) Control Enhancement (M) (H)
The organization implements [Assignment: organization-defined procedures] to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.
Responsible Role:
|Parameter IR-9(3):

|IR-9 (3) What is the solution and how is it implemented?|
#
IR-9 (4) Control Enhancement (M) (H)
The organization employs [Assignment: organization-defined security safeguards] for personnel exposed to information not within assigned access authorizations.
Responsible Role:
|Parameter IR-9(4):

|IR-9 (4) What is the solution and how is it implemented?|
---
title: Maintenance (MA)
---
MA-6 Timely Maintenance (M) (H)
The organization obtains maintenance support and/or spare parts for [Assignment: organization-defined information system components] within [Assignment: organization-defined time period] of failure.
Responsible Role:
|Parameter MA-6(1):
|Parameter MA-6(2):

|MA-6 What is the solution and how is it implemented?|
---
title: Media Protection (MP)
---
MP-7 (1) Control Enhancement (M) (H)
The organization prohibits the use of portable storage devices in organizational information systems when such devices have no identifiable owner.
Responsible Role:

|MP-7 (1) What is the solution and how is it implemented?|
---
title: Physical and Environmental Protection (PE)
---
PE-17 Alternate Work Site (M) (H)
The organization:

Employs [Assignment: organization-defined security controls] at alternate work sites;

Assesses as feasible, the effectiveness of security controls at alternate work sites; and

Provides a means for employees to communicate with information security personnel in case of security incidents or problems.
Responsible Role:
|Parameter PE-17(a):

|PE-17 What is the solution and how is it implemented?|
Part c
---
title: Planning (PL)
---
Planning (PL)
#
PL-1 Security Planning Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A security planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the security planning policy and associated security planning controls; and

Reviews and updates the current:

Security planning policy [FedRAMP Assignment: at least every three (3) years]; and

Security planning procedures [FedRAMP Assignment: at least annually].
Responsible Role:
|Parameter PL-1(a):
|Parameter PL-1(b)(1):
|Parameter PL-1(b)(2):

|PL-1 What is the solution and how is it implemented?|
#
PL-2 System Security Plan (L) (M) (H)
The organization:

Develops a security plan for the information system that:

Is consistent with the organization’s enterprise architecture;

Explicitly defines the authorization boundary for the system;

Describes the operational context of the information system in terms of missions and business processes;

Provides the security categorization of the information system including supporting rationale;

Describes the operational environment for the information system and relationships with or connections to other information;

Provides an overview of the security requirements for the system;

Identifies any relevant overlays, if applicable;

Describes the security controls in place or planned for meeting those requirements including a rationale for the tailoring decisions; and

Is reviewed and approved by the authorizing official or designated representative prior to plan implementation;

Distributes copies of the security plan and communicates subsequent changes to the plan to [Assignment: organization-defined personnel or roles];

Reviews the security plan for the information system [FedRAMP Assignment: at least annually];

Updates the plan to address changes to the information system/environment of operation or problems identified during plan implementation or security control assessments; and

Protects the security plan from unauthorized disclosure and modification.
Responsible Role:
|Parameter PL-2(b):
|Parameter PL-2(c):

|PL-2 What is the solution and how is it implemented?|
#
PL-2 (3) Control Enhancement (M) (H)
The organization plans and coordinates security-related activities affecting the information system with [Assignment: organization-defined individuals or groups] before conducting such activities in order to reduce the impact on other organizational entities.
Responsible Role:
|Parameter PL-2(3):

|PL-2 (3) What is the solution and how is it implemented?|
#
PL-4 Rules of Behavior (L) (M)
The organization:

Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage;

Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system;

Reviews and updates the rules of behavior [FedRAMP Assignment: at least every three (3) years]; and

Requires individuals who have signed a previous version of the rules of behavior to read and resign when the rules of behavior are revised/updated.
Responsible Role:
|Parameter PL-4(c):

|PL-4 What is the solution and how is it implemented?|
#
PL-4 (1) Control Enhancement (M) (H)
The organization includes in the rules of behavior, explicit restrictions on the use of social media/networking sites and posting organizational information on public websites.
Responsible Role:

|PL-4 (1) What is the solution and how is it implemented?|
#
PL-8 Information Security Architecture (M) (H)
The organization:

Develops an information security architecture for the information system that:

Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information;

Describes how the information security architecture is integrated into and supports the enterprise architecture; and

Describes any information security assumptions about, and dependencies on, external services;

Reviews and updates the information security architecture [FedRAMP Assignment: at least annually or when a significant change occurs] to reflect updates in the enterprise architecture; and

PL-8 (b) Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, on Page F-8.
Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.
Responsible Role:

|PL-8 What is the solution and how is it implemented?|
Part c
---
title: POAM Template
---

# Plan of Action and Milestones

|CSP|System Name|Impact Level|POAM Date|
Text|Text|Low/Moderate/High|Date|

|POAM ID|Controls|Weakness Name|Weakness Descriptio|Weakness Detector Source|Weakness Source Identifier|Asset Identifier|Point of Contac|Resources Required|Overall Remediation Plan|Original Detection Date|Scheduled Completion Date|Planned Milestones|Milestone Changes|Status Date|Vendor Dependence|Last Vendor Check-in Date|Vendor Dependent Product Name|Original Risk Rating|Adjusted Risk Rating|Risk Adjustment|False Positive|Operational Requirement|Deviation Rationale|Supporting Documents|Comments|Auto-Approve|
V-1Example|AC-1|Open port on Example Firewall|Unprovisioned port left open on example firewall|Nessus|	12345|172.246.15.3 (80/TCP) http://vuln.gov/queries 172.246.16.17 (80/tcp)|John Doe - Example CSP||	Implement a technical solution to the problem.|5/5/2014|8/3/2014|(1) 2014/05/23: Milestone Description
(2) 2014-06-12: Milestone Description|(2) Update 2014-06-18 : That milestone was delayed due to a Vendor Dependency
(3) New 2014-06-13 : This is the details of this new milestone|8/5/2014|	Yes|8/5/2014|Example Firewall|High|Moderate|Yes|No|Pending|Risk Adjustment: The example firewall scanned is just preliminary
Operational Requirement: The port is needed for service example.|Remediation Evidence : filename.doc
Deviation Request : DR-123-Example-1.doc|none|no|
---
title: Personnel Security (PS)
---
PS-8 Personnel Sanctions (L) (M)
The organization:

Employs a formal sanctions process for personnel failing to comply with established information security policies and procedures; and

Notifies [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
Responsible Role:
|Parameter PS-8(b)-1:
|Parameter PS-8(b)-2:

|PS-8 What is the solution and how is it implemented?|
---
title: Risk Assessment (RA)
---
RA-5 (8) Control Enhancement (L) (M) (H)
The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
RA-5 (8) Additional FedRAMP Requirements and Guidance:

Requirement: This enhancement is required for all high vulnerability scan findings.
Guidance: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.
Responsible Role:

|RA-8 What is the solution and how is it implemented?|
---
title: System and Services Acquisition (SA)
---
SA-11 (8) Control Enhancement (M) (H)
The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.
Responsible Role:

|SA-11 (8) What is the solution and how is it implemented?|
---
title: System and Communications Protection (SC)
---
SC-39 Process Isolation (L) (M) (H)
The information system maintains a separate execution domain for each executing process.
Responsible Role:

|SC-39 What is the solution and how is it implemented?|
---
title: System and Information Integrity (SI)
---
System and Information Integrity (SI)
#
SI-1 System and Information Integrity Policy and Procedures (L) (M)
The organization:

Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:

A system and information integrity policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and

Procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls; and

Reviews and updates the current:

System and information integrity policy [FedRAMP Assignment: at least every three (3) years]; and

System and information integrity procedures [FedRAMP Assignment: at least at least annually].
Responsible Role:
|Parameter SI-1(a):
|Parameter SI-1(b)(1):
|Parameter SI-1(b)(2):

|SI-1 What is the solution and how is it implemented?|
#
SI-2 Flaw Remediation (L) (M) (H)
The organization:

Identifies, reports, and corrects information system flaws;

Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation;

Installs security-relevant software and firmware updates within [FedRAMP Assignment: thirty 30 days of release of updates] of the release of the updates; and

Incorporates flaw remediation into the organizational configuration management process.
Responsible Role:
|Parameter SI-2(c):

|SI-2 What is the solution and how is it implemented?|
#
SI-2 (2) Control Enhancement (M) (H)
The organization employs automated mechanisms [FedRAMP Assignment: at least monthly] to determine the state of information system components with regard to flaw remediation.
Responsible Role:
|Parameter SI-2 (2):

|SI-2 What is the solution and how is it implemented?|
#
SI-2 (3) Control Enhancement (M) (H)
The organization:

Measures the time between flaw identification and flaw remediation; and

Establishes [Assignment: organization-defined benchmarks] for taking corrective actions.
Responsible Role:
|Parameter SI-2(3)(b):

|SI-2 (3) What is the solution and how is it implemented?|
#
SI-3 Malicious Code Protection (L) (M)
The organization:

Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code;

Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures;

Configures malicious code protection mechanisms to:

Perform periodic scans of the information system [FedRAMP Assignment: at least weekly] and real-time scans of files from external sources at [FedRAMP Assignment: to include endpoints] as the files are downloaded, opened, or executed in accordance with organizational security policy; and

[FedRAMP Assignment: to include alerting administrator or defined security personnel] in response to malicious code detection; and

Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.
Responsible Role:
|Parameter SI-3(c)(1)-1:
|Parameter SI-3(c)(1)-2:
|Parameter SI-3(c)(2):

|SI-2 (3) What is the solution and how is it implemented?|
#
1. SI-3 (1) Control Enhancement (M) (H)
The organization centrally manages malicious code protection mechanisms.
Responsible Role:

|SI-3 (1) What is the solution and how is it implemented?|
#
SI-3 (2) Control Enhancement (M) (H)
The information system automatically updates malicious code protection mechanisms.
Responsible Role:

|SI-3 (2) What is the solution and how is it implemented?|
#
SI-3 (7) Control Enhancement (M) (H)
The information system implements nonsignature-based malicious code detection mechanisms.
Responsible Role:

|SI-3 (7) What is the solution and how is it implemented?|
#
SI-4 Information System Monitoring (L) (M) (H)
The organization:

Monitors the information system to detect:

Attacks and indicators of potential attacks in accordance with [Assignment: organization-defined monitoring objectives]; and

Unauthorized local, network, and remote connections;

Identifies unauthorized use of the information system through [Assignment: organization-defined techniques and methods];

Deploys monitoring devices (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization;

Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion;

Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information;

Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and

Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].

SI-4 Additional FedRAMP Requirements and Guidance:
Guidance: See US-CERT Incident Response Reporting Guidelines.
Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:

|SI-4 What is the solution and how is it implemented?|
#
SI-4 (1) Control Enhancement (M) (H)
The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.
Responsible Role:
|Parameter SI-4(a)(1):
|Parameter SI-4(b):
|Parameter SI-4(g)-1:
|Parameter SI-4(g)-2:
|Parameter SI-4(g)-3:

|SI-4 (1) What is the solution and how is it implemented?|
#
1. SI-4 (2) Control Enhancement (M) (H)
The organization employs automated tools to support near real-time analysis of events.
Responsible Role:

|SI-4 (2) What is the solution and how is it implemented?|
#
SI-4 (4) Control Enhancement (M) (H)
The information system monitors inbound and outbound communications traffic [FedRAMP Assignment: continuously] for unusual or unauthorized activities or conditions.
Responsible Role:
|Parameter SI-4(4):

|SI-4 (4) What is the solution and how is it implemented?|
#
1. SI-4 (5) Control Enhancement (M) (H)
The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].

SI-4(5) Additional FedRAMP Requirements and Guidance:

Guidance: In accordance with the incident response plan.
Responsible Role:
|Parameter SI-4(5)-1:
|Parameter SI-4(5)-2:

|SI-4 (5) What is the solution and how is it implemented?|
#
SI-4 (14) Control Enhancement (M) (H)
The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system.
Responsible Role:

|SI-4 (14) What is the solution and how is it implemented?|
#
SI-4 (16) Control Enhancement (M) (H)
The organization correlates information from monitoring tools employed throughout the information system.
Responsible Role:

|SI-4 (16) What is the solution and how is it implemented?|
#
SI-4 (23) Control Enhancement (M) (H)
The organization implements [Assignment: organization-defined host-based monitoring mechanisms] at [Assignment: organization-defined information system components].
Responsible Role:
|Parameter SI-4(23)-1:
|Parameter SI-4(23)-2:

|SI-4 (23) What is the solution and how is it implemented?|
#
SI-5 Security Alerts & Advisories (L) (M) (H)
The organization:

Receives information system security alerts, advisories, and directives from [FedRAMP Assignment: to include US-CERT] on an ongoing basis;

Generates internal security alerts, advisories, and directives as deemed necessary;

Disseminates security alerts, advisories, and directives to [FedRAMP Assignment: to include system security personnel and administrators with configuration/patch-management responsibilities]; and

Implements security directives in accordance with established time frames, or notifies the issuing organization of the degree of noncompliance.
Responsible Role:
|Parameter SI-5(a):
|Parameter SI-5(c):

|SI-5 What is the solution and how is it implemented?|
#
SI-6 Security Functionality Verification (M) (H)
The information system:

Verifies the correct operation of [Assignment: organization-defined security functions];

Performs this verification [FedRAMP Assignment: to include upon system startup and/or restart at least monthly];

Notifies [FedRAMP Assignment: to include system administrators and security personnel] of failed security verification tests; and

[Selection (one or more): shuts the information system down; restarts the information system; [FedRAMP Assignment: to include notification of system administrators and security personnel] when anomalies are discovered.
Responsible Role:
|Parameter SI-6(a):
|Parameter SI-6(b):
|Parameter SI-6(c):
|Parameter SI-6(d)-1:
|Parameter SI-6(d)-2:

|SI-6 What is the solution and how is it implemented?|
#
SI-7 Software & Information Integrity (M) (H)
The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].
Responsible Role:
|Parameter SI-7

|SI-7 What is the solution and how is it implemented?|
#
SI-7 (1) Control Enhancement (M) (H)
The information system performs an integrity check of [Assignment: organization-defined software, firmware, and information] [FedRAMP Selection (one or more): at startup; at [FedRAMP Assignment: to include security-relevant events]; [FedRAMP Assignment: at least monthly]].
Responsible Role:
|Parameter SI-7(1)-1:
|Parameter SI-7(1)-2:
|Parameter SI-7(1)-3:

|SI-7 (1) What is the solution and how is it implemented?|
#
SI-7 (7) Control Enhancement (M) (H)
The organization incorporates the detection of unauthorized [Assignment: organization-defined security-relevant changes to the information system] into the organizational incident response capability.
Responsible Role:
|Parameter SI-7 (7):

|SI-7 (7) What is the solution and how is it implemented?|
#
SI-8 Spam Protection (M) (H)
The organization:

Employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages; and

Updates spam protection mechanisms when new releases are available in accordance with organizational configuration management policies and procedures.
Responsible Role:
|Parameter SI-8:

|SI-8 What is the solution and how is it implemented?|
#
SI-8 (1) Control Enhancement (M) (H)
The organization centrally manages spam protection mechanisms.
Responsible Role:
|Parameter SI-8 (1):

|SI-8 (1) What is the solution and how is it implemented?|
#
SI-8 (2) Control Enhancement (M) (H)
The organization automatically updates spam protection mechanisms.
Responsible Role:

|SI-8 (2) What is the solution and how is it implemented?|
#
SI-10 Information Input Validation (M) (H)
The information system checks the validity of [Assignment: organization-defined information inputs].
Responsible Role:
|Parameter SI-10:

|SI-10 What is the solution and how is it implemented?|
#
SI-11 Error Handling (M) (H)
The information system:

Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries; and

Reveals error messages only to [Assignment: organization-defined personnel or roles].
Responsible Role:
|Parameter SI-11(b):

|SI-11 What is the solution and how is it implemented?|
#
SI-12 Information Output Handling and Retention (L) (M) (H)
The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.
Responsible Role:

|SI-12 What is the solution and how is it implemented?|
#
SI-16 Memory Protection (M) (H)
The information system implements [Assignment: organization-defined fail-safe procedures] to protect its memory from unauthorized code execution.
Responsible Role:
|Parameter SI-16-1:

|SI-16 What is the solution and how is it implemented?|
AC-22 Publicly Accessible Content (L) (M) (H)
The organization:

Designates individuals authorized to post information onto a publicly accessible information system;

Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information;

Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and

Reviews the content on the publicly accessible information system for nonpublic information [FedRAMP Assignment: at least quarterly] and removes such information, if discovered.
Responsible Role:
|Parameter AC-22

|AC-22 What is the solution and how is it implemented?|
AT-4 Security Training Records (L) (M)
The organization:

Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Retains individual training records for [FedRAMP Assignment: at least one year].
Responsible Role:
|Parameter AT-4(b)(c):

|AT-4 What is the solution and how is it implemented?|
Part a:
|Part b:
IR-9 (4) Control Enhancement (M) (H)
The organization employs [Assignment: organization-defined security safeguards] for personnel exposed to information not within assigned access authorizations.
Responsible Role:
|Parameter IR-9(4):

|IR-9 (4) What is the solution and how is it implemented?|
CP-10 (2) Control Enhancement (M) (H)
The information system implements transaction recovery for systems that are transaction-based.
Responsible Role:

|CP-10 (2) What is the solution and how is it implemented?|
AU-12 Audit Generation (L) (M) (H)
The information system:

Provides audit record generation capability for the auditable events defined in AU-2 a. at [FedRAMP Assignment: all information system components where audit capability is deployed/available];

Allows [Assignment: organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and

Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
Responsible Role:
|Parameter AU-12(a):
|Parameter AU-12(b):

|AU-12 What is the solution and how is it implemented?|
CM-11 User-Installed Software (M) (H)
The organization:

Establishes [Assignment: organization-defined policies] governing the installation of software by users;

Enforces software installation policies through [Assignment: organization-defined methods]; and

Monitors policy compliance [FedRAMP Assignment: Continuously (via CM-7 (5))].
Responsible Role:
|Parameter CM-11(a):
|Parameter CM-11(b):
|Parameter CM-11(c):

|CM-11 What is the solution and how is it implemented?|
PL-8 Information Security Architecture (M) (H)
The organization:

Develops an information security architecture for the information system that:

Describes the overall philosophy, requirements, and approach to be taken with regard to protecting the confidentiality, integrity, and availability of organizational information;

Describes how the information security architecture is integrated into and supports the enterprise architecture; and

Describes any information security assumptions about, and dependencies on, external services;

Reviews and updates the information security architecture [FedRAMP Assignment: at least annually or when a significant change occurs] to reflect updates in the enterprise architecture; and

PL-8 (b) Additional FedRAMP Requirements and Guidance:

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, on Page F-8.
Ensures that planned information security architecture changes are reflected in the security plan, the security Concept of Operations (CONOPS), and organizational procurements/acquisitions.
Responsible Role:

|PL-8 What is the solution and how is it implemented?|
Part c