CM-3 (6) What is the solution and how is it implemented? CM-4 (1) - Security Impact Analysis | Separate Test Environments The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. CM-4 (1) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-4 (1) What is the solution and how is it implemented? CM-5 (6) – Access Restrictions for Change | Limit Library Privileges The organization limits privileges to change software resident within software libraries. CM-5 (6) Control Summary Information Responsible Role:
Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> CM-7 (5) What is the solution and how is it implemented? Part a Part c CM-8 Information System Component Inventory The organization: Develops and documents an inventory of information system components that: Accurately reflects the current information system; Includes all components within the authorization boundary of the information system; Is at the level of granularity deemed necessary for tracking and reporting; and Includes [DoD Assignment: hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name]; and CM-8 Control Summary Information Responsible Role: Parameter CM-8(a)(4): Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned
Physical system location(s) (e.g. Washington DC, Los Angeles, CA) Sources, methods, or tools used to identify the incident (e.g. Intrusion Detection System or audit log analysis) Any additional information relevant to the incident and not included above. DoD guidance: For CSOs that are multi-tenant or otherwise shared across Federal Agencies outside of the DoD, incidents will be reported to US-CERT as required by FedRAMP, in parallel with reporting to DoD. For CSOs providing dedicated infrastructure to the DoD, incidents regarding that infrastructure and CSOs will not be reported to US-CERT, but directly to the DoD. The DoD Tier 1 (USCYBERCOM/JFHQ DoDIN) will handle coordination with US-CERT and other entities as appropriate. IR-6 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation - equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IR-6 What is the solution and how is it implemented? Part a Part b
Not implemented – risk acceptance sought Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AC-3(4) What is the solution and how is it implemented? Part a Part b Part c Part d Part e AC-12 (1) – Session Termination| User-Initiated Logouts/Message Displays The information system: (a) Provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [DoD Assignment: all resources]; and (b) Displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.