System Security Plan Addendum Prepared by Identification of Organization that Prepared this Document <insert logo> Organization Name Street Address Suite/Room/Building City, State Zip Prepared for Identification of Cloud Service Provider <insert logo> Organization Name Street Address Suite/Room/Building City, State Zip
Responsible Role: Parameter (c) : Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> AC-2 (7) c What is the solutions and how is it implemented? AC-2(9) Account Management| Restrictions on Use of Shared Groups/Accounts The organization only permits the use of shared/group accounts that meet [DoD Assignment: The CSP defines conditions for establishing shared/group accounts, if applicable. The conditions are approved and accepted by the DISA AO]. Additional DoD Requirement: In support of auditing and accountability, shared/group accounts are not permitted unless the requirement to uniquely attribute user activity to the account is implemented; exceptions may be approved on a case-by-case basis. Personal accounts will not be shared. FedRAMP v2 baseline parameter: [Additional Requirements and Guidance: required if shared group accounts are deployed]
CA-3(5) – System Interconnections |Restrictions on External System Connections The organization employs [DoD Selection: deny-all, permit-by-exception] policy for allowing [DoD Assignment: any information system requiring external connectivity ] to connect to external information systems.] CA-3(5) Control Summary Information Responsible Role: Parameter 1: Parameter 2: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CA-3(5) What is the solution and how is it implemented? CA-6 Security Authorization The organization: c. Updates the security authorization [DoD Assignment: at least every three years, or whenever there is a significant change to the system, or whenever there is a change to the environment in which the system operates ] Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1,
Establishment of [DoD Assignment: monthly] for monitoring and [DoD Assignment: annually] for assessments supporting such monitoring; Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; Correlation and analysis of security-related information generated by assessments and monitoring; Response actions to address results of the analysis of security-related information; and Reporting the security status of organization and the information system to [DoD Assignment: Appropriate AO] [DoD Assignment: monthly]. DoD Additional Guidance: The CSP Continuous Monitoring strategy is expected to be consistent with CNSSI 4009 as well as NIST SP 800-137. DoD Additional Requirement: The vulnerability reports and POA&Ms developed by the CSPs as part of continuous monitoring requirements supporting both FedRAMP and FedRAMP+ requirements will be made available to DISA’s cloud services support team and subsequently to the MCD and BCD providers for their collective use in providing Cyber Defense. For both FedRAMP and FedRAMP+ requirements, high and critical risk findings must be mitigated within 30 days. Moderate findings must be mitigated within 90 days. Low findings must be mitigated within 120 days. DoD Additional Requirement: For CSO’s obtaining FedRAMP v2 baseline provisional authorization for the JAB, the CSP will provide all FedRAMP ISSO and all DoD-related continuous monitoring artifacts directly to the DISA AO representatives. CSPs, 3PAOs, and DoD assessors are responsible for providing deliverables attesting to the implementation of security controls. In some cases, CSPs will provide continuous monitoring artifacts directly to DISA. In such cases, the CSP will utilize commercial standard formats (e.g., comma-separated values, XML) that enable DoD to automate the ingest of continuous monitoring data. For XML exchanges, National Information Exchange Model (NIEM) based XML is the preferred format IAW DoDI 8320.07, August 3, 2015. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a DoD SCA organization, all continuous monitoring reports and artifacts will be provided to the DISA AO representatives. DoD Additional Requirement: For CSOs obtaining FedRAMP v2 baseline authorization from a non-DoD Federal Agency, the CSP will provide all continuous monitoring materials and artifacts to the DISA AO representatives.
IR-8 Incident Response Plan The organization: Develops an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the structure and organization of the incident response capability; Provides a high-level approach for how the incident response capability fits into the overall organization; Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; Defines reportable incidents; Provides metrics for measuring the incident response capability within the organization. Defines the resources and management support needed to effectively maintain and mature an incident response capability; and Is reviewed and approved by [DoD Assignment: at a minimum, the ISSM and ISSO]; IR-8(a) Additional DoD Requirement: CSOs will provide, either as part of their Incident Response Plan or through an Incident Response Plan Addendum, their approach to fulfilling DoD Cyber Defense integration requirements to specifically address cyber incidents and data breaches, where a “breach” or cyber incident includes the loss of control, compromise, unauthorized acquisition, unauthorized access, or any similar term referring to situations where any unauthorized person has access or potential access to government data, whether in electronic or non-electronic form, for any unauthorized purpose. CSPs must ensure that the plan or addendum addresses all incidents regardless of the time, day, or location of the incident and must provide for notice to the Government of any breach of its data. The plan or addendum must incorporate any other policies or procedures that the Government may require to be followed in the event of an incident, including, but not limited to: To whom within the Government, the incident will be reported in accordance with the incident reporting process; Specific steps to be taken in order to mitigate or remedy the incident, including time periods for taking such steps (e.g., reporting of Personally Identifiable Information (PII) data breaches within one hour, Negligent Disclosure of Classified Information (NDCIs) which are commonly referred to as spillages); How and under what circumstances any individuals or entities affected by an incident will be notified and by whom; and Any other special instructions for handling computer security incidents affecting, or potentially affecting U.S. Government data; consistent with guidance and policy directives issued by DoD, NIST, US-CERT and CNSS for incident management, classification, and remediation; or other applicable law, regulation, order, or policy. Distributes copies of the incident response plan to [DoD Assignment: all
Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SC-7(11) What is the solution and how is it implemented? SC-7(14) Boundary Protection | Protects Against Unauthorized Physical Connections The organization protects against unauthorized physical connections at [DoD Assignment: internet access points, enclave LAN to WAN, cross domain solutions, and any DoD Approved Alternate Gateways]. SC-7(14) Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate