Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-2 (12) What is the solution and how is it implemented? IA-3 Device Identification and Authentication (M) (H) The information system uniquely identifies and authenticates [Assignment: organization-defined specific and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection. IA-3 Control Summary Information Responsible Role: Parameter IA-3-1: Parameter IA-3-2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-3 What is the solution and how is it implemented? IA-4 Identifier Management (L) (M) The organization manages information system identifiers for users and devices by:
Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IR-4 (1) What is the solution and how is it implemented? IR-5 Incident Monitoring (L) (M) (H) The organization tracks and documents information system security incidents. IR-5 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IR-5 What is the solution and how is it implemented? IR-6 Incident Reporting (L) (M) (H) The organization: Requires personnel to report suspected security incidents to the organizational incident response capability within [FedRAMP Assignment: US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended)]; and Reports security incident information to [Assignment: organization-defined
components. If PII is discovered, a Privacy Impact Assessment is performed. The Privacy Impact Assessment template used by can be found in Section 3. This section constitutes the Privacy Threshold Analysis and findings. Qualifying Questions Does the ISA collect, maintain, or share PII in any identifiable form? Does the ISA collect, maintain, or share PII information from or about the public? Has a Privacy Impact Assessment ever been performed for the ISA? Is there a Privacy Act System of Records Notice (SORN) for this ISA system? If yes; the SORN identifier and name is: If answers to Questions 1-4 are all “No” then a Privacy Impact Assessment may be omitted. If any of the answers to Question 1-4 are “Yes” then complete a Privacy Impact Assessment. Designation Check one. A Privacy Sensitive System Not a Privacy Sensitive System (in its current version) The Privacy Impact Assessment Template can be found on the following FedRAMP website page: .