CSP IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer etc.) Data Direction (incoming, outgoing, or both) Information Being Transmitted Ports or Circuit # Table 11- 1. System Interconnections
Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> AC-17 What is the solution and how is it implemented? Part a Part b AC-17 (1) The information system monitors and controls remote access methods. AC-17 (1) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific)
Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> CM-8 (1) What is the solution and how is it implemented? CM-8 (3) The organization: Employs automated mechanisms [FedRAMP Assignment: Continuously, using automated mechanisms with a maximum five-minute delay in detection] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies [Assignment: organization-defined personnel or roles]]. CM-8 (3) Control Enhancement Summary Information Responsible Role: Parameter CM-8(3)(a): Parameter CM-8(3)(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply):
PA> MP-7 (1) What is the solution and how is it implemented? (PE) (PE-1) The organization: Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]: A physical and environmental protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls; and Reviews and updates the current: Physical and environmental protection policy [FedRAMP Assignment: at least every 3 years]; and Physical and environmental protection procedures [FedRAMP Assignment: at least annually]. PE-1 Control Summary Information Responsible Role: Parameter PE-1(a): Parameter PE-1(b)(1): Parameter PE-1(b)(2): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply):
Part b Part c Part d Part e RA-5 (1) The organization employs vulnerability scanning tools that include the capability to readily update the list of information system vulnerabilities to be scanned. RA-5 (1) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of
SA-3 What is the solution and how is it implemented? Part a Part b Part c Part d (SA-4) The organization includes the following requirements, descriptions, and criteria, explicitly or by reference, in the acquisition contract for the information system, system component, or information system service in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, guidelines, and organizational mission/business needs: Security functional requirements; Security strength requirements; Security assurance requirements; Security-related documentation requirements; Requirements for protecting security-related documentation; Description of the information system development environment and environment in which the system is intended to operate; and Acceptance criteria. Additional FedRAMP Requirements and Guidance: Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See or . SA-4 Control Summary Information Responsible Role: Implementation Status (check all that apply):