This document is intended to be used by service providers who are applying for a Joint Authorization Board (JAB) Provisional Authorization to Operate (P-ATO) through the Federal Risk and Authorization Management Program (FedRAMP) U.S. Federal agencies may want to use it to document information systems security plans that are not part of the FedRAMP program. In the sections that follow, describe the information security control as it is implemented on the system. All controls originate from a system or from a business process. It is important to describe where the control originates from so that it is clear whose responsibility it is to implement, manage, and monitor the control. In some cases, the responsibility is shared by a CSP and by the customer. Use the definitions in the table that follows to indicate where each security control originates from. Note that “-1” Controls (AC-1, AU-1, SC-1 etc.) cannot be inherited and must be described in some way by the service provider. Throughout this SSP, policies and procedures must be explicitly referenced (title and date or version) so that it is clear which document is being referred to. Section numbers or similar mechanisms should allow the reviewer to easily find the reference. For SaaS and PaaS systems that are inheriting controls from an IaaS (or anything lower in the stack), the “inherited” check box must be checked and the implementation description must simply say “inherited.” FedRAMP reviewers will determine whether the control-set is appropriate or not. In Section 13, the NIST term "organization defined" must be interpreted as being the CSP's responsibility unless otherwise indicated. In some cases the JAB has chosen to define or provide parameters, in others they have left the decision up to the CSP. Delete this instruction from your final version of this document.
Instruction: List all interconnected systems. Provide the IP address and interface identifier (eth0, eth1, eth2) for the CSP system that provides the connection. Name the external organization and the IP address of the external system. Indicate how the connection is being secured. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number. Add additional rows as needed. This table must be consistent with Table 133 CA-3 Authorized Connections. Delete this and all other instructions from your final version of this document. The Table 111 System Interconnections below is consistent with Table 133 CA-3 Authorized Connections. Table System Interconnections SP IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer etc.) Data Direction (incoming, outgoing, or both) Information Being Transmitted Port or Circuit Numbers
AC-6 (1) Control Enhancement The organization explicitly authorizes access to [Assignment: organization-defined security functions (deployed in hardware, software, and firmware) and security-relevant information]. AC-6 (1) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-6 (1) What is the solution and how is it implemented? AC-6 (2) Control Enhancement The organization requires that users of information system accounts, or roles, with access to [FedRAMP Assignment: all security functions], use non-privileged accounts or roles, when accessing non-security functions. AC-6 (2) Additional FedRAMP Requirements and Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions. AC-6 (2) Control Summary Information Responsible Role: Parameter AC-6(2): Implementation Status (check all that apply): Implemented Partially implemented Planned
AC-8 System Use Notification The information system: Displays to users [Assignment: organization-defined system use notification message or banner (FedRAMP Assignment: see additional Requirements and Guidance)] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: Users are accessing a U.S. Government information system; Information system usage may be monitored, recorded, and subject to audit; Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and Use of the information system indicates consent to monitoring and recording; Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and For publicly accessible systems: Displays system use information [Assignment: organization-defined conditions (FedRAMP Assignment: see additional Requirements and Guidance)], before granting further access; Displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and Includes a description of the authorized uses of the system. AC-8 Additional FedRAMP Requirements and Guidance: Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO. Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB/AO. Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.
Inherited from pre-existing FedRAMP Authorization for , AU-7 (1) What is the solution and how is it implemented? AU-8 Time Stamps The information system: Uses internal system clocks to generate time stamps for audit records; and Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: one second granularity of time measurement]. AU-8 Control Summary Information Responsible Role: Parameter AU-8(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-8 What is the solution and how is it implemented? Part a Part b AU-8 (1) Control Enhancement The information system: Compares the internal information system clocks with [FedRAMP Assignment: authoritative time source: [] [at least hourly]]; and
Table CA-3 Authorized Connections Authorized Connections Information System Name Name of Organization System Connects To Role and Name of Person Who Signed Connection Agreement Name and Date of Interconnection Agreement CA-3 Control Summary Information Responsible Role: Parameter CA-3(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-7 (1) What is the solution and how is it implemented? Part a Part b CM-7 (2) Control Enhancement The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage]. CM-7(2) Additional FedRAMP Requirements and Guidance: Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run. CM-7 (2) Control Summary Information Responsible Role: Parameter CM-7(2): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-8 (3) What is the solution and how is it implemented? Part a Part b CM-8 (5) Control Enhancement The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories. CM-8 (5) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-8 (5) What is the solution and how is it implemented? CM-9 Configuration Management Plan The organization develops, documents, and implements a configuration management plan for the information system that:
Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IR-9 (1) What is the solution and how is it implemented? IR-9 (2) Control Enhancement The organization provides information spillage response training [Assignment: organization- defined frequency]. IR-9 (2) Control Summary Information Responsible Role: Parameter IR-9(2): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IR-9 (2) What is the solution and how is it implemented?
PE-2 Control Summary Information Responsible Role: Parameter PE-2(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PE-2 What is the solution and how is it implemented? Part a Part b Part c Part d PE-3 Physical Access Control The organization: Enforces physical access authorizations at [Assignment: organization-defined entry/exit points to the facility where the information system resides] by: Verifying individual access authorizations before granting access to the facility; and Controlling ingress/egress to the facility using [FedRAMP Assignment: CSP physical access control systems/devices AND guards]; Maintains physical access audit logs for [Assignment: organization-defined entry/exit points]; Provides [Assignment: organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; Escorts visitors and monitors visitor activity [FedRAMP Assignment: in all circumstances within restricted access area where the information system resides]; Secures keys, combinations, and other physical access devices; Inventories [Assignment: organization-defined physical access devices] every
SC-7 (13) Control Summary Information Responsible Role: Parameter SC-7(13): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , SC-7 (13) What is the solution and how is it implemented? SC-7 (18) Control Enhancement The information system fails securely in the event of an operational failure of a boundary protection device. SC-7 (18) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
ATTACHMENT 11 - All Authorization Packages must include a Separation of Duties Matrix attachment, which will be reviewed for quality. Maintain a current Revision History in the table below. ATTACHMENT 11 - Separation of Duties Matrix is referenced in the following controls. AC-5 Separation of Duties Additional FedRAMP Requirements and Guidance Separation of Duties Matrix Revision History Additional Comments:
HSPD-12 Homeland Security Presidential Directive Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], August 27, 2004 August 2004 x x HSPD-7 Homeland Security Presidential Directive Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7], December 17, 2003 December 2003 x x x OMB Circular Office of Management and Budget Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [, as amended] Rescinded by OMB Archived x x OMB Circular Office of Management and Budget Management’s Responsibility for Internal Control Revised December 2004 x x x OMB Circular Office of Management and Budget Management of Federal Information Resources, Revised, Transmittal Memorandum No. 4 November 2000 x x x x x x OMB Circular iii Office of Management and Budget Security of Federal Automated Information Systems, Appendix III November 2000 x x x x OMB M-01-05 Office of Management and Budget Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy December 2000 x x x x OMB M-03-22 Office of Management and Budget OMB Guidance for Implementing the Privacy Provisions September 2003 x OMB M-04-04 Office of Management and Budget E-Authentication Guidance for Federal Agencies December 2003 x x x x OMB M-06-16 Office of Management and Budget Protection of Sensitive Agency Information June 2006 x x x x
OMB M-07-16 Office of Management and Budget Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII) May 2007 x OMB M-10-23 Office of Management and Budget Guidance for Agency Use of Third-Party Websites June 2010 x OMB M-99-18 Office of Management and Budget Privacy Policies on Federal Web Sites June 1999 x PL 99-474 US Code Public Law Computer Fraud and Abuse Act , 18 USC 1030 October 1986 x x x x PL 100-503 US Code Public Law Consolidated Appropriations Act of 2005, Section 522 October 1988 x x PL 104-191 US Code Public Law Health Insurance Portability and Accountability Act of 1996 (HIPAA) August 1996 x PL 104-231 US Code Public Law Electronic Freedom of Information Act As Amended in 2002 [PL 104-231, 5 USC 552], October 2, 1996 October 1996 x x x x x PL 107-56 US Code Public Law USA Patriot Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism) October 2001 x PL 107-347 US Code Public Law E-Government Act [includes FISMA Title III] December 2002 x x x x x x PL 108-447 US Code Public Law Consolidated Appropriations Act of 2005, Section 522 September 2005 x PL 113-187 US Code Public Law 44 U.S.C The Presidential and Federal Records Act Amendments of 2014 showing changes to NARA Statutes found below in Chapters 21, 22, 29, 31, 33, of Title 44 in PDF. December 2014 x NARA National Archives 44 U.S.C. Federal Records Act, Chapters 21, 29, 31, 33 (see Public Law 113-187) February 2008 x
FIPS PUB 200 Federal Information Processing Standards Publication Minimum Security Requirements for Federal Information and Information Systems March 2006 x x x x FIPS PUB 201-2 Federal Information Processing Standards Publication Personal Identity Verification (PIV) of Federal Employees and Contractors August 2013 x x x x x NIST SP 800-18 National Institute of Standards and Technology Guide for Developing Security Plans for Federal Information Systems, Revision 1 February 2006 x x x x x NIST 800-26 National Institute of Standards and Technology Security Self-Assessment Guide for Information Technology Systems Superseded By: FIPS 200, SP 800-53, SP 800-53A x NIST SP 800-27 National Institute of Standards and Technology Engineering Principles for Information Technology Security Revision A (A Baseline for Achieving Security) June 2004 x x x NIST SP 800-30 National Institute of Standards and Technology Guide for Conducting Risk Assessments, Revision 1 January 2015 x x x x x NIST SP 800-34 National Institute of Standards and Technology Contingency Planning Guide for Federal Information Systems Revision 1 [includes updates as of 11-11-10] May 2010 x x x x x NIST SP 800-37 National Institute of Standards and Technology Guide for Mapping Types of Information and Information Systems to Security Categories (Revision 1) February 2010 x x x x x NIST SP 800-39 National Institute of Standards and Technology Managing Information Security Risk: Organization, Mission, and Information System View March 2011 x x x
NIST SP 800-137 National Institute of Standards and Technology Information Security Continuous Monitoring for Federal Information Systems and Organizations September 2011 x x x NIST SP 800-144 National Institute of Standards and Technology Guidelines on Security and Privacy in Public Cloud Computing December 2011 x NIST SP 800-145 National Institute of Standards and Technology The NIST Definition of Cloud Computing September 2011 x x x FTC Federal Trade Commission Privacy Online: Fair Information Practices in the Electronic Marketplace: A Federal Trade Commission Report to Congress June 1998 x NARA 2010-05 National Archives NARA Bulletin Guidance on Managing Records in Cloud Computing Environments (NARA Bulletin) September 2010 x FDIC Federal Deposit Insurance Corporation Offshore Outsourcing of Data Services by Insured Institutions and Associated Consumer Privacy Risks June 2004 x The FedRAMP Standards and Guidance workbook can be submitted as an appendix or an attachment. The attachment can be found on this page: . Note: All NIST Computer Security Publications can be found at the following URL: Additional Comments: