2 Auditable Events AU-2a, Certain events must be continuously monitored. AU-2a auditable events: Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes AU-2d Frequency: continually 3 Information System Component Inventory CM-8(3)a CSPs must be able to detect new assets continuously, using automated mechanisms with a maximum delay in detection. This activity should be automated. 4 Incident Reporting IR-6 CSPs must report incidents in accordance with the FedRAMP Incident Communications Procedure. IR-6a. [US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended)] 5 Temperature & Humidity Controls PE-14b CSPs must monitor temperature and humidity controls continuously. Refer to ASHRAE Thermal Guidelines for Data Processing Environments. Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
6 Vulnerability Scanning RA-5(2) CSPs must update the list of vulnerabilities scanned continuously, before each scan. Before scans are run, signatures must be updated to the most current version. 7 Wireless Intrusion Detection SI-4(14) The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system. 10 Days 8 Contingency Training CP-3a CSPs must train personnel in their contingency roles and responsibilities within 10 days of assuming a contingency role or responsibility. Record the date of the training in the System Security Plan. Weekly 9 Audit Review, Analysis, & Reporting AU-6a CSPs must review and analyze information system audit records for indications of inappropriate or unusual activity. Report findings of inappropriate or unusual activity to incident response team. Monthly 10 Vulnerability Scanning RA-5d CSPs must mitigate all discovered high-risk vulnerabilities within 30 days and mitigate moderate vulnerability risks in 90 days. CSPs must send their ISSO updated artifacts every 30 days to show evidence that outstanding high-risk vulnerabilities have been mitigated.
29 Security Awareness AT-2 CSPs must provide basic security awareness training to all users annually. Record the date that security awareness training last took place in the System Security Plan. Security awareness training must include contractors, executives, and anyone who has access to the system. 30 Auditable Events AU-2(3) CSPs must review and update auditable events annually or whenever there is a change in the threat environment. Changes to the auditable event list must be recorded in the System Security Plan. CSPs must record the date that the auditable event review meeting takes place in the System Security Plan. Meeting notes with information about who attended the meeting must be archived. Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the Authorizing Official. 31 Security Assessments CA-2b CSPs must have a 3PAO assess a subset of their security controls annually. Submit the assessment report to the ISSO one year from the Provisional Authorization date and each year thereafter. Consult with the ISSO to obtain information on which controls to assess during annual testing. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs.
35 Baseline Configuration CM-2(1)a CSPs must review and update the baseline configuration annually or during installations and updates. Changes and updates to the baseline configuration must be made in accordance with the change control process described in the CSP’s Configuration Management Plan. This activity must also be performed whenever there is a major significant change to the system. 36 Configuration Management Plan CM-9 CSPs must review and update the Configuration Management Plan annually. Submit the new plan to the ISSO one year from the Provisional Authorization date (and each year thereafter). 37 IT Contingency Plan CP-2d CSPs must review and update the IT Contingency Plan annually. Submit the new plan to the one year from the Provisional Authorization date (and each year thereafter). Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel. 38 Contingency Training CP-3c CSPs must train personnel in their contingency roles and responsibilities annually. Record the date of the training in the System Security Plan.
54 Security Authorization CA-6c The security authorization will be by the Authorizing Official at least every three years. CSPs must record the date of the Provisional Authorization, and any reauthorization, in the System Security Plan. This activity must also be performed whenever there is a major significant change to the system. CA-6c. Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the Authorizing Official. 55 IT Contingency Plan Testing & Exercises (Low Systems) CP-4a CSPs must test and exercise the IT Contingency Plan (for Low systems) every three years using table top written tests. Record the testing date in the System Security Plan. Guidance: Plans for this test must be submitted at least 30 days prior to test to ISSO. CP-4a. Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by Risk-executive/ Authorizing Official prior to initiating testing. 56 Position Categorization PS-2c CSPs must review position categorizations every three years. Record the date that position categorization was completed in the System Security Plan.
CSPs many times buy products or services and incorporates these in to their cloud environment to deliver their services. Many times risks can be related to these products and services and these risks are considered “vendor dependant.” Risks are only considered vendor dependencies when remediating vulnerabilities within a product or service is not allowed by the vendor (e.g. it would void the warranty). All vendor dependencies at a high risk level must be mitigated to a moderate through compensating controls within 30 days. Vendor dependencies at the low and moderate level require CSPs to be in contact with their vendors at a minimum of a monthly basis to ensure there are no updates that would remediate the known vulnerabilities. If a CSP contacts their vendors and provides evidence with their monthly deliverables of this contact regarding any fixes to the open vulnerabilities, then a vendor dependency is not considered a late POA&M. Operational requirements exist only for vulnerabilities where the ability to remediate a vulnerability does not exist or remediating a vulnerability is not supported if the vulnerability is vendor dependent. Attached you will find the Monthly Reporting Summary the FedRAMP PMO uses to highlight key considerations for review to the JAB on a monthly basis for each CSP that achieves a P-ATO. In this template you will see: System Status Overview Unique Scanning Summary Raw Scanning Summary Open POA&M Summary Items of Note Considerations for Review Additional Information Requested Deviation Details