CM-3 What is the solution and how is it implemented? Part a Part b Part c Part d Part e Part f Part g CM-4 Security Impact Analysis The organization analyzes changes to the information system to determine potential security impacts prior to change implementation. CM-4 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-4 What is the solution and how is it implemented? CM-5 Access Restrictions for Change The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
HSPD-12 Homeland Security Presidential Directive Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], August 27, 2004 August 2004 x x HSPD-7 Homeland Security Presidential Directive Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7], December 17, 2003 December 2003 x x x OMB Circular Office of Management and Budget Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [, as amended] Rescinded by OMB Archived x x OMB Circular Office of Management and Budget Management’s Responsibility for Internal Control Revised December 2004 x x x OMB Circular Office of Management and Budget Management of Federal Information Resources, Revised, Transmittal Memorandum No. 4 November 2000 x x x x x x OMB Circular iii Office of Management and Budget Security of Federal Automated Information Systems, Appendix III November 2000 x x x x OMB M-01-05 Office of Management and Budget Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy December 2000 x x x x OMB M-03-22 Office of Management and Budget OMB Guidance for Implementing the Privacy Provisions September 2003 x OMB M-04-04 Office of Management and Budget E-Authentication Guidance for Federal Agencies December 2003 x x x x OMB M-06-16 Office of Management and Budget Protection of Sensitive Agency Information June 2006 x x x x
OMB M-07-16 Office of Management and Budget Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII) May 2007 x OMB M-10-23 Office of Management and Budget Guidance for Agency Use of Third-Party Websites June 2010 x OMB M-99-18 Office of Management and Budget Privacy Policies on Federal Web Sites June 1999 x PL 99-474 US Code Public Law Computer Fraud and Abuse Act , 18 USC 1030 October 1986 x x x x PL 100-503 US Code Public Law Consolidated Appropriations Act of 2005, Section 522 October 1988 x x PL 104-191 US Code Public Law Health Insurance Portability and Accountability Act of 1996 (HIPAA) August 1996 x PL 104-231 US Code Public Law Electronic Freedom of Information Act As Amended in 2002 [PL 104-231, 5 USC 552], October 2, 1996 October 1996 x x x x x PL 107-56 US Code Public Law USA Patriot Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism) October 2001 x PL 107-347 US Code Public Law E-Government Act [includes FISMA Title III] December 2002 x x x x x x PL 108-447 US Code Public Law Consolidated Appropriations Act of 2005, Section 522 September 2005 x PL 113-187 US Code Public Law 44 U.S.C The Presidential and Federal Records Act Amendments of 2014 showing changes to NARA Statutes found below in Chapters 21, 22, 29, 31, 33, of Title 44 in PDF. December 2014 x NARA National Archives 44 U.S.C. Federal Records Act, Chapters 21, 29, 31, 33 (see Public Law 113-187) February 2008 x
NIST 800-47 National Institute of Standards and Technology NIST 800-47, Security Guide for Interconnecting Information Technology Systems August 2002 x NIST SP 800-53 National Institute of Standards and Technology Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4 [Includes updates as of 01-22-2015] April 2013 x x x x x NIST SP 800-53A National Institute of Standards and Technology Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans, Revision 4 December 2014 x x x x x NIST SP 800-60 National Institute of Standards and Technology Guide for Mapping Types of Information and Information Systems to Security Categories, Revision 1 August 2008 x x x NIST SP 800-61 National Institute of Standards and Technology Computer Security Incident Handling Guide, Revision 2 August 2012 x x x NIST SP 800-63-2 National Institute of Standards and Technology Electronic Authentication Guideline: Computer Security, Revision 2 August 2013 x NIST SP 800-64 National Institute of Standards and Technology Security Considerations in the System Development Life Cycle, Revision 2 October 2008 x x x x x NIST SP 800-115 National Institute of Standards and Technology Technical Guide to Information Security Testing and Assessment September 2008 x x x x NIST SP 800-128 National Institute of Standards and Technology Guide for Security-Focused Configuration Management of Information Systems August 2011 x x x