3.1 All “Prepared By” section: changed “Zip” to “ZIP” and corrected input field label. Corrected horizontal axis of table 3-6 from “Likelihood” to “Impact.” Corrected references to the Security Assessment Summary Worksheet, and added it to the FedRAMP website. Corrected erroneous footers reading “Confidential Unclassified Information” to “Controlled Unclassified Information,” and removed duplicate page numbers appearing in some footers in the middle of the footer text. Corrected typographical errors, capitalization, format. Added and clarified instruction boxes. Made all external links appear in the text for clarity. Corrected missing common input fields by including them as linked form fields. Removed Appendix K, which referred to an immature Table Creation Tool. FedRAMP PMO 2/22/2017 3.2 Appendix A, Section 4 Updated TOC to capture Appendix A RISK EXPOSURE TABLE FedRAMP PMO 3/9/2017 3.3 Appendix H Implementation Statement Differential changed back to “Yes” or “No” from “Low”, “Moderate” or “High”. This changed the verbiage throughout Appendix H. Low, Moderate, and High Security Test Case Procedures Templates updated to reflect this change. Updated Table of Contents to ensure pages numbers are current. FedRAMP PMO 6/6/2017 3.3 Cover Updated logo FedRAMP PMO Revision History Date Description Version of SAR Author How to contact us 7
Table 12 Standards and Guidance Identification Number Title Date Link The purpose of this document is to provide the SO, , and the AOs with a SAR for the . A security assessment has been performed on the to evaluate the system’s implementation of, and compliance with, the FedRAMP baseline security controls. The implementation of security controls is described in the SSP, and required by FedRAMP to meet FISMA compliance mandate. The FedRAMP program requires Cloud Service Providers (CSPs) to use a FedRAMP-accepted Independent Assessor (IA) Third Party Assessment Organization (3PAO) to perform independent security assessment testing and development of the SAR. Security testing for was performed by in accordance with the Security Assessment Plan (SAP), dated . This SAR applies to which is managed and operated by . The that is being reported on in this document has a unique identifier which is noted in Table 13 Information System Unique Identifier, Name and Abbreviation. Table 13 Information System Unique Identifier, Name and Abbreviation Unique Identifier Information System Name Information System Abbreviation Instruction: 3PAOs must at the minimum review all the below listed documents. If other documents or files are reviewed, they must be attached in Appendix H and referred to as necessary. Delete this instruction from your final version of this document. Documentation used by the to perform the assessment of includes the following: System Security Plan and Attachments Attachment 1: Information Security Policies and Procedures (covering all Control Families) Attachment 2: User Guide Attachment 3: E-Authentication Plan Attachment 4: Privacy Threshold Analysis/Privacy Impact Assessment Attachment 5: Rules of Behavior Attachment 6: Information System Contingency Plan and Test Results
Risks that reside in the <System Name> that cannot be corrected because of operational impact to the system are summarized in Table 53 Summary of Risks Remaining Due to Operational Requirements. An explanation of the operational impact and risks are included below as well as in the appropriate Security Assessment Test Cases and System Security Plan (SSP). Although these risks are not to be corrected, they are listed in this <System Name Acronym> SAR Appendix A: Risk Exposure Table, and tracked in the Plan of Action and Milestones (POA&M) as Operational Requirements. Instruction: 3PAO must ensure that the content of this table is consistent with the same information documented in <System Name Acronym> SAR Appendix A: Risk Exposure Table. Delete this instruction from your final version of this document. Note: The justification that remediating a vulnerability will cause a break in functionality is not a sufficient rationale for permitting the risk to persist. There must also be full descriptions of the mitigating factors and compensating controls that address the ongoing risk to this specific system. Table 53 Summary of Risks Remaining Due to Operational Requirements Identifier Description Source of Discovery Current Risk Exposure Operational Requirements Rationale and Mitigating Factors