Instruction: List all interconnected systems. Provide the IP address and interface identifier (eth0, eth1, eth2) for the CSP system that provides the connection. Name the external organization and the IP address of the external system. Provide a point of contact and phone number for the external organization. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number. Add additional rows as needed. This table must be consistent with Table 133 CA-3 Authorized Connections. Additional FedRAMP Requirements and Guidance: Guidance: See the FedRAMP Documents page under Key Cloud Service Provider (CSP) Documents> FedRAMP Authorization Boundary Guidance Delete this and all other instructions from your final version of this document. The Table 111 System Interconnections below is consistent with Table 133 CA-3 Authorized Connections. Table 111. System Interconnections SP* IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer, etc.)** Data Direction (incoming, outgoing, or both) Information Being Transmitted Port or Circuit Numbers
AT-4 Control Summary Information Responsible Role: Parameter AT-4(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AT-4 What is the solution and how is it implemented? Part a Part b Audit and Accountability (AU) AU-1 Audit and Accountability Policy and Procedures (L) (M) The organization: Audit Audit policy and and and and and and and and and and that the the the
CM-6 Control Summary Information Responsible Role: Parameter CM-6(a)-1: Parameter CM-6(a)-2: Parameter CM-6(c)-1: Parameter CM-6(c)-2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-6 What is the solution and how is it implemented? Part a Part b Part c Part d CM-6 (1) (M) (H) The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components]. CM-6 (1) Control Summary Information Responsible Role: Parameter CM-6(1): Implementation Status (check all that apply): Implemented
Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PL-8 What is the solution and how is it implemented? Part a Part b Part c Personnel (PS) PS-1 Personnel Security Policy and Procedures (L) (M) The organization: PS-1 Control Summary Information Responsible Role: Parameter PS-1(a): Parameter PS-1(b)(1): Parameter PS-1(b)(2): Implementation Status (check all that apply): Implemented Partially implemented Personnel every annually]. among Develops, disseminates roles]: addresses purpose, scope, responsibilities, commitment, coordination entities, compliance; facilitate controls; current: years]; implementation at personnel personnel the the the
SC-19 Voice Over Internet Protocol (M) (H) The organization: SC-19 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , SC-19 What is the solution and how is it implemented? Part a Part b SC-20 Secure Name / Address Resolution Service (Authoritative Source) (L) (M) (H) The information system: integrity Provides based