Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-6 (6) What is the solution and how is it implemented? AU-6 (7) Control Enhancement The organization specifies the permitted actions for each [FedRAMP Selection (one or more): information system process; role; user] associated with the review, analysis, and reporting of audit information. AU-6 (7) Control Summary Information Responsible Role: Parameter AU-6 (7): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-6 (7) What is the solution and how is it implemented? AU-6 (10) Enhancement The organization adjusts the level of audit review, analysis, and reporting within the information system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
AU-9 (3) What is the solution and how is it implemented? AU-9 (4) Control Enhancement The organization authorizes access to management of audit functionality to only [Assignment: organization-defined subset of privileged users]. AU-9 (4) Control Summary Information Responsible Role: Parameter AU-9(4): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-9 (4) What is the solution and how is it implemented? AU-10 Non-repudiation The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed [FedRAMP Assignment: minimum actions including the addition, modification, deletion, approval, sending, or receiving of data]. AU-10 Control Summary Information Responsible Role: Parameter AU-10: Implementation Status (check all that apply): Implemented Partially implemented
Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-7 (1) What is the solution and how is it implemented? Part a Part b CM-7 (2) Control Enhancement The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage]. CM-7(2) Additional FedRAMP Requirements and Guidance: Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run. CM-7 (2) Control Summary Information Responsible Role: Parameter CM-7(2): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific
Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IR-7 (2) What is the solution and how is it implemented? Part a Part b IR-8 Incident Response Plan The organization: Develops an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the structure and organization of the incident response capability; Provides a high-level approach for how the incident response capability fits into the overall organization; Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; Defines reportable incidents; Provides metrics for measuring the incident response capability within the organization; Defines the resources and management support needed to effectively maintain and mature an incident response capability; and Is reviewed and approved by [Assignment: organization-defined personnel or roles]; Distributes copies of the incident response plan to [FedRAMP Assignment: see additional FedRAMP Requirements and Guidance]. IR-8(b) Additional FedRAMP Requirements and Guidance: Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel. Reviews the incident response plan [FedRAMP Assignment: at least annually]; Updates the incident response plan to address system/organizational changes or
organizational policy and documented in the security plan for the information system; Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; Maintains records for nonlocal maintenance and diagnostic activities; and Terminates session and network connections when nonlocal maintenance is completed. MA-4 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , MA-4 What is the solution and how is it implemented? Part a Part b Part c Part d Part e MA-4 (2) Control Enhancement The organization documents in the security plan for the information system, the policies and procedures for the establishment and use of nonlocal maintenance and diagnostic connections. MA-4 (2) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented
Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PL-2 What is the solution and how is it implemented? Part a Part b Part c Part d Part e PL-2 (3) Control Enhancement The organization plans and coordinates security-related activities affecting the information system with [Assignment: organization-defined individuals or groups] before conducting such activities in order to reduce the impact on other organizational entities. PL-2 (3) Control Summary Information Responsible Role: Parameter PL-2(3): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific)
SC-12 (3) Control Enhancement The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user’s private key]. SC-12 (3) Control Summary Information Responsible Role: Parameter SC-12 (3): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , SC-12 (3) What is the solution and how is it implemented? SC-13 Use of Cryptography The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. SC-13 Control Summary Information Responsible Role: Parameter SC-13: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
ATTACHMENT 9 - CIS All Authorization Packages must include Control Implementation Summary (CIS) Report and Worksheet attachments, which will be reviewed for quality. Maintain a current Revision History in the table below. Templates for both can be found on the following FedRAMP website page: . The Report Template has a sample format. The CSP may modify the format as necessary to comply with its internal policies and FedRAMP requirements. CIS Report and Worksheet Revision History Additional Comments:
ATTACHMENT 12 – The Table 152 FedRAMP Templates that Reference FedRAMP Laws and Regulations lists all of the FedRAMP templates in which FedRAMP laws, regulations, standards and guidance (SSP, SAP, SAR etc.) reference this section and attachment. Table FedRAMP Templates that Reference FedRAMP Laws and Regulations FedRAMP Applicable Laws Current laws and regulations as applicable to each template are shown in Table 153 FedRAMP Laws and Regulations. Table FedRAMP Laws and Regulations FedRAMP Laws and Regulations Applies to these Templates Number Source Title Date Link SSP SAP SAR PTA/PIA ISCP FIPS 199 44 USC 31 US Code Title 44 Public Printing and Documents; Chapter 31 Records Management by Federal Agencies January 2012 x x x x 5 USC 552a US Code Title 5 Government Organization and Employees; Chapter 5 Administrative Procedure; Section 552a Records maintained on individuals (Privacy Act of 1974 as amended) January 2014 x x x x
HSPD-12 Homeland Security Presidential Directive Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors [HSPD-12], August 27, 2004 August 2004 x x HSPD-7 Homeland Security Presidential Directive Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7], December 17, 2003 December 2003 x x x OMB Circular Office of Management and Budget Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [, as amended] Rescinded by OMB Archived x x OMB Circular Office of Management and Budget Management’s Responsibility for Internal Control Revised December 2004 x x x OMB Circular Office of Management and Budget Management of Federal Information Resources, Revised, Transmittal Memorandum No. 4 November 2000 x x x x x x OMB Circular iii Office of Management and Budget Security of Federal Automated Information Systems, Appendix III November 2000 x x x x OMB M-01-05 Office of Management and Budget Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy December 2000 x x x x OMB M-03-22 Office of Management and Budget OMB Guidance for Implementing the Privacy Provisions September 2003 x OMB M-04-04 Office of Management and Budget E-Authentication Guidance for Federal Agencies December 2003 x x x x OMB M-06-16 Office of Management and Budget Protection of Sensitive Agency Information June 2006 x x x x
FTC Federal Trade Commission Federal Trade Commission Act Section 5: Unfair or Deceptive Acts or Practices June 2008 x NCSL National Conference of State Legislatures State Privacy Laws January 2016 x ECFR Electronic Code of Federal Regulations Title 35, Code of Federal Regulations, Chapter XII, Subchapter B March 2016 x The FedRAMP Laws and Regulations can be submitted as an appendix or an attachment. The attachment can be found on this page: . FedRAMP Applicable Standards and Guidance Table 154 FedRAMP Applicable Standards and Guidance reflects current standards and guidance as applicable to each template. Table FedRAMP Applicable Standards and Guidance FedRAMP Laws and Regulations Applies to these Templates Identification Number Source Title Date Link SSP SAP SAR PIA/PTA ISCP FIPS 199 FIPS PUB 140-2 Federal Information Processing Standards Publication Security Requirements for Cryptographic Modules May 2001 x x x x FIPS PUB 199 Federal Information Processing Standards Publication Standards for Security Categorization of Federal Information and Information Systems February 2004 x x x x FIPS PUB 200 Federal Information Processing Standards Publication Minimum Security Requirements for Federal Information and Information Systems March 2006 x x x x
NIST SP 800-53 National Institute of Standards and Technology Security and Privacy Controls for Federal Information Systems and Organizations, Revision 4 [Includes updates as of 01-22-2015] April 2013 x x x x x NIST SP 800-53A National Institute of Standards and Technology Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans, Revision 4 December 2014 x x x x x NIST SP 800-60 National Institute of Standards and Technology Guide for Mapping Types of Information and Information Systems to Security Categories, Revision 1 August 2008 x x x NIST SP 800-61 National Institute of Standards and Technology Computer Security Incident Handling Guide, Revision 2 August 2012 x x x NIST SP 800-63-2 National Institute of Standards and Technology Electronic Authentication Guideline: Computer Security, Revision 2 August 2013 x NIST SP 800-64 National Institute of Standards and Technology Security Considerations in the System Development Life Cycle, Revision 2 October 2008 x x x x x NIST SP 800-115 National Institute of Standards and Technology Technical Guide to Information Security Testing and Assessment September 2008 x x x x NIST SP 800-128 National Institute of Standards and Technology Guide for Security-Focused Configuration Management of Information Systems August 2011 x x x NIST SP 800-137 National Institute of Standards and Technology Information Security Continuous Monitoring for Federal Information Systems and Organizations September 2011 x x x
NIST SP 800-144 National Institute of Standards and Technology Guidelines on Security and Privacy in Public Cloud Computing December 2011 x NIST SP 800-145 National Institute of Standards and Technology The NIST Definition of Cloud Computing September 2011 x x x FTC Federal Trade Commission Privacy Online: Fair Information Practices in the Electronic Marketplace: A Federal Trade Commission Report to Congress June 1998 x NARA 2010-05 National Archives NARA Bulletin Guidance on Managing Records in Cloud Computing Environments (NARA Bulletin) September 2010 x FDIC Federal Deposit Insurance Corporation Offshore Outsourcing of Data Services by Insured Institutions and Associated Consumer Privacy Risks June 2004 x The FedRAMP Standards and Guidance workbook can be submitted as an appendix or an attachment. The attachment can be found on this page: . Note: All NIST Computer Security Publications can be found at the following URL: Additional Comments: