Instruction: List all interconnected systems. Provide the IP address and interface identifier (eth0, eth1, eth2) for the CSP system that provides the connection. Name the external organization and the IP address of the external system. Indicate how the connection is being secured. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number. Add additional rows as needed. This table must be consistent with Table 133 CA-3 Authorized Connections. Delete this and all other instructions from your final version of this document. The Table 111 System Interconnections below is consistent with Table 133 CA-3 Authorized Connections. Table 111 System Interconnections SP* IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer, etc.)** Data Direction (incoming, outgoing, or both) Information Being Transmitted Port or Circuit Numbers *Service Processor **Internet Protocol Security (IPSec), Virtual Private Network (VPN), Secure Sockets Layer (SSL)
Table 132 Control Origination and Definitions Control Origination Definition Example Service Provider Corporate A control that originates from the corporate network. DNS from the corporate network provides address resolution services for the information system and the service offering. Service Provider System Specific A control specific to a particular system at the and the control is not part of the standard corporate controls. A unique host based intrusion detection system (HIDs) is available on the service offering platform but is not available on the corporate network. Service Provider Hybrid A control that makes use of both corporate controls and additional controls specific to a particular system at the . There are scans of the corporate network infrastructure; scans of databases and web based application are system specific. Configured by Customer A control where the customer needs to apply a configuration in order to meet the control requirement. User profiles, policy/audit configurations, enabling/disabling key switches (e.g., enable/disable http* or https, etc.), entering an IP range specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a SAML SSO solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits PE controls from an IaaS provider. *Hyper Text Transport Protocol (http) Responsible Role indicates the role of CSP employee who can best respond to questions about the particular control that is described. (AC) AC-1 Access Control Policy and Procedures Requirements (L) (M) The organization: Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]: An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the access control policy and associated access controls; and
Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (5) What is the solution and how is it implemented? AC-2 (7) Control Enhancement (M) The organization: Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles; Monitors privileged role assignments; and Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate. AC-2 (7) Control Summary Information Responsible Role: Parameter AC-2(7)(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (7) What is the solution and how is it implemented? Part a Part b Part c
Parameter AC-7(a)-2: Parameter AC-7(b)-1: Parameter AC-7(b)-2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-7 What is the solution and how is it implemented? Part a Part b AC-8 System Use Notification (L) (M) (H) The information system: Displays to users [Assignment: organization-defined system use notification message or banner (FedRAMP Assignment: see additional Requirements and Guidance)] before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance and states that: Users are accessing a U.S. Government information system; Information system usage may be monitored, recorded, and subject to audit; Unauthorized use of the information system is prohibited and subject to criminal and civil penalties; and Use of the information system indicates consent to monitoring and recording; Retains the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the information system; and For publicly accessible systems: Displays system use information [Assignment: organization-defined conditions (FedRAMP Assignment: see additional Requirements and Guidance)], before
AC-8 What is the solution and how is it implemented? Part a Part b Part c Additional FedRAMP Requirements and Guidance Requirement 1: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO. Requirement 2: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB/AO. If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. Requirement 3: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO. AC-8 Req. Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
Inherited from pre-existing FedRAMP Authorization for , AU-7 (1) What is the solution and how is it implemented? AU-8 Time Stamps (L) (M) (H) The information system: Uses internal system clocks to generate time stamps for audit records; and Records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT) and meets [Assignment: one second granularity of time measurement]. AU-8 Control Summary Information Responsible Role: Parameter AU-8(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-8 What is the solution and how is it implemented? Part a Part b AU-8 (1) Control Enhancement (M) (H) The information system: Compares the internal information system clocks with [FedRAMP Assignment: authoritative time source: [] [at least hourly]]; and
Synchronizes the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period]. AU-8 (1) Additional FedRAMP Requirements and Guidance: Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server. Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server. Guidance: The service provider selects primary and secondary time servers used by the NIST Internet time service, or by a Stratum-1 time server. The secondary server is selected from a different geographic region than the primary server. If using Windows Active Directory, all servers should synchronize time with the time source for the Windows Domain Controller. If using some other directory services (e.g., LDAP), all servers should synchronize time with the time source for the directory server AU-8 (1) Control Summary Information Responsible Role: Parameter AU-8(1)(a)-1: Parameter AU-8(1)(a)-2: Parameter AU-8(1)(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-8 (1) What is the solution and how is it implemented? Part a Part b
Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-7 (1) What is the solution and how is it implemented? Part a Part b CM-7 (2) Control Enhancement (M) (H) The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage]. CM-7(2) Additional FedRAMP Requirements and Guidance: Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e., white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run. CM-7 (2) Control Summary Information Responsible Role: Parameter CM-7(2): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
MP-2 Control Summary Information Responsible Role: Parameter MP-2-1: Parameter MP-2-2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , MP-2 What is the solution and how is it implemented? MP-3 Media Labeling (M) (H) The organization: Marks information system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information; and Exempts [FedRAMP Assignment: no removable media types] from marking as long as the media remain within [Assignment: organization-defined controlled areas]. MP-3(b) Additional FedRAMP Requirements and Guidance: Guidance: Second parameter in MP-3(b)-2 is not applicable. MP-3 Control Summary Information Responsible Role: Parameter MP-3(b)-1: Parameter MP-3(b)-2: Not applicable Implementation Status (check all that apply): Implemented Partially implemented Planned
PE-10 Emergency Shutoff (M) (H) The organization: Provides the capability of shutting off power to the information system or individual system components in emergency situations; Places emergency shutoff switches or devices in [Assignment: organization-defined location by information system or system component] to facilitate safe and easy access for personnel; and Protects emergency power shutoff capability from unauthorized activation. PE-10 Control Summary Information Responsible Role: Parameter PE-10(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PE-10 What is the solution and how is it implemented? Part a Part b Part c PE-11 Emergency Power (M) (H) The organization provides a short-term uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the information system; transition of the information system to long-term alternate power] in the event of a primary power source loss.