Document Revision History Date Page(s) Description Author 06/06/2014 Major revision for SP800-53 Revision 4. Includes new template and formatting changes. FedRAMP PMO 06/06/2017 1 Updated logo FedRAMP PMO Table of Contents
Security Assessments CA-2 (continued) (continued) c. Produces a security assessment report that documents the results of the assessment; and d. Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles]. 33 Security Assessments - Specialized Assessments CA-2 (2) The organization includes as part of security control assessments, [FedRAMP Assignment: at least annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: other forms of security assessment]]. . Requirement: To include 'announced', 'vulnerability scanning' at least annually Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs. 34 Penetration Testing CA-8, CA-8 (1) CSPs must conduct penetration testing at least annually or when there is a major significant change to ensure compliance with all vulnerability mitigation procedures. Penetration testing must be performed by a 3PAO. All penetration testing reports must be sent to the ISSO. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs.
49 Vulnerability Scan RA-5a CSPs must have an accredited 3PAO scan operating systems/infrastructure, web applications, and databases annually. All scan reports must be sent to the ISSO. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs. 50 Boundary Protection SC-7(4)e CSPs must remove traffic flow that is no longer supported by a business/mission need. Changes and updates to traffic flow must be made in accordance with the change control process described in the CSP’s Configuration Management Plan. 51 Security Training AT-3b, AT-3c CSPs must provide role-based security training annually and when required. The date that the training took place, along with whom provided the training, must be recorded In the System Security Plan. Role-based security training is typically for privileged users. 52 Security Training Records AT-4b CSPs must archive security training records at least annually. In the System Security Plan, record who participated in training and when the training took place. Archive the actual training materials. Every Two Years 53 Identifier Management IA-4d Prevent reuse of user and device identifiers every two years. Every Three Years
Every Five Years 58 Personnel Screening PS-3b Law enforcement must undergo personnel screening every 5 years. Any law enforcement staff screened must have the screening date recorded in the System Security Plan along with their name. For national security clearances; a reinvestigation is required during the 5th year for top secret security clearance, the 10th year for secret security clearance, and 15th year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the 5th year. There is no reinvestigation for other moderate risk positions or any low risk positions. High impact personnel screening is not required at this time because FedRAMP is not supporting high impact sensitive systems at this time. Table A-1 – Summary of Continuous Monitoring Activities & Deliverables