Part d Part e Part f Part g CA-7 Additional FedRAMP Requirements and Guidance: Requirement 1: Operating System Scans: at least monthly Requirement 2: Database and Web Application Scans: at least monthly Requirement 3: All scans performed by Independent Assessor: at least annually CA-7 Req. Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CA-7 What is the solution and how is it implemented? Req. 1 Req. 2 Req. 3
Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , PS-2 What is the solution and how is it implemented? Part a Part b Part c PS-3 Personnel Screening (L) (M) (H) The organization: Screens individuals prior to authorizing access to the information system; and Rescreens individuals according to [FedRAMP Assignment: For national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance. For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year. There is no reinvestigation for other moderate risk positions or any low risk positions]. PS-3 Control Summary Information Responsible Role: Parameter PS-3(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
PTA / PIA This Attachment Section has been revised to include the PTA Template. Therefore, a separate PTA attachment is not needed. If any of the answers to Question 1-4 are “Yes” then complete a Privacy Impact Assessment Template and include it as an Attachment. Delete this note and all other instructions from your final version of this document. All Authorization Packages must include a Privacy Threshold Analysis (PTA) and if necessary, the Privacy Impact Assessment (PIA) attachment, which will be reviewed for quality. The PTA is included in this section, and the PIA Template can be found on the following FedRAMP website page: . The PTA and PIA Template includes a summary of laws, regulations and guidance related to privacy issues in Attachment 12, FedRAMP Laws and Regulations. Privacy Overview and Point of Contact (POC) The Table 156. Privacy POC individual is identified as the Privacy Officer and POC for privacy at . Table 156. Privacy POC Name Title CSP / Organization Address Phone Number Email Address The FedRAMP Laws and Regulations may be found on: . A summary of FedRAMP Laws and Regulations is included in the System Security Plan (SSP) Attachment 12, FedRAMP Laws and Regulations. Table 121. Laws and Regulations include additional laws and regulations that are specific to . These will include laws and regulations from the Federal Information Security Management Act (FISMA), Office of Management and Budget (OMB) circulars, Public Law (PL), United States Code (USC), and Homeland Security Presidential Directives (HSPD). Table 157. Laws and Regulations Identification Number Title Date Link