Table 51 Information System Management Point of Contact Information System Management Point of Contact Name Title Company / Organization Address Phone Number Email Address Table 52 Information System Technical Point of Contact Information System Technical Point of Contact Name Title Company / Organization Address Phone Number Email Address Instruction: Add more tables as needed. Delete this and all other instructions from your final version of this document. Point of Contact Name Title Company / Organization Address Phone Number Email Address The Information System Security Officers (ISSO), or their equivalent, identified below, have been appointed in writing and are deemed to have significant cyber and operational role
Instruction: For an External User, write “Not Applicable” in the Sensitivity Level Column. This table must include all roles including systems administrators and database administrators as a role types. (Also include web server administrators, network administrators and firewall administrators if these individuals have the ability to configure a device or host that could impact the CSP service offering.) This table must also include whether these roles are fulfilled by foreign nationals or systems outside the United States. Delete this and all other instructions from your final version of this document. Table 91 Personnel Roles and Privileges Role Internal or External Privileged (P), Non-Privileged (NP), or No Logical Access (NLA) Sensitivity Level Authorized Privileges Functions Performed UNIX System Administrator Full administrative access (root) Add/remove users and hardware, install and configure software, OS updates, patches and hotfixes, perform backups Client Administrator Portal administration Add/remote client users. Create, modify and delete client applications Program Director N/A Reviews, approves and enforces policy There are currently internal personnel and external personnel. Within one year, it is anticipated that there will be internal personnel and external personnel. Instruction: Insert a network architectural diagram in the space that follows. Ensure that the following items are labeled on the diagram: hostnames, Domain Name System (DNS) servers, DHCP servers, authentication and access control servers, directory servers, firewalls, routers,
Table 132 Control Origination and Definitions Control Origination Definition Example Service Provider Corporate A control that originates from the corporate network. DNS from the corporate network provides address resolution services for the information system and the service offering. Service Provider System Specific A control specific to a particular system at the and the control is not part of the standard corporate controls. A unique host based intrusion detection system (HIDs) is available on the service offering platform but is not available on the corporate network. Service Provider Hybrid A control that makes use of both corporate controls and additional controls specific to a particular system at the . There are scans of the corporate network infrastructure; scans of databases and web based application are system specific. Configured by Customer A control where the customer needs to apply a configuration in order to meet the control requirement. User profiles, policy/audit configurations, enabling/disabling key switches (e.g., enable/disable http* or https, etc.), entering an IP range specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a SAML SSO solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits PE controls from an IaaS provider. *Hyper Text Transport Protocol (http) Responsible Role indicates the role of CSP employee who can best respond to questions about the particular control that is described. (AC) AC-1 Access Control Policy and Procedures Requirements (H) The organization: Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]: An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the access control policy and associated access controls; and
Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-6 (8) What is the solution and how is it implemented? AC-6 (9) Control Enhancement (M) (H) The information system audits the execution of privileged functions. AC-6 (9) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-6 (9) What is the solution and how is it implemented? AC-6 (10) Control Enhancement (M) (H) The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. AC-6 (10) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented
Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-6 (3) What is the solution and how is it implemented? AU-6 (4) Control Enhancement (H) The information system provides the capability to centrally review and analyze audit records from multiple components within the system. AU-6 (4) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AU-6 (4) What is the solution and how is it implemented? AU-6 (5) Control Enhancement (H) The organization integrates analysis of audit records with analysis of [FedRAMP Selection (one or more): vulnerability scanning information; performance data; information system monitoring information; penetration test data; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.
through the use of Interconnection Security Agreements; Documents, for each interconnection, the interface characteristics, security requirements, and the nature of the information communicated; and Reviews and updates Interconnection Security Agreements [FedRAMP Assignment: at least annually and on input from FedRAMP]. Table 133 CA-3 Authorized Connections Authorized Connections Information System Name Name of Organization System Connects To Role and Name of Person Who Signed Connection Agreement Name and Date of Interconnection Agreement CA-3 Control Summary Information Responsible Role: Parameter CA-3(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for ,
CM-3 Control Summary Information Responsible Role: Parameter CM-3(e): Parameter CM-3(g)-1: Parameter CM-3(g)-2: Parameter CM-3(g)-3: Parameter CM-3(g)-4: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-3 What is the solution and how is it implemented? Part a Part b Part c Part d Part e Part f Part g CM-3 (1) Control Enhancement (H) The organization employs automated mechanisms to: Document proposed changes to the information system; Notify [Assignment: organization-defined configuration management approval authorities] of proposed changes to the information system and request change approval; Highlight proposed changes to the information system that have not been approved or disapproved by [FedRAMP Assignment: organization agreed upon time period];
Parameter CM-6(c)-2: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-6 What is the solution and how is it implemented? Part a Part b Part c Part d CM-6 (1) Control Enhancement (M) (H) The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components]. CM-6 (1) Control Summary Information Responsible Role: Parameter CM-6(1): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific)
Instruction: In the first three columns, put the NIST SP-60 V2 R1 recommended impact level. In the next three columns, put in the CSP determined recommended impact level. If the CSP determined recommended impact level does not match the level recommended by NIST, put in an explanation in the last column as to why this decision was made. Delete this instruction from your final version of this document. The Table 21 CSP Applicable Information Types with Security Impact Levels Using NIST SP 800-60 V2 R1below uses the NIST SP 800-60 V2 R1 Volume II Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories to identify information types with the security impacts. Table 21 CSP Applicable Information Types with Security Impact Levels Using NIST SP 800-60 V2 R1 Information Type NIST SP 800-60 V2 R1 Recommended Confidentiality Impact Level NIST SP 800-60 V2 R1 Recommended Integrity Impact Level NIST SP 800-60 V2 R1 Recommended Availability Impact Level CSP Selected Confidentiality Impact Level CSP Selected Integrity Impact Level CSP Selected Availability Impact Level Statement for Impact Adjustment Justification