4/24/2012 Appendix F, p. 42 Scan inventory added, severity rating added in false positive table FedRAMP Office 4/25/2012 p. 44 Added Appendix G FedRAMP Office 4/25/2012 p. 25 Modified Source of Discovery explanation FedRAMP Office 4/30/2012 Appendices Tables FedRAMP Office 05/01/2012 Appendix Updated Appendix C FedRAMP Office 11/20/2012 § 5 Revised wording and instructions. FedRAMP Office 12/3/2012 p. 19, T-16 Denial of Service FedRAMP Office 12/13/2012 § 5 Revised wording and instructions FedRAMP Office 12/17/2012 Appendix F Revised instructions FedRAMP Office 1/14/2013 § 5 Modified section name FedRAMP Office 5/10/2013 Various Added Table ES-1; §1.0 Removed reference to management, technical, and operational controls for consistency with SP 800-53, Rev. 4;§1.3 Added SAP date field; Table 1-1 heading; §3.0, §3.1, §3.2, §3.5 minor wording changes; Table 3-1 Availability description; §4.0, §4.1, §4.2, §4.3, §4.4 removed Type for consistency with SP 800-53, Rev 4; §4.0 Added reference to CVEs and OWASP; Revised instructions in Appendices C, D, E, F, G; Added F.4.1 and F.4.2. FedRAMP Office of Contents
Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service Distributed Denial of Service Attack P An adversary uses multiple compromised information systems to attack a single target and could cause denial of service for users of the targeted information systems. Denial of Service Earthquake E Seismic activity can damage the information system or its facility. Please refer to the following document for earthquake probability maps . Destruction Denial of Service Electromagnetic Interference E, P Disruption of electronic and wire transmissions could be caused by high frequency (HF), very high frequency (VHF), and ultra-high frequency (UHF) communications devices (jamming) or sun spots. Denial of Service Espionage P The illegal covert act of copying, reproducing, recording, photographing or intercepting to obtain sensitive information . Disclosure Modification Fire E, P Fire can be caused by electrical problems, lightning, chemical agents, or other unrelated proximity fires. Destruction Denial of Service Floods E damage caused by flood hazards can be caused by proximity to local flood plains. Flood maps and base flood elevation should be considered. Destruction Denial of Service Fraud P Intentional deception regarding data or information an information system could compromise the confidentiality, integrity, or availability of an information system. Disclosure Modification or Destruction Unavailable Accurate Records Hardware or Equipment Failure E Hardware or equipment may fail due to a variety of reasons. Denial of Service Hardware Tampering P An unauthorized modification to hardware that alters the proper functioning of equipment in a manner that degrades the security functionality the asset provides. Modification Denial of Service
Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane impact the facilities that house the information systems. Destruction Denial of Service Malicious Software P Software that damages a system such a virus, Trojan, or worm. Modification or Destruction Denial of Service Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service Power Interruptions E interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g. spike, surge, brownout, or blackout). Denial of Service Procedural Error U An in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service Sabotage P Underhand interference with work. Modification or Destruction Denial of Service Scavenging P Searching through disposal containers (e.g. dumpsters) to acquire unauthorized data. Disclosure Severe Weather E Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. Destruction Denial of Service