Hardware Inventory The following table lists the principal server hardware components for <Information System Name>. Table 10-1. Server Hardware Components Hostname Make Model and Firmware Location Components that Use this Device hostname1.com Company SilverEdge M710, 4.6ios Dallas, Rm. 6, Rack 4 AppOne, EAuthApp hostname2.com Company SilverEdge M610, 4.6ios Datacenter2, Rack 7 VMs 1-50 Not Applicable Company iSCSI SAN Storage Bldg Rm 7 SAN Storage Note: A complete and detailed list of the system hardware and software inventory is required per NIST SP 800-53, Rev 3 CM-8. Software Inventory The following table lists the principle software components for <Information System Name>.
Table 11-1. System Interconnections CSP IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer etc.) Data Direction (incoming, outgoing, or both) Information Being Transmitted Ports or Circuit #
Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AC-17 (7) What is the solution and how is it implemented? Control Enhancement AC-17 (8) AC-17 (8) The organization disables [Assignment: organization-defined networking protocols within the information system deemed to be non-secure] except for explicitly identified components in support of specific operational requirements. AC-17 (8) Parameter Requirements: [tftp, (trivial ftp); X-Windows, Sun Open Windows; FTP; TELNET; IPX/SPX; NETBIOS; BlueTooth; RPC-services, like NIS or NFS; rlogin, rsh, rexec; SMTP (Simple Mail Transfer Protocol); RIP (Routing Information Protocol); DNS (Domain Name Services); UUCP (Unix-Unix Copy Protocol); NNTP (Network News Transfer Protocol); NTP (Network Time Protocol); Peer-to-Peer] AC-17 (8) Additional FedRAMP Requirements and Guidance: Requirement: Networking protocols implemented by the service provider are approved and accepted by JAB. Guidance: Exceptions to restricted networking protocols are granted for explicitly identified information system components in support of specific operational requirements. AC-17 (8) Control Enhancement Summary Information Responsible Role: Parameter:
Part b Part c Part d Part e (MA) System Maintenance Policy and Procedures (MA-1) The organization develops, disseminates, and reviews/updates [Assignment: organization-defined frequency]: A formal, documented information system maintenance policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the information system maintenance policy and associated system maintenance controls. MA-1 Parameter Requirements: [at least annually] MA-1 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned
Part c Part d Part e Maintenance Tools (MA-3) The organization approves, controls, monitors the use of, and maintains on an ongoing basis, information system maintenance tools. MA-3 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> MA-3 What is the solution and how is it implemented?
Control Enhancements for Maintenance Tools Control Enhancement MA-3 (1) MA-3 (1) The organization inspects all maintenance tools carried into a facility by maintenance personnel for obvious improper modifications. MA-3 (1) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> MA-3 (1) What is the solution and how is it implemented? Control Enhancement MA-3 (2) MA-3 (2) The organization checks all media containing diagnostic and test programs for malicious code before the media are used in the information system. MA-3 (2) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable