Table 11-1. System Interconnections CSP IP Address and Interface External Organization Name and IP Address of System External Point of Contact and Phone Number Connection Security (IPSec VPN, SSL, Certificates, Secure File Transfer etc.) Data Direction (incoming, outgoing, or both) Information Being Transmitted Ports or Circuit #
Control Enhancement AU-6 (1) AU-6 (1) The information system integrates audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. AU-6 (1) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AU-6 (1) What is the solution and how is it implemented? Control Enhancement AU-6 (3) AU-6 (3) The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness. AU-6 (3) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific
Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-6 (3) What is the solution and how is it implemented? Least Functionality (CM-7) The organization configures the information system to provide only essential capabilities and specifically prohibits or restricts the use of the following functions, ports, protocols, and/or services [Assignment: organization-defined list of prohibited or restricted functions, ports, protocols, and/or services] CM-7 Parameter Requirement: See additional requirements and guidance. CM-7 Additional FedRAMP Requirements and Guidance: Requirement: The service provider uses the Center for Internet Security guidelines (Level 1) to establish a list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. The list of prohibited or restricted functions, ports, protocols, and/or services is approved and accepted by the JAB. Guidance: Information on the USGCB checklists can be found at: . CM-7 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned
A formal, documented contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Formal, documented procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls. CP-1 Parameter Requirement: [at least annually] CP-1 Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) CP-1 What is the solution and how is it implemented? Part a Part b Contingency Plan (CP-2) The organization: Develops a contingency plan for the information system that: Identifies essential missions and business functions and associated contingency requirements; Provides recovery objectives, restoration priorities, and metrics;
Partially implemented Planned Alternative implementation Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IR-4 What is the solution and how is it implemented? Control Enhancement for Incident Handling Control Enhancement IR-4 (1) IR-4 (1) The organization employs automated mechanisms to support the incident handling process. IR-4 (1) Control Enhancement Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA>
PE-14a Additional FedRAMP Parameter Requirements: The service provider measures temperature at server inlets and humidity levels by dew point. Monitors temperature and humidity levels [Assignment: organization-defined frequency] PE-14b Parameter Requirements: [continuously] PE-14 Control Summary Information Responsible Role: Parameter 14a: Parameter 14a Additional: Parameter 14b: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> PE-14 What is the solution and how is it implemented? Water Damage Protection (PE-15) The organization protects the information system from damage resulting from water leakage by providing master shutoff valves that are accessible, working properly, and known to key personnel.