3 6 1. 7 1.1 7 2. 8 2.1 (GR) CSP 8 2.1.1 GR-1A.2 Use of other CSP resources 9 2.1.2 GR-1A.3 Requirement for mission system inclusion 10 2.1.3 GR-1A.4 Access Controls - passwords 10 2.1.4 GR-1A.5 DoDIN connectivity 11 2.1.5 GR-1A.6 Separation of DoD Data 12 2.1.6 GR-1A.7 Data Locations 13 2.1.7 GR-1A.8 Data spill incident handling 14 2.2 15 2.2.1 CND-1B.1 Communication with CND Tier II Service Provider 15 2.2.2 CND-1B.2 Notice of scheduled outages 16 2.2.3 CND-1B.3 Support for DoD installed HBSS 17 3. 5 19 3.1 (AC) 21 3.1.1 Access Control (AC) - Additional controls 21 3.1.2 Access Control (AC) – changed controls 26 3.2 (AT) – 34 3.2.1 Awareness and Training (AT) – changed controls 34 3.3 (AU) 36 3.3.1 Audit and Accountability (AU) – additional controls 36 3.3.2 Audit and Accountability (AU) – changed controls 41 3.4 (CA) 48 3.4.1 Assessment and Authorization (CA) – Additional controls 48 3.4.2 Assessment and Authorization (CA) – changed controls 50 3.5 (CM) 53 3.5.1 3.5.1 Configuration Management (CM) - Additional controls 53 3.5.2 Configuration Management (CM) – changed controls 61 3.6 (CP) – 69 3.6.1 Contingency Planning (CP) – changed controls 69 3.7 (IA) 70 3.7.1 Identification and Authentication (IA) – additional controls 70 3.7.2 Identification and Authentication (IA) – changed controls 75 3.8 (IR) 79 3.8.1 Incident Response (IR) - additional controls 79 3.8.2 Incident Response (IR) - changed controls 82 3.9 (MA) 86 3.9.1 Maintenance (MA) – additional controls 86 3.10 (MP) 89 3.10.1 Protection (MP) – additional controls 89 DOD
3.10.2 Protection (MP) – changed controls 92 3.11 (PE) 94 3.11.1 Physical and Environmental Protection (PE) – additional controls 94 3.11.2 Physical and Environmental Protection (PE) – changed controls 99 3.12 (PS) 101 3.12.1 Personnel Security (PS) – Additional controls 101 3.12.2 Personnel Security (PS) – changed controls 102 3.13 (RA) 106 3.13.1 Risk Assessment (RA) – additional controls 106 3.14 (SA) 106 3.14.1 System and Services Acquisition (SA) - additional controls 106 3.15 (SC) 109 3.15.1 System and Communications Protection (SC) – additional controls 109 3.15.2 System and Communications Protection (SC) – changed controls 120 3.16 (SI) 124 3.16.1 System and Information Integrity (SI) – additional controls 124 3.16.2 System and Information Integrity (SI) – changed controls 128 Cloud Service Provider Signatures X <named CSP official attesting to content> <Date> <Title> <Company name> X CSP official attesting to content> <Date> <Title> <Company name> X
Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AU-12 What is the solution and how is it implemented? Assessment and Authorization (CA) Assessment and Authorization (CA) – Additional controls CA-2(2) – Security Assessments Enhancement The organization includes as part of security control assessments, [Assignment: frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises]; OR [Assignment: organization-defined other forms of security testing]. DoD parameter 1: [Annually or more frequently as required by the security plan] DoD parameter 2: [announced] DoD parameter 3: [in-depth monitoring; malicious user testing; penetration testing; red team exercises; and/or other forms of security testing (e.g. vulnerability scans, integrity checks, security readiness reviews) as necessary.)]
CM-4 (2) What is the solution and how is it implemented? CM-5 (2) – Access Restrictions for Change The organization conducts audits of information system changes [Assignment: frequency] and when indications so warrant to determine whether unauthorized changes have occurred. DoD parameter: [every 7 days] CM-5 (2) Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-5 (2) What is the solution and how is it implemented? CM-5 (3) – Access Restrictions for Change The information system prevents the installation of [Assignment: organization-defined critical software programs] that are not signed with a certificate that is recognized and approved by the
Part a Part b MA-4 (6) - Non-Local Maintenance The organization employs cryptographic mechanisms to protect the integrity and confidentiality of maintenance and diagnostic communications. MA-4 (6) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) MA-4 (6) What is the solution and how is it implemented? MA-4 (7) - Maintenance The organization employs remote disconnect verification at the termination of non-local maintenance and diagnostic sessions. MA-4 (7) Control Summary Information