3 5 6 DISA 6 7 General Readiness (GR) CSP Questions 7 Computer Network Defense questions 10 2 17 19 Access Control (AC) – Additional controls 19 Access Control (AC) – different parameters 21 Awareness and Training (AT) – different parameters 28 and Accountability (AU) – different parameters 28 Assessment and Authorization (CA) – Additional controls 33 Assessment and Authorization (CA) – different parameters 33 Configuration Management (CM) - Additional controls 36 Configuration Management (CM) – different parameters 39 Contingency Planning (CP) – different parameters 44 Identification and Authentication (IA) – additional controls 45 Identification and Authentication (IA) – different parameters 47 Incident Response (IR) - additional controls 51 Incident Response (IR) - different parameters 52 Maintenance (MA) – additional controls 54 Media Protection (MP) – additional controls 55 Media Protection (MP) – different parameters 58 Physical and Environmental Protection (PE) – additional controls 59 Physical and Environmental Protection (PE) – different parameters 61 Personnel Security (PS) – different parameters 64 Risk Assessment (RA) – additional controls 66 System and Services Acquisition (SA) - additional controls 67 System and Communications Protection (SC) – additional controls 68 System and Communications Protection (SC) – different parameters 73 System and Information Integrity (SI) – additional controls 77 System and Information Integrity (SI) – different parameters 82 A: DISA ECSB 88 Cloud Service Provider Signatures
Part b Part c Part d Part e SC-23 (1) - Session Authenticity The information system invalidates session identifiers upon user logout or other session termination. SC-23 (1) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SC-23 (1) What is the solution and how is it implemented?
The assessment Team Lead has established a repository in eMass for the assessment artifacts (and placed the documentation received to date) in the repository Exit criteria The CSP and FSO Team agree that the SSP Addendum is complete and can therefore be used as the basis for review and testing Support review of existing FedRAMP documentation: Description: The FSO team assessors review and analyze the FedRAMP SSP and the associated artifacts from the 3PAO involved. In addition, the assessors review the Security Assessment Report (SAR) and the resulting Program of Actions and Milestones (POA&M) for the determination of risk per the FedRAMP process as it relates to DoD The assessors generally trust the results of the 3PAO in this analysis. However, the assessors consider the actions and conclusions as they relate to DoD needs and so questions may arise. Of particular interest will likely be system scans and vulnerability analysis. Milestones/artifacts: The FSO assessment team has requested specific artifacts from past assessments as well as any updates the assessment (e.g. POA&M updates detailed testing info). The CSP has provided the requested artifacts. This may be obtained from the FedRAMP repository or from the CSP (including the 3PAO). The FSO has completed the analysis of FedRAMP materials for risk to DoD environments, identifying additional artifacts or materials needed Exit criteria: Completion of FSO assessment of FedRAMP materials in DRAFT Interim Certification Recommendation and identification of further materials needed to complete DoD overlay requirements Support FSO Assessor review of the provided DoD SSP Errata: Description: The assessors review and analyze the provided Errata for compliance with the additional controls. There may be iterative technical exchanges via teleconference or meetings if questions arise during this process if clarification is needed. Milestones/artifacts: CSP provides all requested additional material and artifacts FSO Assessment team completes(draft) risk report based on documentation, including any recommended adjustment of risk from the FedRAMP assessment Exit criteria FSO Assessment team completes verification/test plan based on the information in the documentation. This plan identifies some security controls to investigate further, either via meetings (either during a site visit or telephone conferencing) or through direct inspection or testing.