3 6 1. 7 1.1 7 2. 8 2.1 (GR) CSP 8 2.1.1 GR-1A.2 Use of other CSP resources 9 2.1.2 GR-1A.3 Requirement for mission system inclusion 10 2.1.3 GR-1A.4 Access Controls - passwords 10 2.1.4 GR-1A.5 DoDIN connectivity 11 2.1.5 GR-1A.6 Separation of DoD Data 12 2.1.6 GR-1A.7 Data Locations 14 2.1.7 GR-1A.8 Data spill incident handling 14 2.2 15 2.2.1 CND-1B.1 Communication with CND Tier II Service Provider 15 2.2.2 CND-1B.2 Notice of scheduled outages 16 2.2.3 CND-1B.3 Support for DoD installed HBSS 17 3. 4 19 3.1 (AC) 21 3.1.1 Access Control (AC) - Additional controls 21 3.1.2 Access Control (AC) – changed controls 22 3.2 (AT) – 30 3.2.1 Awareness and Training (AT) – changed controls 30 3.3 (AU) 32 3.3.1 Audit and Accountability (AU) – additional controls 32 3.3.2 Audit and Accountability (AU) – changed controls 33 3.4 (CA) 40 3.4.1 Assessment and Authorization (CA) – Additional controls 40 3.4.2 Assessment and Authorization (CA) – changed controls 42 3.5 (CM) 46 3.5.1 3.5.1 Configuration Management (CM) - Additional controls 46 3.5.2 Configuration Management (CM) – changed controls 47 3.6 (CP) – 55 3.6.1 Contingency Planning (CP) – changed controls 55 3.7 (IA) 56 3.7.1 Identification and Authentication (IA) – additional controls 56 3.7.2 Identification and Authentication (IA) – changed controls 57 3.8 (IR) 61 3.8.1 Incident Response (IR) - additional controls 61 3.8.2 Incident Response (IR) - changed controls 63 3.9 (MA) 67 3.9.1 Maintenance (MA) – additional controls 67 3.10 MA-4 (7) (MP) 68 3.10.1 Protection (MP) – additional controls 68 DOD
GR-1A.4 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented (Yes) Partially implemented Planned Alternative implementation – equivalent (explain below) Not applicable (No) GR-1A.4 What is the solution and how is it implemented? GR-1A.5 DoDIN connectivity a. Does the CSP participate in the Defense Industrial base (DIB) Cyber Security/Information Assurance (CS/IA) Program? b. Does the CSP meet the requirements to access DIBNet-U as specified by the DIB CS/IA Program? c. Does the CSP system connect to DoDIN for all external connections? Guidance: Information on the DIB CS/IA Program can be found at . Further instruction on connection to the DoDIN can be found in Chairman of the Chief of Staff (CJCS) Instruction 6211.02D at GR-1A.5 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented (Yes) Partially implemented Planned Alternative implementation – equivalent (explain below) Not applicable (No) GR-1A.5 What is the solution and how is it implemented?
Part b IA-2 (9) – Identification and Authentication (Organizational Users) The information system uses [Assignment: organization-defined replay-resistant authentication mechanisms] for network access to non-privileged accounts. DoD parameter: [Replay-resistant authentication mechanisms (e.g. Time Stamp Cryptographic mechanisms, Protected incremented Counters, Nonces, Cnonce)] IA-2 (9) Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IA-2 (9) What is the solution and how is it implemented? Identification and Authentication (IA) – changed controls IA-3 – Device Identification and Authentication The information system uniquely identifies and authenticates [Assignment: organization-defined
of devices. The list of devices and/or device types is approved and accepted by the JAB.] IA-4d Control Summary Information Responsible Role: Parameter: Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IA-4d What is the solution and how is it implemented? IA-5g – Authenticator Management The organization manages information system authenticators for and devices by: … g. Changing/refreshing authenticators [Assignment: organization-defined time period by authenticator type] DoD parameter: [sixty days for passwords; 3 years for CAC/PKI certificate; 3 years for biometrics if applicable.] FedRAMP baseline parameter: [sixty days] IA-5g Control Summary Information Responsible Role: Parameter: