AU-9(4) What is the solution and how is it implemented? Part a Part b Audit and Accountability (AU) – changed controls AU-2(3): Audited Events The organization reviews and updates the list of auditable events [Assignment: frequency]. DoD parameter: [annually or whenever is a change in the threat environment] Guidance: Changes in the threat environment may be detected by the CSP and communicated to the ECSB and/or customer’s CNDSP or is communicated to the service provider by the ECSB and/or customer's CNDSP in conjunction with USCYBERCOM. FedRAMP baseline parameter: [annually or whenever there is a change in the threat environment] Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB. AU-2(3) Control Summary Information Responsible Role: Parameter: Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Not applicable
AU-12a: Audit Generation The information system: Provides audit record generation capability for the list of auditable events defined in at [Assignment: organization-defined information system components]; … DoD parameter: [all information system and network components where audit capability is deployed/available)] FedRAMP baseline parameter: [all information system components where audit capability is deployed] AU-12a Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AU-12 What is the solution and how is it implemented? Assessment and Authorization (CA) Assessment and Authorization (CA) – Additional controls CA-2(2) – Security Assessments Enhancement The organization includes as part of security control assessments, [Assignment:
Partially implemented Planned Alternative implementation - equivalence (explain Configured by customer Not applicable Control Origination all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IA-5 (3) What is the solution and how is it implemented? Incident Response (IR) Incident Response (IR) - additional controls IR-4 (3) - Incident Handling The organization identifies classes of incidents and defines appropriate actions to take in response to ensure continuation of organizational missions and business functions. Requirement: The following are the categories of information requirements relevant to CSP operations. information requirements are fulfilled by the CSP through incident reporting, and further detail (CJCSM 6510.01B) on reporting requirements is dependent on impact level and service type: • Malware • Denial of Service attack • Targeted malicious activity • Significant vulnerabilities • System compromise • Service outage with mission impact (e.g., scheduled maintenance, natural disasters) Requirement: The CSP defines incident categories consistent with CJCSM 6510.01B and includes the following:
PE-3 (3) - Physical Access Control The organization guards, alarms, and monitors every physical access point to the facility where the information system resides 24 hours per day, 7 days per week. PE-3 (3) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> PE-3 (3) What is the solution and how is it implemented? Physical and Environmental Protection (PE) – changed controls PE-2c – Physical Access Authorizations The organization: … c. Reviews and approves the access list and authorization credentials [Assignment: frequency], removing from the access list, personnel no longer requiring access. DoD parameter: [monthly] FedRAMP baseline parameter: [at least annually] PE-2c Control Enhancement Summary Information
Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SI-2(2) What is the solution and how is it implemented? SI-3c – Malicious Code Protection The organization: … c. Configures malicious code protection mechanisms to: - perform periodic scans of the information system [Assignment: organization-defined frequency] and real-time scans of files from external sources as the files are downloaded, opened, or executed in accordance with organizational security policy; and - [Selection (one or more): block malicious code; quarantine malicious code; send alert to administrator; [Assignment: organization-defined action] in response to malicious code detection; DoD parameter 1: [at least weekly] DoD parameter 2: [block malicious code; quarantine malicious code; send alert to administrator] DoD parameter 3: [send alert to USCYBERCOM via DoD customer's CNDSP, and send alert to ECSB] FedRAMP baseline parameter: Parameter 1: [at least weekly] Parameter 2: [block malicious code; quarantine malicious code; send alert to administrator] Parameter 3: [block or quarantine malicious code, send alert to administrator, send alert to FedRAMP] SI-3c Control Summary Information Responsible Role: Parameter 3:
SI-4a Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SI-4a What is the solution and how is it implemented? SI-5a – Security Alerts, Advisories, and Directives The organization: Receives information system security alerts, advisories, and directives from designated external organizations on an ongoing basis; REQUIREMENT: The “designated external organization” is defined as CND Tier II. CSPs must be able to receive and act upon warnings and notifications that are sent by CND Tier II. notifications may be generated by Tier I or II CND and will include guidance for or countermeasures to be taken by CSPs. Guidance: The CSP should describe how they plan to act upon warnings and notification from DoD CND Tier II. SI-5a Control Summary Information Responsible Role: