Identification and Authentication, Authorization, and Access Control Only answer “yes” if the answer is consistently “yes”. For partially implemented areas, answer “no” and describe what is missing to achieve a “yes” answer. If inherited, please indicate partial or full inheritance in the “Describe Capability” column. Any non-inherited capabilities must be described. Table 5-4. Identification and Authentication, Authorization, and Access Control Question Yes No Describe capability, supporting evidence, and any missing elements Does the system identify and authorize users in a manner that cannot be repudiated and which sufficiently reduces the risk of impersonation? [IA-2] Does the system require authentication (MFA) for administrative accounts and functions? [IA-2, IA-2(1), IA-2(3), IA-2(11)] Does the system enforce all DoD traffic through a DoD CAP? CA-3(1,3)] Does the system uniquely identify each individual user? [IA-4, IA-4(4)] Does the system uniquely identify each individual device before allowing connection? [IA-3] Does the system fully comply with eAuth Level 3 or higher? [NIST SP 800-63] State the eAuth Level, and provide sufficient details that justify this level, consistent with NIST SP 800-63. Does the system enforce DoD PKI, PKE and use a DoD PKI registration authority? [IA-5, IA-5(3)] Does the system restrict personnel’s access to resources and the CSP review those privileges? [AC-6(2), AC-6(7)] Does the system design ensure that a process cannot elevate its privileges above the user? [AC-6(8), SI-16] Does the system restrict users from performing privileged function? [AC-6(10)] Does the system ensure secure separation of customer data and data flows [SC-4, AC-4(21)]
Configuration and Risk Management Only answer “yes” if the answer is consistently “yes”. For partially implemented areas, answer “no” and describe what is missing to achieve a “yes” answer. If inherited, please indicate partial or full inheritance in the “Describe Capability” column. Any non-inherited capabilities must be described. Table 5-7. Configuration and Risk Management Question Yes No Describe capability, supporting evidence, and any missing elements Does the CSP maintain a current, complete, and accurate baseline configuration of the information system? [CM-2] Does the CSP maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8] Does the CSP configure the system to ensure least functionality? CM-7(1,2,5)] Does the CSP have a Configuration Management Plan? [CM-9, CM-11] Does the CSP follow a formal change control process that includes a security impact for any change, including security impact assessment? [CM-3, CM-3(4,6), Does the CSP employ automated mechanisms to detect inventory and configuration changes? CM-6(1), CM-8(3)] Does the CSP prevent unauthorized changes to the system? [CM-5, Does the CSP establish configuration settings for based on DoD STIGs and SRGs and reflect the most restrictive mode consistent with operational requirements? [CM-6] Describe which STIGs are used, and any portions of the systems NOT configured in accordance with STIGs. Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6, CM-6(1)]