Executive Summary In the space below, provide a one-paragraph description of the system that includes all the information provided in Table 3-1, System Information. In the space below, make a statement as to the CSP’s overall readiness, then provide up to four paragraphs that summarize the information provided in Sections , , and 4.3, based on the 3PAO’s cybersecurity expertise and knowledge of FedRAMP, including notable strengths and other areas for consideration. At a minimum, the 3PAOs must describe the following: Overall alignment with the National Institute of Science and Technology (NIST) definition of cloud computing according to NIST SP 800-145; Notable strengths and weaknesses; Ability to consistently maintain a clearly defined system boundary; Clearly defined customer responsibilities; Unique or alternative implementations; Overall maturity relative to the system type, size, and complexity; and Overall operational maturity relative to how long the system and required security controls have been in operation of
2 Does the CSP employ automated mechanisms to maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8, CM-8(2)] 3 Does the CSP employ automated mechanisms to detect inventory and configuration changes? [CM-6(1), CM-8(3)] 4 Does the CSP have a Configuration Management Plan? [CM-9, CM-11] 5 Does the CSP employ automated mechanisms to implement a formal change control process? [CM-3, CM-3(1)] 6 Does the CSP’s formal change control process include a security impact assessment? [CM-4] 7 Does the CSP prevent unauthorized changes to the system? [CM-5, CM-5(1), CM-5(5), CM-11, CM-11(1)] 8 Does the CSP establish configuration settings for products employed that reflect the most restrictive mode consistent with operational requirements? [CM-6] If “yes,” describe if the configuration settings are based on Center for Internet Security (CIS) Benchmarks or United States Government Configuration Baseline (USGCB), or “most restrictive consistent with operational requirements.” 9 Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6] For the following questions, 3PAOs may use Table 4-18 (Continuous Monitoring Capabilities – Additional Details) to enter the capability descriptions, supporting evidence and missing elements. 10 Does the CSP perform authenticated operating system/ infrastructure, web, and database vulnerability scans at least monthly, as applicable? [RA-5, RA-5(5), SI-2(2)] Describe how the 3PAO validated that vulnerability scans were fully authenticated. 11 Does the CSP demonstrate the capability to remediate High vulnerabilities within 30 days and Moderate vulnerabilities within 90 days? [RA-5, FedRAMP Continuous Monitoring Guide] Describe how the 3PAO validated that the CSP remediates High vulnerabilities within 30 days and Moderate vulnerabilities within 90 days. 12 When a High vulnerability is identified as part of ConMon activities, does the CSP consistently check audit logs for evidence of exploitation? [RA-5(8)]
Table 4-10. Missing Policy and Procedure Elements Missing Policy and Procedure Elements The 3PAO must answer the questions below. 4-11. Security Awareness Training Question Yes No Describe capability, supporting evidence, and any missing elements Does the CSP train personnel on security awareness and security responsibilities? Additional Capability Information FedRAMP will evaluate the responses in this section on a case-by-case relative to a FedRAMP-Ready designation decision. Staffing Levels In the table below, the 3PAO must describe the CSP’s organizational structure, staffing levels currently dedicated to the security of the system, as well as any planned changes to these staffing levels. This description must clearly indicate role and number of individuals as well as identify which staff is dedicated full-time, and which are performing their role as a collateral duty. 4-12. Staffing Levels Staffing Levels Change Management Maturity the following change management capabilities are not required, they indicate a more mature change management capability and may influence a FedRAMP-Readiness decision, especially for larger systems. The 3PAO must answer the questions below. Table 4-13. Change Management # Question Yes No If “no”, please describe how this is accomplished. 1 Does the CSP’s change management capability include a fully functioning Change Control Board (CCB)? 2 Does the CSP have and use development and/or test environments to verify changes before implementing them in the production environment? Vendor Dependencies and Agreements The 3PAO must answer the questions below. Table 4-14. Vendor Dependencies and Agreements # Question Yes No Instructions