<Information Type> <NIST Identifier> Low Low Low (FIPS 199) Based on the information provided in Table 2.3, Sensitivity Categorization of Information Types for the <Information System Abbreviation>, default to the high-water mark for the Information Types as identified in Table 2.4, Security Impact Level, below. If the security impact level for confidentiality, integrity, and availability for any of the identified data types is moderate or high, the information system is not a FedRAMP Tailored LI-SaaS system. The Cloud Service Provider (CSP) must meet the standard FedRAMP Low, Moderate, or High impact baseline security requirements, as applicable, and complete the requirement documentation. Table 2.4. Security Impact Level Security Objective Low, Moderate or High Confidentiality Low Integrity Low Availability Low Through careful review and analysis, the baseline security categorization for the <Information System Abbreviation> system has been determined and is listed in Table 2.5, Baseline Security Configuration, which follows. Table 2.5. Baseline Security Configuration <Information System Abbreviation> Security Categorization Low Using this categorization, in conjunction with the risk assessment and any unique security requirements, the security controls for this system have been established as detailed in this FedRAMP Tailored LI-SaaS Framework. The following individual is identified as the system owner or functional proponent/advocate for this system. 3.1. Information System Owner
☐ Major Modification The system is undergoing a major change, development, or transition. ☐ Other Explain: Click here to enter text. The <Information System Abbreviation> makes use of unique managed service provider architecture layer(s). Information systems, particularly those based on cloud architecture models, are made up of different service layers. Below are some questions that can help system owners determine if their system is a cloud followed by specific questions to help system owners determine the type of cloud. Table 9.1. Determining a Cloud System Question (Yes/No) Conclusion Does the system use virtual machines (VM)? A no response means that system is most likely not a cloud. Does the system have the ability to expand its capacity to meet customer demand? A no response means that the system is most likely not a cloud. Does the system allow the customer to build anything other than servers? A no response means that the system is an Infrastructure as a Service (IaaS). A yes response means that the system is either a Platform as a Service (PaaS) or a SaaS. Does the system offer the ability to create databases? A yes response that the system is a PaaS. Does the system offer various developer toolkits and Application Programming Interfaces (APIs)? A yes response means that the system is a PaaS. Does the system offer only applications that are available by obtaining a login? A yes response that system is a SaaS. A no response means that the system is either a PaaS or an IaaS. The layers of the <Information System Abbreviation> defined in this FedRAMP Tailored Framework are indicated in 9.2, Service Layers Represented in this FedRAMP Tailored LI-SaaS Framework, which follows. Table 9.2. Service Layers Represented in this FedRAMP Tailored LI-SaaS Framework Service Provider Architecture Layers ☐ Software as a Service (SaaS) Major Application
role types. Also include web server administrators, network administrators, and firewall administrators if these individuals have the ability to configure a device or host that could impact the CSP service offering. This must also include whether these roles are fulfilled by foreign nationals or systems outside the United States. Delete this and all other instructions from your final version of this document. Table 10.1. Personnel Roles and Privileges Role Internal or External Privileged (P), Non-Privileged (NP), or No Logical Access (NLA) Sensitivity Level Authorized Privileges Functions Performed UNIX System Administrator Internal P Moderate Full administrative access (root) Add/remove users and hardware, install and configure software, OS updates, patches and hotfixes, perform backups. Client Administrator External NP N/A Portal administration Add/remote client Create, modify, and delete client applications. Program Director Internal NLA Limited N/A Reviews, approves and enforces policy. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. There are currently <number> internal personnel and <number> external personnel. Within one year, it is anticipated that there will be <number> internal personnel and <number> external personnel.
/ Interface> POC> <Phone Security> item. Transmitted> Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> The FedRAMP Laws and Regulations Template can be found on this page: . 13.1, FedRAMP Tailored LI-SaaS Applicable Guidance, includes additional documentation specific to FedRAMP Tailored LI-SaaS information systems. Table 13.1. FedRAMP Tailored LI-SaaS Applicable Guidance Title Date FedRAMP Tailored Security Requirements for Low Impact Software as a Service (LI-SaaS) Cloud Systems 1/30/2017 NIST SP 800-171 rev 1, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations 12/2016 NIST Framework for Improving Critical Infrastructure Cybersecurity, v1.0 2/12/2014 . APPLICABLE STANDARDS AND GUIDANCE Table 13.2, <Information System Name> Standards and Guidance, includes any additional standards and guidance specific to <Information System Name>.
Table 13.2. <Information System Name> Standards and Guidance Identification Number Title Date Link <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> Security controls must meet minimum security control baseline requirements. The following contains the FedRAMP Tailored LI-SaaS Security Controls Baseline (by family). are six (6) categories of FedRAMP Tailored LI-SaaS controls: FED, NSO, Required, Conditional, Inherited, and Attestation. Table 14.1, Control Tailoring Criteria, provides definitions of the tailoring criteria utilized for the determination of the FedRAMP Tailored baseline. Table 14.1. Control Tailoring Criteria Tailoring Symbol Tailoring Criteria CSP Response Requirements FED The control is typically the responsibility of the Federal Government, not the CSP. No CSP response is required. NSO FedRAMP has determined the control does not impact the security of the Cloud SaaS. No CSP response is required. Document and Assess The control must be documented in Appendix B, and independently assessed. This does not mean that a vendor will necessarily have each control implemented or implemented as stated. A vendor must address how they meet (or don't meet) the intent of the control so that it can be independently assessed and detail any risks associated with the implementation. CSP must provide documentation for the control Document and Assess (D&A) Conditional If the condition exists, the control must be documented in Appendix B and independently assessed as above. If the condition does not exist, the CSP must attest to this in Appendix E. CSP must provide documentation for the control below. Inherited The control is inherited from the underlying infrastructure provider (i.e., FedRAMP authorized IaaS/PaaS). CSP attestation response is required.
specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a Security Assertions Markup Language (SAML) Single Sign-On (SSO) solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the CSP Name and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another CSP Name system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits Physical and Environmental (PE) controls from an IaaS provider. (AC) AC-2 Account Management AC-2 Requirement(s) The organization: Identifies and selects the following of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; Monitors the use of information system accounts; and Notifies account managers: When accounts are no longer required; When users are terminated or transferred; and When individual information system usage or need-to-know changes [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] AC-2 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
ATTACHMENTS Instruction: Attach any documents that are referred to in this FedRAMP Tailored LI-SaaS Framework. Documents and attachments should, provide the title, version, and exact file name, including the file extension. Delete this and all other instructions from your final version of this document. A recommended attachment file naming convention is provided in the following table, Attachment File Naming Convention. Use this to generate names for the attachment files. Table 18.1. Attachment File Naming Convention No. Attachment File Name File Extension 1 FedRAMP Tailored LI-SaaS CIS Worksheet <(Information System Abbreviation) CIS version X> . enter extension 2 FedRAMP Inventory Workbook <(Information System Abbreviation) Inventory version X> . enter extension 3 FedRAMP FIPS 199 <Information System FIPS 199 version X> . enter extension 4 <CSP/System Name> Summary of Remediation Plans <(Information System Abbreviation) Remediation Plans version X> . enter extension Additional attachments as applicable ATTACHMENT 1 – CIS All Authorization Packages must include the FedRAMP Control Implementation Summary (CIS) Worksheet. The template is provided in the following file: The following file includes a summary of the control implementation information provided in this FedRAMP Tailored LI-SaaS Framework: ATTACHMENT 2 – All Authorization Packages must include a complete inventory. The FedRAMP Inventory Workbook can be found at the following FedRAMP website page: () ATTACHMENT 3 – FIPS 199 All Authorization Packages must include a complete FIPS 199. The FedRAMP FIPS 199