<Logo> Organization Name <Company/Organization>. Street Address <Street Address> Suite/Room/Building <Suite/Room/Building> City, State Zip <Zip Code> Assessment Plan/Procedures and Assessment Results Prepared by: Identification of Independent Assessor <Logo> Organization Name <Company/Organization>. Street Address <Street Address> Suite/Room/Building <Suite/Room/Building> City, State Zip <Zip Code> Template Revision History Date Description Template Version Author 6/19/2017 Initial release version 1.0 FedRAMP PMO 7/11/2017 Updated on first round of public comments 2.0 FedRAMP PMO 8/23/2017 Final baseline for publication/use 3.0 FedRAMP PMO 8/25/2017 Minor content revisions to more properly align with the core document 3.2 FedRAMP PMO 9/21/2017 Revised the SA-9 requirement statement to resolve a copy/paste error 3.3 FedRAMP PMO 10/27/2017 Revised AC-2 to better reflect the exclusion of some clauses. Revised SA-9 to address a copy/past and adds missing control CA-3. 3.4 FedRAMP PMO
Control Summary and Implementation Descriptions Application/Service Provider Assessment Plan/Procedures Independent Assessor Assessment Results Independent Assessor Remediation Plan Application/Service Provider Summary of Assessment Results – Section 15 Independent Assessor Summary of Remediation Plans – Section 16 Application/Service Provider List of Attachments – Section 17 Application/Service Provider and Independent Assessor as applicable Remove all instructions from your final version of the document. Table of Contents
role types. Also include web server administrators, network administrators, and firewall administrators if these individuals have the ability to configure a device or host that could impact the CSP service offering. This must also include whether these roles are fulfilled by foreign nationals or systems outside the United States. Delete this and all other instructions from your final version of this document. Table 10.1. Personnel Roles and Privileges Role Internal or External Privileged (P), Non-Privileged (NP), or No Logical Access (NLA) Sensitivity Level Authorized Privileges Functions Performed UNIX System Administrator Internal P Moderate Full administrative access (root) Add/remove and hardware, install and configure software, OS updates, patches and hotfixes, perform backups. Client Administrator External NP N/A Portal administration Add/remote client users. Create, modify, and delete client applications. Program Director Internal NLA Limited N/A Reviews, approves and enforces policy. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. Choose an item. There are currently <number> internal personnel and <number> external personnel. Within one year, it is anticipated that there will be <number> internal personnel and <number> external personnel.
/ Interface> POC> <Phone Security> item. Transmitted> Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> <SP IP Address / Interface> <External Org/IP> <External Org POC> <Phone <Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers> The FedRAMP Laws and Regulations Template can be found on this page: . 13.1, FedRAMP Tailored LI-SaaS Applicable Guidance, includes additional documentation specific to FedRAMP Tailored LI-SaaS information systems. Table 13.1. FedRAMP Tailored LI-SaaS Applicable Guidance Title Date FedRAMP Tailored Security Requirements for Low Impact Software as a Service (LI-SaaS) Cloud Systems 1/30/2017 NIST SP 800-171 rev 1, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations 12/2016 NIST Framework for Improving Critical Infrastructure Cybersecurity, v1.0 2/12/2014 . APPLICABLE STANDARDS AND GUIDANCE Table 13.2, <Information System Name> Standards and Guidance, includes any additional standards and guidance specific to <Information System Name>.
MP-1 Media Protection Policy and Procedures x MP-2 Access x x x MP-6 Media Sanitization x x x MP-7 Use x x x PE – Physical and Environmental Protection PE-1 Physical and Environmental Protection Policy and Procedures x PE-2 Physical Access Authorizations x x x PE-3 Physical Access Control x x x PE-6 Monitoring Physical Access x x x PE-8 Visitor Access Records x x x PE-12 Emergency Lighting x x x PE-13 Fire Protection x x x PE-14 Temperature and Humidity Controls x x x PE-15 Damage Protection x x x PE-16 Delivery and Removal x x x PL – Planning PL-1 Security Planning Policy and Procedures x PL-2 System Security Plan x PL-4 Rules of Behavior x PS – Personnel Security PS-1 Personnel Security Policy and Procedures x PS-2 Position Risk Designation x PS-3 Personnel Screening x PS-4 Personnel Termination x PS-5 Personnel Transfer x PS-6 Access Agreements x PS-7 Personnel Security x PS-8 Personnel Sanctions x RA – Risk Assessment RA-1 Risk Assessment Policy and Procedures x RA-2 Security Categorization x RA-3 Risk Assessment x RA-5 Vulnerability Scanning x SA – System and Services Acquisition SA-1 System and Services Acquisition Policy and Procedures x SA-2 Allocation of Resources x SA-3 System Development Life Cycle x
specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a Security Assertions Markup Language (SAML) Single Sign-On (SSO) solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the CSP Name and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another CSP Name system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits Physical and Environmental (PE) controls from an IaaS provider. (AC) AC-2 Account Management AC-2 Requirement(s) The organization: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; Monitors the use of information system accounts; and Notifies account managers: When accounts are no longer required; When users are terminated or transferred; and When individual information system or need-to-know changes [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] AC-2 Control Summary Information Responsible Role: Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
ATTACHMENTS Instruction: Attach any documents that are referred to in this FedRAMP Tailored LI-SaaS Framework. Documents and attachments should, provide the title, version, and exact file name, including the file extension. Delete this and all other instructions from your final version of this document. A recommended attachment file naming convention is provided in the following table, Attachment File Naming Convention. Use this to generate names for the attachment files. Table 18.1. Attachment File Naming Convention No. Attachment File Name File Extension 1 FedRAMP Tailored LI-SaaS CIS Worksheet <(Information System Abbreviation) CIS version X> . enter extension 2 FedRAMP Inventory Workbook <(Information System Abbreviation) Inventory version X> . enter extension 3 FedRAMP FIPS 199 <Information System FIPS 199 version X> . enter extension 4 <CSP/System Name> Summary of Remediation <(Information System Abbreviation) Remediation Plans version X> . enter extension Additional attachments as applicable ATTACHMENT 1 – CIS All Authorization Packages must include the FedRAMP Control Implementation Summary (CIS) Worksheet. The template is provided in the following file: The following file includes a summary of the control implementation information provided in this FedRAMP Tailored LI-SaaS Framework: ATTACHMENT 2 – All Authorization Packages must include a complete inventory. The FedRAMP Inventory Workbook can be found at the following FedRAMP website page: () ATTACHMENT 3 – FIPS 199 All Authorization Packages must include a complete FIPS 199. The FedRAMP FIPS 199