Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the JAB/AO. Where user management is a function of the service, reports of activity of consumer users shall be made available.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Should use a shorter timeframe than AC-12.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Required if shared/group accounts are deployed
+Included in FedRAMP Moderate Baseline, Rev 4
+Required if shared/group accounts are deployed
+NIST added this control to the NIST High Baseline during the 1/15/2015
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Guidance: Required for privileged accounts.
+(b) Guidance: Required for privileged accounts.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. If there is a significant high-impact risk of inadvertent or intentional data leakage with a system deployed in a shared-service environment, this control is justified to mitigate that risk. Similar justification applies when an organization needs to ensure data isolation between different types of information enclaves within the organization.
+ANALYSIS. Although this control is usually employed to control flows between different classified enclaves, it can also apply to non-classified scenarios (e.g., the need to isolate legal, personnel, health-related, financial, or other information or files deemed sensitive.
+SAMPLE THREAT VECTORS. Sensitive free-text information passes from the personnel department to the rest of the organization. Law-enforcement sensitive information is inadvertently pulled from the organization's general counsel case management system and passed outside the department to users without authorization to view that information. HIPAA-protected health information flows freely from the HR department to all employees. Privacy-Act information flows from an HR system into a publicly released report.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Integrity-Assured, Adaptive, Manageable, Assessed, Auditable, Regulated, Controlled, Monitored, Providing Good Data Stewardship, Assured, Competent, Confidential, Data Controllable, Access-Controlled.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+CSP Insider Threat mitigation; Good housekeeping and a best business practice for the protection of the CSP and customer alike. In a cloud environment, the power (and potentially harm) of the privileged users is greatly magnified because of the scale. For that reason periodic review of privileges is important.
+Priority for adding to FedRAMP-M: HIGH
+This control is not part of the NIST high baseline and was added for FedRAMP at the recommendation of DoD and NIST. This is a CNSSI 1253 control.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. If an organization's mobile devices carry information whose loss would have a high impact, this control is warranted in order to mitigate the risk of such loss.
+ANALYSIS. The technologies associated with this control are well established COTS hardware and software.
+SAMPLE THREAT VECTORS. Mobile device is lost, falls into the hands of people without authorization to view the information contained on the device.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Integrity-Assured, Usable, Adaptive, Manageable, Agile, Supported, Assessed, Auditable, Regulated, Controlled, Monitored, Providing Good Data Stewardship, Assured, Confidential, Data Controllable, Access-Controlled, Mission Assured.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB/AO.
+Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB/AO.
+Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.
+Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB/AO.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Recommended by High Baseline Tiger Team. vulnerabilities associated with not having a logout button are well-documented.
+Guidance: https://www.owasp.org/index.php/Testing_for_logout_functionality_%28OTG-SESS-006%29
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Rationale for Selection: Best business practice for the protection of the CSP and customer alike " when not intended for use". This is an unanticipated vector for attack if present and active. While probably not an issue with data center servers and networking devices, wireless is becoming embedded in many components and devices such as printers, fax devices, copiers, scanners, communications devices, etc. There is the additional potential that wireless capabilities may become available in air conditioners, power centers, power controllers, lighting, alarm systems, etc. There is a potential that these capabilities could exist without organizational awareness. Selection drivedsawareness. It's better to perform the check than to make assumptions about what devices are in the IS.
+ECSB Supplemental Guidance as the C/CE relates to CSPs
+The application of this control enchancement should include all systems and devices in the CSP facility such as printers, fax devices, copiers, scanners, communications devices, air conditioners, power centers, power controllers, lighting, alarm systems, etc. Wireless networking capabilities should be disabled when they are near or networked with systems supporting customer's services.
+Priority for adding to FedRAMP-M: Moderate
+(Low L1/2)
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. High-impact systems warrant significantly elevated protection; one of these elevated protections is provided through simulated no-notice attacks that exercise users' ability to detect and respond correctly to attempts to steal internal information in their possession.
+ANALYSIS. These controls are well understood and widely installed; COTS components keep implementation time and cost low.
+SAMPLE THREAT VECTORS. Cybersecurity staff do not know how to monitor, respond, and manage complex enforcement systems and subsystems. Cybersecurity staff is not properly trained to understand how the controls are to operate. Staff does not understand the event alarms/logs. Staff is not able to protect from unauthorized disclosure. Staff is careless with handling data, or unwilling to follow the established security protocols, or willing to cut corners to save time.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Integrity-Assured, Assessed, Auditable, Controlled, Monitored, Providing Good Data Stewardship, Assured, Competent, Confidential.
+NEED. High-impact systems warrant significantly elevated protection.
+ANALYSIS. These controls are well understood and widely installed.
+THREAT VECTORS ADDRESSED. Staff does not know how to monitor or manage complex systems in a way that supports effective management decision or control. Malicious actors manipulate the system to appear as if functioning normally when in reality, it is not. People fail to review event logs. People make unauthorized changes to event logger.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Integrity-Assured, Assessed, Auditable, Controlled, Monitored, Providing Good Data Stewardship, Assured, Competent, Confidential.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tennant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. Due to the complexity of independent systems exchanging security-related monitoring data, and high-impact systems implemented in shared-service environments, the responsible organization needs a centralized capability that integrates these various data sources into a unified whole permitting central review and analysis of diverse log data relevant to security audits.
+ANALYSIS. This control permits analysts and auditors to focus on their primary duty of analyzing log data, and relieves them of the usual burden of discovery, collection, validation, aggregation, and indexing of large log datasets relevant to system security. Since these latter collection tasks have been automated under this control, less time and funding will be required to execute this core audit/analysis activity.
+SAMPLE THREAT VECTORS. Staff does not know how to monitor or manage complex systems in a way that supports effective management decision or control. Malicious actors manipulate the system to appear as if functioning normally, when it is not. People fail to review event logs. People make unauthorized changes to event logger."
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.
+This control is not part of the NIST high baseline and was added for FedRAMP.
+Rationale for Selection L3-6: In support of cyber security threat / incident response activities. Supports flexibility in auditing levels based on threat level. Supports CSP integration with DoD security architecture. The sensitivity of the information at levels 3-6 warrents the adjustment of auditing levels based on threat level.
+ECSB Supplemental Guidance as the C/CE relates to CSPs: This CE supports cyber security threat / incident response activities and flexibility in auditing levels based on threat level. This CE also supports CSP integration with DoD security architecture and the ability to respond to USCYBERCOM and DoD CNDSP alerts and directives.
+NOTE L1/2: The handling of alerts from US-CERT and other credible sources is sufficient to change auditing activities if this CE is tailored in via an SLA.
+NOTE: L3-6: The handling of alerts and directives from USCYBERCOM and DoD CNDSPs is required at these levels in addition to handling of alerts from US-CERTand other credible sources.
+Priority for adding to FedRAMP-M: High
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.
+Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.
+Guidance: Synchronization of system clocks improves the accuracy of log analysis.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Non-repudiation
+Non-repudiation
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: For JAB Authorization, must use an accredited 3PAO.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: To include 'announced', 'vulnerability scanning'
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Guidance: Refer to Appendix H - Cloud Considerations of the TIC 2.0 Reference Architecture document.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: For JAB Authorization, CSPs shall include details of this control in their Architecture Briefing
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Requirement: POA&Ms must be provided at least monthly.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(c) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: Operating System Scans: at least monthly Database and Web Application Scans: at least monthly All scans performed by Independent Assessor: at least annually
+Guidance: CSPs must provide evidence of closure and remediation of high vulnerabilities within the timeframe for standard POA&M updates.
+Operating System Scans: at least monthly
+Database and Web Application Scans: at least monthly
+All scans performed by Independent Assessor: at least annually
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. Organization requires independent data to validate that current security monitoring continues to target the right data, and that no gaps have opened between what is currently measured and what needs to be measured given the constantly evolving threat environment. In particular, the organization determines that security management will need trend analytics tuned to the current security climate to ensure the organization's security officials maintain general situational awareness of larger security trends that may pose a threat to the organization's high-impact systems fielded in shared-service environments.
+ANALYSIS. Implementation of this control should provide security management with a technical advantage by forcing them to maintain continual current awareness of the larger security threat-scape, rather than become lost in the lower-level details of specific security metrics.
+SAMPLE THREAT VECTORS ADDRESSED. Stakeholders do not have the information they need to make sound decisions due to technology capability. System fails to send alarms, logs, and other pertinent data to the event manager. Control processes involve too many layers of review, concurrence, and revision to support effective and timely conveyance of relevant information to decision-makers. Monitoring not effectively linked to control processes.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored, Controlled
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, page F-7.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the JAB/AO.
+(e) Guidance: In accordance with record retention policies and procedures.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Rationale for De-Selection L1/2: The sensitivity of the information at these levels may not require a information security representative to be a member of the organization-defined configuration change control element.
+Rationale for Selection L3-6: This is a best business practice for the protection of the CSP and customer alike in that the security representative will be more aware of IA issues that configuration changes can introduce and he/she can more easily provide IA guidance for issues spotted.
+Rationale for SA L1: Cryptographic mechanisms are only required at this level for priviledged user (system administrator / SA) access control and the transport of privileged commands or configuration files. Not the publicly released information served at this level.
+Rationale for Selection L2-6: Best practice. Supplemental guidance for this CE refers primarily to the processes surrounding the management of the cryptographic mechanisms used. These processes need to be under change management that addresses security concerns to ensure they remain secure.
+CE supplemental guidance.
+Regardless of the cryptographic means employed (e.g., public key, private key, shared secrets), organizations ensure that there are processes and procedures in place to effectively manage those means. For example, if devices use certificates as a basis for identification and authentication, there needs to be a process in place to address the expiration of those certificates.
+Priority for adding to FedRAMP-M: High
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be utilized.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a)-1 Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available.
+(a)-2 Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).
+(a) Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(b) Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available.
+Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+(Partially derived from AC-17(8).
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e. white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: must be provided at least monthly or when there is a change.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. High-impact systems will require special measures to ensure users cannot place the overall system at risk by installing unauthorized software. This control supports that need.
+ANALYSIS. Implementation of these controls is well understood, and relies on capabilities provided in COTS operating systems.
+SAMPLE THREAT VECTORS. The system executes malicious and harmful software. Software updates could render the system unstable or cause it to function incorrectly. Software is not designed with adequate safeguards to protect PII and other sensitive information. Users could make mistakes in following policy. Users could intentionally install unapproved/unvetted software.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Quality Assured, Substantiated Integrity, Maintainable, Testable, Configuration Managed, Change Managed, Supported, Assessed, Auditable, Authorized, Regulated, Enforcement, Controlled, Reliable, Providing Good Data Stewardship, Assured, Confidential, Access-Controlled
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by the JAB/AO prior to initiating testing.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites will be less relevant.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.
+(a) Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.
+(b) Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.
+(c) Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: PIV=separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(e) Requirement: The service provider defines the time period of inactivity for device identifiers.
+Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: Authenticators must be compliant with NIST SP 800-63-2 Electronic Authentication Guideline assurance Level 4 (Link http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf)
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Guidance: If automated mechanisms which enforce password authenticator strength at creation are not used, automated mechanisms must be used to audit strength of created password authenticators.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+NEED. In those cases where an organization's user accounts authenticate to more than one system, and at least one of those systems is a high-impact system implemented in a shared-service environment, then this control is warranted as a baseline capability to guard against loss of high-impact, sensitive information.
+ANALYSIS. Organizations can use COTS tools and techniques to implement this control in many ways. Agencies should be prepared to document their plan and approach to this control technique.
+THREAT VECTORS ADDRESSED. A user's account password is cracked, permitting attackers to identify all systems to which the user has access, and to gain access to the information in those systems.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored, Assessed
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Rationale for Selection: Best practice for authenticated web services and best business practice for the protection of the CSP and customer alike. ECSB sees this as a significant value add toward the protection of customer accounts on SaaS or customer service / managent interfaces/portals.
+L1 Rationale for SA: No authenticators are required for user access to public informationl. Info sensitivity does not warrant. However this CE would be required priviledged user access to manage the system server(s) containing public information.
+ECSB Supplemental Guidance as the C/CE relates to CSPs: CSP must minimally implement this control enhancement on all SaaS offerings and customer service / managent interfaces. The time period can be negotiated in the SLA.
+NOTE: while the browser or other client cashes the authenticator, the server must enforce its expiration if the client does not.
+Priority for adding to FedRAMP-M: Low
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+-2 Requirement: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). For JAB authorization, the service provider provides test plans to the JAB/AO annually. Test plans are approved and accepted by the JAB/AO prior to test commencing.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. Organization requires near real-time subsystem reconfiguration for high-impact systems, especially those deployed wholly or partially into shared-service environments. This dynamic reconfiguration is required for core infrastructure components such as routers, firewalls, messaging gateways, or access control/authentication servers, especially when these core components are under cyber-attack.
+ANALYSIS. These critical cyber controls are well understood, and to some extent their automated capability has been established. Other aspects still require human decisions. Since this technology area is rapidly changing to meet new cyber-threat scenarios, it is expected that implementation of this control will be subject to significant change for the foreseeable future. Even so, its technology advantages are clear, especially for high-impact systems infrastructure.
+SAMPLE THREAT VECTORS. System does not have error-correcting or self-recovery capabilities. The system is not designed to allow for quick remediation of threats that will impact the system.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Survivable, Absorptive, Adaptive, Restorable
+NEED. Due to the direct connection between system function and critical mission/business capability, the system requires Continuity-of-Operations (COOP) controls.
+ANALYSIS. These critical cyber controls are well understood, and to some extent their automated capability has been established. Other aspects still require human decisions. Since this technology area is rapidly changing to meet new cyber-threat scenarios and also changes in subsystem technology, it is expected that implementation of this control will be subject to significant change for the foreseeable future. Even so, its technology advantages are fundamental, especially for high-impact systems infrastructure.
+SAMPLE THREAT VECTORS. The system does not have error-correcting or self-recovery capabilities. The system is not designed to allow for quick remediation of threats that will impact the system. Time does not allow for the design in error handling, self-recovery, or to capitalize on system diversity to restore a system. Also, the organization lacks the expertise to develop or implement a plan for restoring system. A malicious change may be implemented to counter the ability to restore the system.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Survivable, Absorptive, Adaptable, Restorable
+Included in NIST High Baseline, Rev 4
+NEED. High-impact systems will require special measures to ensure security incidents are correctly and effectively handled in a timely manner. This high-level control supports that need, and is therefore warranted as a baseline for high-impact systems in shared-service environments.
+ANALYSIS. Implementation of this general control is well understood among Departments and Agencies. However, it may require special funding and time to implement in a shared service environment, where response roles and responsibilities demand vigilant analysis and definition.
+SAMPLE THREAT VECTORS. Insiders gain access to information for which they have no authorization. Insiders push sensitive information to outside networks not authorized to receive it. Insiders violate agency information-security policies. Insider actions are not monitored.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Agile, Owned, Enforcement
+This control was recommended ecommended by the High Baseline Tiger Team.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: Reports security incident information according to FedRAMP Incident Communications Procedure.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(b) Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+(e) Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Rationale for Selection: Best practice business practice for the protection of the CSP and customer alike. Protects against unauthorized access and compromise of the CSP infrastructure. See Supplemental Guidance
+ECSB Supplemental Guidance as the C/CE relates to CSPs: While AC-17(2) is similar to this CE and implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions, System configuration, maintenance and diagnostic communications can be considered sensitive information and it is in DoD. Maintaining the confidrntiality and integrity of nonlocal maintenance and diagnostic communications helps maintain the health of the system, prevents unauthorized access from sniffing and MITM atacks, etc. While beneficial this selection may not be required for nonlocal maintenance and diagnostic communications over the CSP's private network and particularly if that network is out of band. Encryption is required if such communications are over a network external to the CSP (e.g., the Internet).
+Priority for adding to FedRAMP-M: High
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(b) Guidance: Second parameter not-applicable
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirement: The service provider defines controlled areas within facilities where the information and information system reside.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirement: The service provider defines security measures to protect digital and non-digital media in transport. The security measures are approved and accepted by the JAB.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Equipment and procedures may be tested or validated for effectiveness
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(b) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, page F-7.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.
+(d) Requirement: Include all Authoring Officials and FedRAMP ISSOs.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(a) Requirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.
+(e) Requirement: to include the Risk Executive; for JAB authorizations to include FedRAMP
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Guidance: include in Continuous Monitoring ISSO digest/report to JAB/AO
+Included in FedRAMP Moderate Baseline, Rev 4
+Requirements: This enhancement is required for all high vulnerability scan findings.
+Guidance: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.
+NEED. Organizations commonly run vulnerability scanning tools against diverse enterprise systems and subsystems. These tools are often attuned to the specific subsystems, and often provided by different manufacturers. Because there is no single-vendor consolidation of all scanning tools, organizations need to correlate the outputs of these tools in order to triangulate on potential threats that may be related, or identical at their source. When the security impact is high a shared-service environment may increase the number of independent scanning tools, implementation of this control is warranted.
+ANALYSIS. Although this control is well understood by vendors, its implementation takes many forms, depending on the scanning tools adopted by a particular organization.
+SAMPLE THREAT VECTORS. Different scanning tools discover low-impact vulnerabilities in multiple subsystems of a system. Considered individually, none of them warrants immediate action,; yet when considered together, they constitute a significant attack pattern.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Interoperable, Change Managed, Agile, Supported, Assessed, Monitored
+Guidance: If multiple tools are not used, this control is not applicable.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred.
+See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+(e) Requirement: for JAB authorizations, track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. High-impact systems warrant careful attention to scenarios associated with exfiltration of sensitive organizational information. Different systems and implementation will trigger different scenarios, but regardless of the specific system context, organizations are warranted in establishing this control for high-impact systems with subsystems deployed into shared-service environments.
+ANALYSIS. Organizations should devote careful attention to design considerations relative to this control.
+SAMPLE THREAT VECTORS. Authorized processes push very large volumes of data to external networks. Internal devices send address/status/security information to external networks.
+RELEVANT SECURITY CONTROL ATTRIBUTES: Integrity-Assured, Absorptive, Survivable, Adaptive, Agile, Auditable, Monitored, Controlled, Data Controllable, Access-Controlled
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.
+Guidance: Examples include: information security tools, mechanisms, and support components such as, but not limited to PKI, patching infrastructure, cyber defense tools, special purpose gateway, vulnerability tracking systems, internet access points (IAPs); network element and data center administrative/management traffic; Demilitarized Zones (DMZs), Server farms/computing centers, centralized audit log servers etc.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+NEED. High-impact systems warrant careful attention to situations where specific sources or methods become suspect. Such situations can involve specific user accounts, messages, message payloads, data, applications, or even entire subsystems. Under these circumstances, a capability for dynamic segregation is highly justified.
+ANALYSIS. Isolation techniques are well understood in the cyber market, and constantly evolving. Example techniques include honey pots and honey nets. Both techniques can isolate a user, an autonomous application, or an entire subsystem.
+SAMPLE THREAT VECTORS. Anomalous user behavior is detected Messages arrive from suspect domains. Messages arrive with suspect attachments. Applications begin to behave anomalously. Subsystems begin moving data anomalously.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Integrity-Assured, Absorptive, Survivable, Adaptive, Agile, Auditable, Monitored, Controlled, Data Controllable, Access-Controlled
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: Federally approved cryptography
+Included in NIST High Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Rationale for Selection: Rationale for Selection for SA L1: At L1 this CE is only applicable to privileged user sessions.
+Rationale for Selection L1-6: Best Practice; APT. This CE mitigates the threat/vulnerability inherant in authenticated sessions whereby If an adversary captures a session identifier that remains valid after the session is terminated, the adversary could use it to reinitiate the session thus gaining unauthorized access to CSP and CSP customer resources and information/data.
+ECSB Supplemental Guidance as the C/CE relates to CSPs: If an adversary captures a session identifier that remains valid after the session is terminated, the adversary could use it to reinitiate the session thus gaining unauthorized access to CSP and/or CSP customer resources and information/data. While unnessary for user sessions at L1, this enhancement is selected for System Administrator sessions.
+Priority for adding to FedRAMP-M: High
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: See US-CERT Incident Response Reporting Guidelines.
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Guidance: In accordance with the incident response plan.
+NEED. When a high-impact system is implemented in a shared-service environment, organizations should ensure their sensitive data is properly protected against classic threats to the confidentiality of its sensitive information. This control partially meets that need.
+ANALYSIS. The tools and techniques for implementing this monitoring control are now well understood and embedded in COTS operating systems and software.
+SAMPLE THREAT VECTORS. Large outbound file transfers execute without being detected. External malware network sites are accessed from within the organization without detection. Network sessions remain connected for long periods of time without detection. Esoteric protocols are active and undetected on ports not defined by the organization.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored
+Included in FedRAMP Moderate Baseline, Rev 4
+Included in FedRAMP Moderate Baseline, Rev 4
+NEED. When a high-impact system is implemented in a shared-service environment, organizations should ensure their sensitive data is properly protected against classic threats to the confidentiality of sensitive information. This control partially meets that need.
+ANALYSIS. The tools and techniques for implementing this monitoring control are now well understood, and embedded in COTS operating systems and software.
+SAMPLE THREAT VECTORS. Large outbound files are disguised to transfer without being detected. Communications with external malware network sites are embedded to avoid detection.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Substantiated Integrity, Monitored, Assessed
+Rationale for De-Selection L1-3: The information sensitivity at these levels does not seem to warrant implementation of this CE. The costs for instituting fine-grained monitoring per individual far may outweigh the risks
+Rationale for selection L4-6: SP Insider Threat mitigation; The information sensitivity at these levels warrants implementation of this CE.Best business practice for the protection of the CSP and customer alike. This enhancement works in conjunction with AC-2 (13) account disablement for such individuals and IR-4 (6).
+ECSB Supplemental Guidance as the C/CE relates to CSPs: This enhancement works in conjunction with or opposite of AC-2 (13) which requires acount disablement within a specific time frame of discovering or identifying an individual posing a significant insider threat. In some instances the best action is not to terminate the individual's account, but rather to monitor their actions. This allows for the ability to collect evidence (for prosecution) and obtain insight into the TTPs that they may be using and others they may working with. Termination of the account is often best left as a final act.
+Priority for adding to FedRAMP-M: Moderate
+Rationale for Selection: Best business practice for the protection of the CSP and customer alike. Given the scale of a cloud, the possible harm by an malicious insider is greatly magnified over normal systems.
+ECSB Supplemental Guidance as the C/CE relates to CSPs: his CE is on a par with SI-4 (9), IR-4 (6) and the various other insider threat Cs/CEs. Supports the mitigation of insider threat from those that can do the most damage. While CSPs typically claim they only have privileged users in their infrastructure (other than customers), this CEadds value for privilege users that have higher privilege than others. These higher privileged users should be subject to additional monitoring.
+Priority for adding to FedRAMP-M: High
+NEED. When a high-impact system is implemented across networks in a shared-service environment, organizations should monitor network services to protect against unauthorized services capable of exfiltrating sensitive information. This control meets that monitoring need.
+ANALYSIS. The tools and techniques for implementing this monitoring control are well understood, and embedded in COTS operating systems and software.
+SAMPLE THREAT VECTORS. Systems daemons and application services running in the background, exfiltrating sensitive information to external networks.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored, Assessed
+Included in FedRAMP Moderate Baseline, Rev 4
+NEED. When a high-impact system is implemented across networks in a shared-service environment, organizations should aggressively monitor for symptoms that system integrity has been compromised. This control addresses that monitoring need.
+ANALYSIS. The tools and techniques for implementing this monitoring control are no longer unusual, but their implementation still requires careful initial analysis of tools, standards, and sources for indicators of compromise (IOC) data. This capability is not a simple matter of installing COTS software and watching for alerts. Rather, it requires staff to maintain a keen understanding of the threat-scape in order to properly understand the alerts coming from the IOC subsystem.
+SAMPLE THREAT VECTORS. Temporary files appear but are not associated with any known system processes; independent security services warn of new surveillance techniques appearing globally; evidence of those new techniques appears in an organization's event logs. Reports on the payload of a new botnet indicate that the system has been touched by the botnet.
+RELEVANT SECURITY CONTROL ATTRIBUTES. Monitored, Assessed
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Included in NIST High Baseline, Rev 4 and FedRAMP Moderate Baseline, Rev 4
+Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB.
+Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB.
+Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. AC-8 Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB.
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tennant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.
+Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements.
+Requirement: Must use an accredited 3PAO for JAB authorization
+Guidance: Requirement: POA&Ms must be provided at least monthly.
+-c. Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
+Requirement: Operating System Scans: at least monthly Database and Web Application Scans: at least monthly All scans performed by Independent Assessor: at least annually
+Guidance: CSPs must provide evidence of closure and remediation of high vulnerabilities within the timeframe for standard POA&M updates.
+Operating System Scans: at least monthly
+Database and Web Application Scans: at least monthly
+All scans performed by Independent Assessor: at least annually
+(a) Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available.
+(a) Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).
+(a) Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+(b) Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available.
+Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+(Partially derived from AC-17(8).)
+Requirement: must be provided at least monthly or when there is a change.
+Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.
+(a). Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by the JAB/AO prior to initiating testing.
+Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.
+(a) Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.
+(b) Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.
+(c) Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.
+Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.
+(e) Requirement: The service provider defines time period of inactivity for device identifiers.
+Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.
+Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.
+Requirement: Reports security incident information according to FedRAMP Incident Communications Procedure.
+(b) Additional FedRAMP Requirements and Guidance: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+(e) Additional FedRAMP Requirements and Guidance: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+(a). Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
+Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.
+(a) Requirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.
+(e) Requirement: to include the Risk Executive; for JAB authorizations to include FedRAMP
+Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred.
+See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.
+Guidance: Federally approved cryptography
+Additional FedRAMP Requirements and Guidance:
+Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.
+Guidance: See US-CERT Incident Response Reporting Guidelines.
+Guidance: should use a shorter timeframe than AC-12.
+Required if shared/group accounts are deployed
+Required if shared/group accounts are deployed
+(a) Guidance: Required for privileged accounts.
+(b) Guidance: Required for privileged accounts.
+Additional FedRAMP Requirements and Guidance:
+Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP.
+Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.
+Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB.
+Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB.
+Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. AC-8 Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB.
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO.
+Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB.
+Requirement: The service provider defines audit record types. The audit record types are approved and accepted by the JAB/AO. Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.
+Requirement: Coordination between service provider and consumer shall be documented and accepted by the JAB/AO. In multi-tennant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.
+Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.
+Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.
+Guidance: Synchronization of system clocks improves the accuracy of log analysis.
+Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements.
+Requirement: Must use an accredited 3PAO for JAB authorization
+Requirement: To include 'announced', 'vulnerability scanning'
+Guidance: Refer to Appendix H - Cloud Considerations of the TIC 2.0 Reference Architecture document.
+For JAB Authorization, CSPs shall include details of this control in their Architecture Briefing
+Guidance: Requirement: POA&Ms must be provided at least monthly.
+-c. Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
+Requirement: Operating System Scans: at least monthly Database and Web Application Scans: at least monthly All scans performed by Independent Assessor: at least annually
+Guidance: CSPs must provide evidence of closure and remediation of high vulnerabilities within the timeframe for standard POA&M updates.
+Operating System Scans: at least monthly
+Database and Web Application Scans: at least monthly
+All scans performed by Independent Assessor: at least annually
+Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the JAB/AO.
+-e Guidance: In accordance with record retention policies and procedures.
+Guidance: If digital signatures/certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be utilized.
+(a) Requirement 1: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available.
+(a) Requirement 2: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).
+(a) Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+(b) Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available.
+Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc
+(Partially derived from AC-17(8).)
+Guidance: This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e. white listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run.
+Requirement: must be provided at least monthly or when there is a change.
+Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel.
+(a). Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by the JAB/AO prior to initiating testing.
+(a). Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
+Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites will be less relevant.
+Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.
+Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.
+(a) Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.
+(b) Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.
+(c) Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.
+Guidance: PIV=separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials.
+Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.
+(e) Requirement: The service provider defines time period of inactivity for device identifiers.
+Guidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP http://iase.disa.mil/cloud_security/Pages/index.aspx.
+Additional FedRAMP Requirements and Guidance: Guidance: If automated mechanisms which enforce password authenticator strength at creation are not used, automated mechanisms must be used to audit strength of created password authenticators.
+-2 Requirement 1: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended).
+-2 Requirement 2: For JAB Authorization, the service provider provides test plans to the JAB/AO annually.
+-2 Requirement 3: Test plans are approved and accepted by the Authorizing Official (AO) prior to test commencing.
+Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.
+Requirement: Reports security incident information according to FedRAMP Incident Communications Procedure.
+(b) Additional FedRAMP Requirements and Guidance: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+(e) Additional FedRAMP Requirements and Guidance: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.
+Requirement: Only MA-5 (1)(a)(1) is required by FedRAMP Moderate Baseline
+(b) Guidance: Second parameter not-applicable
+(a) Additional FedRAMP Requirements and Guidance: Requirement: The service provider defines controlled areas within facilities where the information and information system reside.
+(a) Additional FedRAMP Requirements and Guidance:
+Requirement: The service provider defines security measures to protect digital and non-digital media in transport. The security measures are approved and accepted by the JAB.
+Guidance: Equipment and procedures may be tested or validated for effectiveness
+(a). Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.
+(b) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F, page F-7.
+Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.
+(d) Requirement: Include all Authoring Officials and FedRAMP ISSOs.
+(a) Requirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.
+(e) Requirement: to include the Risk Executive; for JAB authorizations to include FedRAMP
+Guidance: include in Continuous Monitoring ISSO digest/report to JAB/AO
+Requirements: This enhancement is required for all high vulnerability scan findings. Guidance: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.
+Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred.
+See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.
+Guidance: CSP must use the same security standards regardless of where the system component or information system service is acquired.
+(e) Requirement: for JAB authorizations, track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP.
+Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.
+Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.
+Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.
+Guidance: Federally approved cryptography
+Additional FedRAMP Requirements and Guidance:
+Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.
+Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest.
+Guidance: See US-CERT Incident Response Reporting Guidelines.
+Guidance: In accordance with the incident response plan.
+