The file's text, extracted by GovTribe without its formatting.
Software
New or Additional Software
| Line | Location | Product | Use Restriction | Support Level |
| 1 | PROD:GovCloud | S3F-S-CSPSG-MT: Infor CloudSuite Public Sector Financials & Supply Management - SaaS MT - Regulated Industries | 1000 EM | CXTE |
| 2 | PROD:GovCloud | S3S-S-MSC-MT: Mobile Supply Chain Management - FSM - SaaS MT | 1000 EM | CCFS |
| 3 | PROD:GovCloud | S3S-S-RCLMG-MT: Item Lifecycle Management - FSM - SaaS MT - Regulated Industries | 1000 EM | CCFS |
| 4 | PROD:GovCloud | S3F-S-SRMG-MT: Strategic Sourcing/Supplier Portal - FSM - SaaS MT - Regulated Industries | 1000 EM | CCFS |
| 5 | PROD:GovCloud | TAM-S-HCM-LTD-USE-MT: Infor HR Talent Limited Use for CS FSM - SaaS MT | 1 ET | CCFS |
| 6 | PROD:GovCloud | BBI-S-DENT-PLS-ENH: Infor Birst Enterprise Platform Enhanced | 1 BBIENH | CCFS |
| 7 | PROD:GovCloud | BBI-S-DEPLOY-USW: Birst Cloud Deployment Site - US West | 1 DA | CCFS |
| 8 | PROD:GovCloud | ION-S-ESSENTLS-CEG: Infor OS Essentials - SaaS MT - Regulated Industries | 1 TECH | CXTE |
| 9 | PROD:GovCloud | ION-S-STORAGE: Cloud Suite data processing volume | 2000 1.0GB | NAX |
| 10 | PROD:GovCloud | EDU-S-NOP-CPM: Infor Campus Plus Membership - All Campus Plus Content | 1 ET | CXTE |
Exhibit A Infor Government Solutions Customer Responsibility Matrix for Data Subject to FedRAMP “Low” or “Moderate” Controls
| Ref # |
| Customer Responsibility |
| Controls Reference |
| 1 |
| As Infor relies upon Customer’s Identity Provider (IdP), it’s the Customer’s responsibility to identify and select the "boot strap" admin needed to account management of the tenant. Customer or the privileged user for Customer will establish conditions and role membership for the tenant as well as specify any authorized users of the group and role membership, access authorizations/privileges and any other attribute (as required) for each account. Customer is responsible for identifying and determining the personnel and the roles necessary as well as the processes to approve, enable, modify, disable and/or remove user accounts (privileged or non-privileged). Customer is responsible for monitoring the use of their accounts and also for identifying personnel and/or processes in additions to roles that will provide notification to boot strap admins/privileged users when accounts are no longer required, the user is terminated or transferred, or when a usage or need-to-know changes. Customer is responsible for authorizing access to the tenant based on valid access authorization, intended usage, and other attributes as required by Customer or their customer's mission or business needs. Customer is responsible for reviewing the accounts for compliance, annually. Customer is also responsible for establishing a process to reissue shared/group account credentials (if deployed) when individuals are removed from the group. |
| AC-2 |
| 2 |
| Customer has the responsibility to apply the principles of least privilege to the development, implementation and operations as it relates to Customer implementation or configuration settings affecting the Customer’s assets on premise or hosted under the purview of the Customer. Specifically, Customer will only allow authorized access for users (or processes acting on behalf of users) which are critical to accomplish assigned tasks in accordance with Customer or their customer's missions and business functions. |
| AC-6 |
| 3 |
| Customer application access is controlled by SAML tokens and CACs, implemented as part of Customer authentication solutions. It is a Customer responsibility to handle unsuccessful login attempts. |
| AC-07 |
| 4 |
| Application access will use accounts on Customer identity management solutions, auditing successful and unsuccessful logon events and account management events is a Customer responsibility for customer identity management solutions. Infor will audit users accessing the system with SAML tokens and assignment of Infor roles to Customer accounts including addition of roles to an account, changes of roles to an account and removal of roles from an account. Customer is also responsible for all Customer application data, including the people, places, things, business rules, and events in relation to Customer’s business goals/mission. This data is provided to Customer from within the application for their review and analysis. The distinction between Infor Security Related Data and Customer Application Data has been made to clarify what audit information is required. Customer Application Data is not necessary to support after-the-fact investigations of security incidents and will not be captured for this function. Auditable events regarding Customer Application Data will be captured and will be made accessible to customers through the application or by request, if not available through the application. |
| AU-02 |
| 5 |
| Customer’s Authorizing Official will determine risk acceptance for any web calls, PIs or other data flows (ingress/egress) that might impact the confidentiality, integrity and/or availability. Infor is responsible for documenting the data flows and updating the documentation of the security attributes as necessary. |
| CA-3 |
| 6 |
| Customer accounts maintained on customer identity management systems will be used for application access. Infor will accept SAML tokens from Customer Active Directory or LDAP implementations. It is a Customer responsibility to provide access control and multifactor authentication for accounts that reside in customer identity management implementations that provide access to Infor. These users would connect to Infor using HTTPS with TLS sessions utilizing Customer provided credentials including multifactor authentication verified against customer identity management systems. Typically this would include a user ID, password or PIN and a Personal Identity Verification (PIV) card or Common Access Card (CAC). It is also a Customer responsibility to manage additional user types, if they determine they are needed within their SaaS instance. These user types provide limited access for specific functions outside of the general use case. They are implemented, configured, and managed from within the IGS application by a privileged customer user. IGS user types, how they are to be used, the justification for their inclusion, and the mitigating controls are detailed below. IA controls are not applied to customer service accounts. These accounts have limited access through the ION API Gateway to specific functions, based on Customer need. Access to back end systems are not permitted. |
| IA-02 |
| 7 |
| It is a Customer responsibility to provide multifactor authentication as part of their identity management implementation that will be used with Infor. |
| IA-02(1) and IA-02(2) |
| 8 |
| It is a Customer responsibility to provide replay-resistant multifactor authentication as part of their identity management implementation that will be used with Infor. |
| IA-2(8) |
| 9 |
| It is a Customer responsibility to provide multifactor authentication requiring a separate device, such as a PIV card or CAC, as part of their identity management implementation that will be used with Infor. |
| IA-2(11) |
| 10 |
| It is a Customer responsibility to authorize access for their organization’s users of the Infor system before granting access. The application access path includes customer authentication via SAML assertions from customer identity management solutions. It is a Customer responsibility to select identifiers for application access by their users. It is a Customer responsibility to provision and manage the administration of InforOS Service Accounts that are created and enabled from within the Customer interface within the Infor environment. These Service Accounts perform specific actions with limited scope on behalf of the Customer to support Infor applications within its cloud suites. |
| IA-4 |
| 11 |
| Infor utilizes SAML assertions from customer identity management solutions to control access to the system. It is a Customer responsibility to implement all aspects of authenticator management for their users. |
| IA-5 |
| 12 |
| Infor utilizes SAML assertions from customer identity management solutions to control access to the system. It is a Customer responsibility to implement all aspects of authenticator complexity, lifetime, reuse and protection on their identity management systems. |
| IA-5(1) |
| 13 |
| It is a Customer responsibility to distribute PIV Cards or CACs or any other hardware or biometric multifactor authenticators that may be used in the Customer’s authentication solution in person before a Customer registration authority with authorization by Customer account authorizers. |
| IA-5(3) |
| 14 |
| It is a Customer responsibility to define the token quality requirements for hardware token-based authentication for use with their identity management solution. |
| IA-5(11) |
| 15 |
| It is a Customer responsibility to configure customer identity management systems to obscure feedback of all authenticators. |
| IA-6 |
| 16 |
| Customer users authenticate to their own agencies’ identity management solutions and access Infor with a SAML token presented by the customer identity management solution. Customer requirements are detailed throughout the IA controls |
| IA-8 |
| 17 |
| Verification of PIV credentials is a Customer responsibility and will be carried out by customer identity management systems. After successful authentication SAML assertions will be transmitted from the customer identity management systems to INFOR. |
| IA-8(1) |
| 18 |
| All verification of third party credentials will be carried out by customer identity management systems. It is a Customer responsibility to configure their identity management systems to accept only FICAM-approved third-party credentials. |
| IA-8(2) |
| 19 |
| All verification of third party credentials will be carried out by customer identity management systems. It is a Customer responsibility to employ only FICAM-approved information system components in their identity management system to accept third-party credentials. |
| IA-8(3) |
| 20 |
| It is a Customer responsibility to implement identity management systems that conform to FICAM-issued profiles. |
| IA-8(4) |
| 21 |
| Roles within Infor are highly customizable and new roles can be defined by the Customer. It is a Customer responsibility to limit management functionality to appropriate roles and users within their organization. |
| SC-2 |
| 22 |
| It is the responsibility of Customer to install, configure, system harden and conduct routine risk management of any SFTP server from which Infor services will securely transfer files to/from our authorized boundary. Customers are required to setup authentication and provide account management. All traffic traversing the internet must be supported to encrypt end-to-end using an IPSec tunnel and the latest FISMA/FedRAMP encryption standards (i.e - FIPS 140-2 validated module) |
| AU-2, CM-6, RA-5, IA-7, IA-8 |
| 23 |
| Customer has a responsibility to scan for vulnerabilities related to Customer implementation or configuration settings affecting the Customer’s assets on premise or hosted under the purview of the Customer, monthly for OS, dB and web applications; ad-hoc when new vulnerabilities potentially affecting the system/applications are identified and reported; and annually by an American Association for Laboratory Accreditation (A2LA) accredited Third Party Assessment Organization (3PAO) to scan OS, dB and web application. Customer is responsible for employing scanning tools leveraging standards for enumerating platforms, software flaws, and improper configurations formatting checklists and test procedures and measuring vulnerability impact against the Common Vulnerability Scoring System (CVSS). Customer is responsible for the monthly interpretation of the vulnerability scan reports as well as analysis of any security control assessments performed on the Customer’s assets on premise or hosted under the purview of the Customer. Customer is responsible for remediating any legitimate vulnerabilities within 30 days for high CVSS findings, 90 days for moderate CVSS findings, 180 for low CVSS findings from the date of discovery. For Federal customer’s or customer’s supporting Federal customers: it’s their responsibility to share with their Risk Executive, IGS' System Owner, and the FedRAMP JAB information obtained from the annual vulnerability scanning process and security control assessments conducted by the 3PAO and monthly for any overdue high findings to IGS' System Owner and FedRAMP JAB related to customer implementation or configuration settings affecting customer's assets on premise or hosted under the purview of customer. For all other customers, it’s their responsibility to share with their Risk Executive and/or the Risk Executive of their customer as well as IGS' System Owner information obtained from the annual vulnerability scanning process and security control assessments conducted by the 3PAO and monthly for any overdue high findings to IGS' System Owner and FedRAMP JAB related to customer implementation or configuration settings affecting the customer’s assets on premise or hosted under the purview of the customer. |
| RA-5 |
| Customer has a responsibility as part of their configuration management process to identify, report and correct any flaws or vulnerabilities that are a result of Customer implementation and/or configuration settings. Customer also has a responsibility to install security relevant or vendor dependent software and firmware updates within 30 days of the release of the updates. As part of Customer's release process, Customer's responsibilities include testing software and firmware updates related to the flaw remediation or any other security relevant vendor dependencies before production deployment for any system breaks |
| SI-2 |
