Attachment J-18_ FedRAMP Security Controls Baseline Tailoring.xlsx

GSA ETSNext FedRAMP Baseline Ta

2) Standardize roles and permissions across agencies to limit the possibility of accidental over-provisioning of permissions

Role-based privileges should emphasize "need to know" principle. Identify specific user roles/functions and limit access to information needed for the role, in particular PII (e.g. traveler name, email address, address, contact info, travel document info). There shouldn't be a single privileged user role that can access all data within the system.

Refer to IA-8 enhancement below for roles related to invitational travelers.

1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and

2. When required by system changes or following [Assignment: organization-defined events];

b. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques];

c. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and

a. What type of event occurred;

b. When the event occurred;

c. Where the event occurred;

d. Source of the event;

e. Outcome of the event; and

Per FedRAMP, M-21-31 does not apply directly to CSP offerings (unless that CSP is a government system that is developed for or behalf of the government); however, FedRAMP authorized CSOs must comply with M-21-31 by supporting agency implementations within the cloud offering. These requirements are reflected in the FedRAMP Rev. 5 baselines (Related controls are AC-4 (4), AU-11, and SI-4 (10)).

AUDIT AND ACCOUNTABILITY AU-10 Non-repudiation Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation]. Types of individual actions covered by non-repudiation include creating information, sending and receiving messages, and approving information. Non-repudiation protects against claims by authors of not having authored certain documents, senders of not having transmitted messages, receivers of not having received messages, and signatories of not having signed documents. Non-repudiation services can be used to determine if information originated from an individual or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request, or receiving specific information). Organizations obtain non-repudiation services by employing various techniques or mechanisms, including digital signatures and digital message receipts. AU-10 [minimum actions including the addition, modification, deletion, approval, sending, or receiving of data] New Added Control Capture log data to correlate user/process activity to user/process identity where possible.

Further, per FedRAMP, M-21-31 does not apply directly to CSP offerings (unless that CSP is a government system that is developed for or behalf of the government); however, FedRAMP authorized CSOs must comply with M-21-31 by supporting agency implementations within the cloud offering. These requirements are reflected in the FedRAMP Rev. 5 baselines (Related controls are AC-4 (4), AU-11, and SI-4 (10)).

CONFIGURATION MANAGEMENT CM-8 System Component Inventory a. Develop and document an inventory of system components that:

1. Accurately reflects the system;

2. Includes all components within the system;

3. Does not include duplicate accounting of components or components assigned to any other system;

4. Is at the level of granularity deemed necessary for tracking and reporting; and

5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]; and

IA-2 (1) Requirement: Multi-factor authentication must be phishing-resistant.

IA-2 (2) Requirement: Multi-factor authentication must be phishing-resistant.

Vendor wil prepare and submit a C-SCRM Plan that adheres to GSA C-SCRM guidelines. Vendor will integrate with GSA Vendor Risk Assessment Program (VRAP) for third party vendor monitoring for all downstream service providers/vendors (e.g. Interos and BitSight).

RISK ASSESSMENT RA-5 Vulnerability Monitoring and Scanning a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;

b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:

1. Enumerating platforms, software flaws, and improper configurations;

2. Formatting checklists and test procedures; and

3. Measuring vulnerability impact;

c. Analyze vulnerability scan reports and results from vulnerability monitoring;

d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;

e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and

f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned. Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers.

Vulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).

Vulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation.

https://www.FedRAMP.gov/documents/ RA-5 (a) Requirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.

RA-5 (d) Requirement: If a vulnerability is listed among the CISA Known Exploited Vulnerability (KEV) Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) the KEV remediation date supersedes the FedRAMP parameter requirement.

RA-5 (e) Requirement: to include all Authorizing Officials; for JAB authorizations to include FedRAMP

RA-5 Guidance: Informational findings from a scanner are detailed as a returned result that holds no vulnerability risk or severity and for FedRAMP does not require an entry onto the POA&M or entry onto the RET during any assessment phase.

Warning findings, on the other hand, are given a risk rating (low, moderate, high or critical) by the scanning solution and should be treated like any other finding with a risk or severity rating for tracking purposes onto either the POA&M or RET depending on when the findings originated (during assessments or during monthly continuous monitoring). If a warning is received during scanning, but further validation turns up no actual issue then this item should be categorized as a false positive. If this situation presents itself during an assessment phase (initial assessment, annual assessment or any SCR), follow guidance on how to report false positives in the Security Assessment Report (SAR). If this situation happens during monthly continuous monitoring, a deviation request will need to be submitted per the FedRAMP Vulnerability Deviation Request Form.

Warnings are commonly associated with scanning solutions that also perform compliance scans, and if the scanner reports a “warning” as part of the compliance scanning of a CSO, follow guidance surrounding the tracking of compliance findings during either the assessment phases (initial assessment, annual assessment or any SCR) or monthly continuous monitoring as it applies. Guidance on compliance scan findings can be found by searching on “Tracking of Compliance Scans” in FAQs.

Tailoring Includes all components within the system including production, test, development, jump boxes/bastion hosts, network equipment, user machines/VDIs with direct connection to system components, and internal/external integrations (refer to Section 11 - System Interconnections of FedRAMP Moderate SSP template).

For external integrations, vendor must clearly identify endpoints they are unable scan.

Must comply with BOD 22-01.

If Static code analysis cannot be performed (for example, when the source code is not available), then dynamic code analysis must be performed (see SA-11 (8))

Tailoring Ensure deployed applications developed as part of the system are scanned/tested (dynamic application security testing) for security vulnerabilities.

Ensure mobile applications developed to interact with the system are incorporated into the FedRAMP system boundary and the deployed software application is scanned/tested (dynamic application security testing) for security vulnerabilities along with other software developed for the system.

Ensure mobile applications developed to interact with the system are incorporated into the FedRAMP system boundary and software source code is scanned/tested (static code analysis) for security vulnerabilities along with other software developed for the system. Mobile application shall store sensitive data on the mobile device in a manner that is not accessible to other applications on the mobile device or other external entities.

SYSTEM AND SERVICES ACQUISITION SA-11 (2) Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:

(a) Uses the following contextual information: [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels];

(b) Employs the following tools and methods: [Assignment: organization-defined tools and methods];

(c) Conducts the modeling and analyses at the following level of rigor: [Assignment: organization-defined breadth and depth of modeling and analyses]; and

Implement a Content Delivery Network (CDN) in front of the web application(s).

Use a highly globally scaled DNS provider to thwart and absorb DNS DDoS attacks.

Ensure the application and database architecture automatically scales and/or includes redundancy to ensure the availability of the system during a DoS attack.

Limit access to administrative APIs and ports to specific IPs or networks. Protect network management interfaces from general internal or external network without additional administrative checks. There should be no direct, broad-based access (i.e. must go through a hot point, known system).

SYSTEM AND COMMUNICATIONS PROTECTION SC-12 Cryptographic Key Establishment and Management Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. NIST CMVP and NIST CAVP provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment. SC-12 [In accordance with Federal requirements] SC-12 Guidance: See references in NIST 800-53 documentation.

SC-12 Guidance: Must meet applicable Federal Cryptographic Requirements. See References Section of control.

Organizations should select a mode of protection that is targeted towards the relevant threat scenarios.

Examples:

A. Organizations may apply full disk encryption (FDE) to a mobile device where the primary threat is loss of the device while storage is locked.

B. For a database application housing data for a single customer, encryption at the file system level would often provide more protection than FDE against the more likely threat of an intruder on the operating system accessing the storage.

C. For a database application housing data for multiple customers, encryption with unique keys for each customer at the database record level may be more appropriate.

b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;

c. Configure malicious code protection mechanisms to:

1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and

2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action]]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and

d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system. System entry and exit points include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can also be encoded in various formats contained within compressed or hidden files or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways, including by electronic mail, the world-wide web, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities. A variety of technologies and methods exist to limit or eliminate the effects of malicious code.

Malicious code protection mechanisms include both signature- and nonsignature-based technologies. Nonsignature-based detection mechanisms include artificial intelligence techniques that use heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Nonsignature-based mechanisms also include reputation-based technologies. In addition to the above technologies, pervasive configuration management, comprehensive software integrity controls, and anti-exploitation software may be effective in preventing the execution of unauthorized code. Malicious code may be present in commercial off-the-shelf software as well as custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions.

In situations where malicious code cannot be detected by detection methods or technologies, organizations rely on other types of controls, including secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to ensure that software does not perform functions other than the functions intended. Organizations may determine that, in response to the detection of malicious code, different actions may be warranted. For example, organizations can define actions in response to malicious code detection during periodic scans, the detection of malicious downloads, or the detection of maliciousness when attempting to open or execute files. SI-3 (a) [signature based and non-signature based] SI-3 (c) (1)-1 [at least weekly] SI-3 (c) (1)-2 [to include endpoints and network entry and exit points] SI-3 (c) (2)-1 [to include blocking and quarantining malicious code] SI-3 (c) (2)-2 [administrator or defined security personnel near-real time] Tailoring Employ end-point detection and response (EDR) solution for all system components where it is technologically feasible to implement.

Includes all components within the system including production, test, development, jump boxes/bastion hosts, user machines/VDIs with direct connection to system components, and internal/external integrations (refer to Section 11 - System Interconnections of FedRAMP Moderate SSP template).

SYSTEM AND INFORMATION INTEGRITY SI-4 System Monitoring a. Monitor the system to detect:

1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]; and

2. Unauthorized local, network, and remote connections;

b. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods];

c. Invoke internal monitoring capabilities or deploy monitoring devices:

1. Strategically within the system to collect organization-determined essential information; and

2. At ad hoc locations within the system to track specific types of transactions of interest to the organization;

d. Analyze detected events and anomalies;

e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation;

f. Obtain legal opinion regarding system monitoring activities; and