System_Security_Plan_Extensible.doc

M-M-M FedRAMP 2.1 System Security Plan 8 April 2019

FedRAMP System Security Plan

DHS

M-M-M FedRAMP 2.1 8 April 2019 [Document classification not provided]

System Security Plan Prepared for Department of Homeland Security Headquarters (DHS HQ) [Component address not provided] Executive Summary This document details the System Security Plan (SSP) for the M-M-M FedRAMP 2.1 security controls. This System Security Plan was written in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-18, Revision 1, Guide for Developing Security Plans for Information Technology Systems. Completion of this SSP, which describes how U.S. federal information will be safeguarded, is a requirement of the Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources, and Public Law 100-235, the Computer Security Act of 1987.

Document Revision History

Table of Contents 23About This Document

Who should use this document?

How this document is organized How to contact us System Security Plan Approvals 1.

Information System Name/Title 2.

Information System Categorization 2.1.

Information Types 2.2.

Security Objectives Categorization (FIPS 199) 3.

Information System Owner 4.

Authorizing Official 5.

Other Designated Contacts 6.

Assignment of Security Responsibility 7.

Information System Operational Status 8.

Information System Type 8.1.

Cloud Service Model 8.2.

Leveraged Provisional Authorizations 9.

General System Description 9.1.

System Function or Purpose 9.2.

Information System Components and Boundaries 9.3.

Types of Users 9.4.

Network Architecture 10.

System Environment 10.1.1.

Hardware Inventory 10.1.2.

Software Inventory 10.1.3.

Network Inventory 10.1.4.

Data Flow 10.1.5.

Ports, Protocols and Services 11.

System Interconnections 12.

Applicable Laws and Regulations 12.1.

Applicable Laws 12.2.

Applicable Standards and Guidance 13.

Minimum Security Controls 13.1.

Access Control (AC)

13.1.1 Access Control Policy and Procedures (AC-1)

13.1.2 Access Control Policy and Procedures (AC-1 (DHS-5.1.1.c))

13.1.3 Account Management (AC-2)

13.1.4 Account Management (AC-2 (1))

13.1.5 Account Management (AC-2 (2))

13.1.6 Account Management (AC-2 (3))

13.1.7 Account Management (AC-2 (4))

13.1.8 Account Management (AC-2 (5))

13.1.9 Account Management (AC-2 (7))

13.1.10 Account Management (AC-2 (9))

13.1.11 Account Management (AC-2 (10))

13.1.12 Account Management (AC-2 (12))

13.1.13 Access Enforcement (AC-3)

13.1.14 Access Enforcement (AC-3 (DHS-5.1.1.d))

13.1.15 Information Flow Enforcement (AC-4)

13.1.16 Information Flow Enforcement (AC-4 (21))

13.1.17 Separation of Duties (AC-5)

13.1.18 Least Privilege (AC-6)

13.1.19 Least Privilege (AC-6 (1))

13.1.20 Least Privilege (AC-6 (2))

13.1.21 Least Privilege (AC-6 (5))

13.1.22 Least Privilege (AC-6 (9))

13.1.23 Least Privilege (AC-6 (10))

13.1.24 Unsuccessful Logon Attempts (AC-7)

13.1.25 System Use Notification (AC-8)

13.1.26 System Use Notification (AC-8 (DHS-4.8.5.d))

13.1.27 Concurrent Session Control (AC-10)

13.1.28 Session Lock (AC-11)

13.1.29 Session Lock (AC-11 (1))

13.1.30 Session Lock (AC-11 (DHS-4.6.2.o))

13.1.31 Session Termination (AC-12)

13.1.32 Permitted Actions without Identification or Authentication (AC-14)

13.1.33 Remote Access (AC-17)

13.1.34 Remote Access (AC-17 (1))

13.1.35 Remote Access (AC-17 (2))

13.1.36 Remote Access (AC-17 (3))

13.1.37 Remote Access (AC-17 (4))

13.1.38 Remote Access (AC-17 (9))

13.1.39 Remote Access (AC-17 (DHS-5.4.1.b))

13.1.40 Remote Access (AC-17 (DHS-5.4.1.c))

13.1.41 Wireless Access (AC-18)

13.1.42 Wireless Access (AC-18 (1))

13.1.43 Wireless Access (AC-18 (DHS-4.8.6.a))

13.1.44 Wireless Access (AC-18 (DHS-4.8.6.b))

13.1.45 Access Control for Mobile Devices (AC-19)

13.1.46 Access Control for Mobile Devices (AC-19 (5))

13.1.47 Use of External Information Systems (AC-20)

13.1.48 Use of External Information Systems (AC-20 (1))

13.1.49 Use of External Information Systems (AC-20 (2))

13.1.50 Information Sharing (AC-21)

13.1.51 Publicly Accessible Content (AC-22)

13.2.

Awareness and Training (AT)

13.2.1 Security Awareness and Training Policy and Procedures (AT-1)

13.2.2 Security Awareness Training (AT-2)

13.2.3 Security Awareness Training (AT-2 (2))

13.2.4 Role-Based Security Training (AT-3)

13.2.5 Security Training Records (AT-4)

13.3.

Audit and Accountability (AU)

13.3.1 Audit and Accountability Policy and Procedures (AU-1)

13.3.2 Audit Events (AU-2)

13.3.3 Audit Events (AU-2 (3))

13.3.4 Content of Audit Records (AU-3)

13.3.5 Content of Audit Records (AU-3 (1))

13.3.6 Content of Audit Records (AU-3 (DHS-5.3.a))

13.3.7 Audit Storage Capacity (AU-4)

13.3.8 Response to Audit Processing Failures (AU-5)

13.3.9 Audit Review, Analysis, and Reporting (AU-6)

13.3.10 Audit Review, Analysis, and Reporting (AU-6 (1))

13.3.11 Audit Review, Analysis, and Reporting (AU-6 (3))

13.3.12 Audit Review, Analysis, and Reporting (AU-6 (DHS-5.3.h))

13.3.13 Audit Review, Analysis, and Reporting (AU-6 (DHS-5.3.i))

13.3.14 Audit Review, Analysis, and Reporting (AU-6 (DHS-5.4.6.f))

13.3.15 Audit Reduction and Report Generation (AU-7)

13.3.16 Audit Reduction and Report Generation (AU-7 (1))

13.3.17 Time Stamps (AU-8)

13.3.18 Time Stamps (AU-8 (1))

13.3.19 Protection of Audit Information (AU-9)

13.3.20 Protection of Audit Information (AU-9 (2))

13.3.21 Protection of Audit Information (AU-9 (4))

13.3.22 Audit Record Retention (AU-11)

13.3.23 Audit Record Retention (AU-11 (DHS-5.3.d))

13.3.24 Audit Generation (AU-12)

13.3.25 Audit Generation (AU-12 (DHS-5.3.g))

13.4.

Security Assessment and Authorization (CA)

13.4.1 Security Assessment and Authorization Policies and Procedures (CA-1)

13.4.2 Security Assessment and Authorization Policies and Procedures (CA-1 (DHS-3.18.c))

13.4.3 Security Assessment and Authorization Policies and Procedures (CA-1 (DHS-3.18.d))

13.4.4 Security Assessment and Authorization Policies and Procedures (CA-1 (DHS-3.18.e))

13.4.5 Security Assessments (CA-2)

13.4.6 Security Assessments (CA-2 (1))

13.4.7 Security Assessments (CA-2 (2))

13.4.8 Security Assessments (CA-2 (3))

13.4.9 Security Assessments (CA-2 (DHS-3.3.h))

13.4.10 Security Assessments (CA-2 (DHS-3.3.i))

13.4.11 Security Assessments (CA-2 (DHS-3.15.h))

13.4.12 Security Assessments (CA-2 (DHS-3.18.b))

13.4.13 System Interconnections (CA-3)

13.4.14 System Interconnections (CA-3 (3))

13.4.15 System Interconnections (CA-3 (5))

13.4.16 System Interconnections (CA-3 (DHS-5.4.3.b))

13.4.17 System Interconnections (CA-3 (DHS-5.4.3.c))

13.4.18 System Interconnections (CA-3 (DHS-5.4.3.f))

13.4.19 System Interconnections (CA-3 (DHS-5.4.3.m))

13.4.20 System Interconnections (CA-3 (DHS-5.4.3.n))

13.4.21 Plan of Action and Milestones (CA-5)

13.4.22 Plan of Action and Milestones (CA-5 (DHS-2.2.8.d))

13.4.23 Security Authorization (CA-6)

13.4.24 Security Authorization (CA-6 (DHS-4.12.d))

13.4.25 Continuous Monitoring (CA-7)

13.4.26 Continuous Monitoring (CA-7 (1))

13.4.27 Continuous Monitoring (CA-7 (DHS-4.6.2.4.a))

13.4.28 Continuous Monitoring (CA-7 (DHS-4.6.3.a))

13.4.29 Penetration Testing (CA-8)

13.4.30 Penetration Testing (CA-8 (1))

13.4.31 Internal System Connections (CA-9)

13.5.

Configuration Management (CM)

13.5.1 Configuration Management Policy and Procedures (CM-1)

13.5.2 Baseline Configuration (CM-2)

13.5.3 Baseline Configuration (CM-2 (1))

13.5.4 Baseline Configuration (CM-2 (2))

13.5.5 Baseline Configuration (CM-2 (3))

13.5.6 Baseline Configuration (CM-2 (7))

13.5.7 Baseline Configuration (CM-2 (DHS-4.12.b))

13.5.8 Configuration Change Control (CM-3)

13.5.9 Configuration Change Control (CM-3 (DHS-2.1.8.g))

13.5.10 Configuration Change Control (CM-3 (DHS-5.4.3.l))

13.5.11 Security Impact Analysis (CM-4)

13.5.12 Access Restrictions for Change (CM-5)

13.5.13 Access Restrictions for Change (CM-5 (1))

13.5.14 Access Restrictions for Change (CM-5 (3))

13.5.15 Access Restrictions for Change (CM-5 (5))

13.5.16 Configuration Settings (CM-6)

13.5.17 Configuration Settings (CM-6 (1))

13.5.18 Configuration Settings (CM-6 (DHS-3.7.e))

13.5.19 Configuration Settings (CM-6 (DHS-3.7.f))

13.5.20 Configuration Settings (CM-6 (DHS-4.5.2.b))

13.5.21 Configuration Settings (CM-6 (DHS-4.8.4.a))

13.5.22 Configuration Settings (CM-6 (DHS-4.12.f))

13.5.23 Configuration Settings (CM-6 (DHS-4.12.j))

13.5.24 Configuration Settings (CM-6 (DHS-5.4.5.d))

13.5.25 Configuration Settings (CM-6 (DHS-5.4.5.e))

13.5.26 Least Functionality (CM-7)

13.5.27 Least Functionality (CM-7 (1))

13.5.28 Least Functionality (CM-7 (2))

13.5.29 Least Functionality (CM-7 (5))

13.5.30 Least Functionality (CM-7 (DHS-5.4.5.f))

13.5.31 Information System Component Inventory (CM-8)

13.5.32 Information System Component Inventory (CM-8 (1))

13.5.33 Information System Component Inventory (CM-8 (3))

13.5.34 Information System Component Inventory (CM-8 (5))

13.5.35 Information System Component Inventory (CM-8 (DHS-4.6.a))

13.5.36 Information System Component Inventory (CM-8 (DHS-4.12.c))

13.5.37 Configuration Management Plan (CM-9)

13.5.38 Configuration Management Plan (CM-9 (DHS-3.7.c))

13.5.39 SW Usage Restrictions (CM-10)

13.5.40 SW Usage Restrictions (CM-10 (1))

13.5.41 SW Usage Restrictions (CM-10 (DHS-4.8.4.f))

13.5.42 User-Installed SW (CM-11)

13.6.

Contingency Planning (CP)

13.6.1 Contingency Planning Policy and Procedures (CP-1)

13.6.2 Contingency Planning Policy and Procedures (CP-1 (DHS-3.5.1.a))

13.6.3 Contingency Planning Policy and Procedures (CP-1 (DHS-3.15.f))

13.6.4 Contingency Plan (CP-2)

13.6.5 Contingency Plan (CP-2 (1))

13.6.6 Contingency Plan (CP-2 (2))

13.6.7 Contingency Plan (CP-2 (3))

13.6.8 Contingency Plan (CP-2 (8))

13.6.9 Contingency Plan (CP-2 (DHS-3.5.2.e))

13.6.10 Contingency Training (CP-3)

13.6.11 Contingency Plan Testing (CP-4)

13.6.12 Contingency Plan Testing (CP-4 (1))

13.6.13 Contingency Plan Testing (CP-4 (DHS-3.5.2.f))

13.6.14 Alternate Storage Site (CP-6)

13.6.15 Alternate Storage Site (CP-6 (1))

13.6.16 Alternate Storage Site (CP-6 (3))

13.6.17 Alternate Processing Site (CP-7)

13.6.18 Alternate Processing Site (CP-7 (1))

13.6.19 Alternate Processing Site (CP-7 (2))

13.6.20 Alternate Processing Site (CP-7 (3))

13.6.21 Telecommunications Services (CP-8)

13.6.22 Telecommunications Services (CP-8 (1))

13.6.23 Telecommunications Services (CP-8 (2))

13.6.24 Information System Backup (CP-9)

13.6.25 Information System Backup (CP-9 (1))

13.6.26 Information System Backup (CP-9 (3))

13.6.27 Information System Recovery and Reconstitution (CP-10)

13.6.28 Information System Recovery and Reconstitution (CP-10 (2)) 13.7.

Identification and Authentication (IA)

13.7.1 Identification and Authentication Policy and Procedures (IA-1)

13.7.2 Identification and Authentication Policy and Procedures (IA-1 (DHS-3.14.7.a))

13.7.3 Identification and Authentication Policy and Procedures (IA-1 (DHS-3.14.7.c))

13.7.4 Identification and Authentication Policy and Procedures (IA-1 (DHS-3.14.7.f))

13.7.5 Identification and Authentication Policy and Procedures (IA-1 (DHS-3.14.7.i))

13.7.6 Identification and Authentication Policy and Procedures (IA-1 (DHS-4.6.2.4.b))

13.7.7 Identification and Authentication Policy and Procedures (IA-1 (DHS-4.6.2.q))

13.7.8 Identification and Authentication Policy and Procedures (IA-1 (DHS-5.1.1.a))

13.7.9 Identification and Authentication (Organizational Users) (IA-2)

13.7.10 Identification and Authentication (Organizational Users) (IA-2 (1))

13.7.11 Identification and Authentication (Organizational Users) (IA-2 (2))

13.7.12 Identification and Authentication (Organizational Users) (IA-2 (3))

13.7.13 Identification and Authentication (Organizational Users) (IA-2 (5))

13.7.14 Identification and Authentication (Organizational Users) (IA-2 (8))

13.7.15 Identification and Authentication (Organizational Users) (IA-2 (11))

13.7.16 Identification and Authentication (Organizational Users) (IA-2 (12))

13.7.17 Identification and Authentication (Organizational Users) (IA-2 (DHS-5.1.a))

13.7.18 Identification and Authentication (Organizational Users) (IA-2 (DHS-5.1.d))

13.7.19 Device Identification and Authentication (IA-3)

13.7.20 Identifier Management (IA-4)

13.7.21 Identifier Management (IA-4 (4))

13.7.22 Identifier Management (IA-4 (DHS-4.6.2.r))

13.7.23 Authenticator Management (IA-5)

13.7.24 Authenticator Management (IA-5 (1))

13.7.25 Authenticator Management (IA-5 (2))

13.7.26 Authenticator Management (IA-5 (3))

13.7.27 Authenticator Management (IA-5 (4))

13.7.28 Authenticator Management (IA-5 (6))

13.7.29 Authenticator Management (IA-5 (7))

13.7.30 Authenticator Management (IA-5 (11))

13.7.31 Authenticator Management (IA-5 (DHS-5.1.e))

13.7.32 Authenticator Management (IA-5 (DHS-5.1.k))

13.7.33 Authenticator Management (IA-5 (DHS-5.1.m))

13.7.34 Authenticator Feedback (IA-6)

13.7.35 Cryptographic Module Authentication (IA-7)

13.7.36 Identification and Authentication (Non-Organizational Users) (IA-8)

13.7.37 Identification and Authentication (Non-Organizational Users) (IA-8 (1))

13.7.38 Identification and Authentication (Non-Organizational Users) (IA-8 (2))

13.7.39 Identification and Authentication (Non-Organizational Users) (IA-8 (3))

13.7.40 Identification and Authentication (Non-Organizational Users) (IA-8 (4)) 13.8.

Incident Response (IR)

13.8.1 Incident Response Policy and Procedures (IR-1)

13.8.2 Incident Response Policy and Procedures (IR-1 (DHS-3.15.g))

13.8.3 Incident Response Training (IR-2)

13.8.4 Incident Response Testing (IR-3)

13.8.5 Incident Response Testing (IR-3 (2))

13.8.6 Incident Handling (IR-4)

13.8.7 Incident Handling (IR-4 (1))

13.8.8 Incident Monitoring (IR-5)

13.8.9 Incident Reporting (IR-6)

13.8.10 Incident Reporting (IR-6 (1))

13.8.11 Incident Reporting (IR-6 (DHS-3.15.h))

13.8.12 Incident Response Assistance (IR-7)

13.8.13 Incident Response Assistance (IR-7 (1))

13.8.14 Incident Response Assistance (IR-7 (2))

13.8.15 Incident Response Plan (IR-8)

13.8.16 Information Spillage Response (IR-9)

13.8.17 Information Spillage Response (IR-9 (1))

13.8.18 Information Spillage Response (IR-9 (2))

13.8.19 Information Spillage Response (IR-9 (3))

13.8.20 Information Spillage Response (IR-9 (4))

13.9.

Maintenance (MA)

13.9.1 System Maintenance Policy and Procedures (MA-1)

13.9.2 System Maintenance Policy and Procedures (MA-1 (DHS-4.8.4.e))

13.9.3 System Maintenance Policy and Procedures (MA-1 (DHS-4.8.4.i))

13.9.4 System Maintenance Policy and Procedures (MA-1 (DHS-4.12.g))

13.9.5 Controlled Maintenance (MA-2)

13.9.6 Maintenance Tools (MA-3)

13.9.7 Maintenance Tools (MA-3 (1))

13.9.8 Maintenance Tools (MA-3 (2))

13.9.9 Maintenance Tools (MA-3 (3))

13.9.10 Nonlocal Maintenance (MA-4)

13.9.11 Nonlocal Maintenance (MA-4 (2))

13.9.12 Nonlocal Maintenance (MA-4 (DHS-4.12.e))

13.9.13 Nonlocal Maintenance (MA-4 (DHS-5.4.4.c))

13.9.14 Maintenance Personnel (MA-5)

13.9.15 Maintenance Personnel (MA-5 (1))

13.9.16 Timely Maintenance (MA-6)

13.10.

Media Protection (MP)

13.1.1 Media Protection Policy and Procedures (MP-1)

13.1.2 Media Protection Policy and Procedures (MP-1 (DHS-4.3.1.g))

13.1.3 Media Protection Policy and Procedures (MP-1 (DHS-4.11.d))

13.1.4 Media Protection Policy and Procedures (MP-1 (DHS-5.4.1.d))

13.1.5 Media Access (MP-2)

13.1.6 Media Marking (MP-3)

13.1.7 Media Storage (MP-4)

13.1.8 Media Storage (MP-4 (DHS-4.3.1.a))

13.1.9 Media Transport (MP-5)

13.1.10 Media Transport (MP-5 (4))

13.1.11 Media Transport (MP-5 (DHS-4.11.f))

13.1.12 Media Transport (MP-5 (DHS-4.11.g))

13.1.13 Media Sanitization (MP-6)

13.1.14 Media Sanitization (MP-6 (2))

13.1.15 Media Sanitization (MP-6 (DHS-4.3.3.b))

13.1.16 Media Sanitization (MP-6 (DHS-4.3.3.c))

13.1.17 Media Sanitization (MP-6 (DHS-4.12.h))

13.1.18 Media Use (MP-7)

13.1.19 Media Use (MP-7 (1))

13.1.20 Media Use (MP-7 (DHS-4.3.1.d))

13.1.21 Media Use (MP-7 (DHS-4.3.1.e))

13.1.22 Media Use (MP-7 (DHS-4.3.1.f))

13.11.

Physical and Environmental Protection (PE)

13.11.1 Physical and Environmental Protection Policy and Procedures (PE-1)

13.11.2 Physical and Environmental Protection Policy and Procedures (PE-1 (DHS-3.3.c))

13.11.3 Physical and Environmental Protection Policy and Procedures (PE-1 (DHS-4.6.2.3.b))

13.11.4 Physical and Environmental Protection Policy and Procedures (PE-1 (DHS-4.8.1.c))

13.11.5 Physical Access Authorizations (PE-2)

13.11.6 Physical Access Control (PE-3)

13.11.7 Access Control for Transmission Medium (PE-4)

13.11.8 Access Control for Output Devices (PE-5)

13.11.9 Monitoring Physical Access (PE-6)

13.11.10 Monitoring Physical Access (PE-6 (1))

13.11.11 Visitor Access Records (PE-8)

13.11.12 Power Equipment and Cabling (PE-9)

13.11.13 Emergency Shutoff (PE-10)

13.11.14 Emergency Power (PE-11)

13.11.15 Emergency Lighting (PE-12)

13.11.16 Fire Protection (PE-13)

13.11.17 Fire Protection (PE-13 (2))

13.11.18 Fire Protection (PE-13 (3))

13.11.19 Temperature and Humidity Controls (PE-14)

13.11.20 Temperature and Humidity Controls (PE-14 (2))

13.11.21 Water Damage Protection (PE-15)

13.11.22 Delivery and Removal (PE-16)

13.11.23 Alternate Work Site (PE-17)

13.12.

Planning (PL)

13.12.1 Security Planning Policy and Procedures (PL-1)

13.12.2 Security Planning Policy and Procedures (PL-1 (DHS-4.6.1.d))

13.12.3 Security Planning Policy and Procedures (PL-1 (DHS-4.6.1.e))

13.12.4 System Security Plan (PL-2)

13.12.5 System Security Plan (PL-2 (3))

13.12.6 System Security Plan (PL-2 (DHS-3.15.i))

13.12.7 Rules of Behavior (PL-4)

13.12.8 Rules of Behavior (PL-4 (1))

13.12.9 Rules of Behavior (PL-4 (DHS-4.1.2.a))

13.12.10 Rules of Behavior (PL-4 (DHS-4.1.2.b))

13.12.11 Rules of Behavior (PL-4 (DHS-4.8.2.b))

13.12.12 Rules of Behavior (PL-4 (DHS-4.8.2.c))

13.12.13 Rules of Behavior (PL-4 (DHS-4.8.3.a))

13.12.14 Rules of Behavior (PL-4 (DHS-4.8.5.e))

13.12.15 Information Security Architecture (PL-8)

13.13.

program management (PM) 13.14.

Personnel Security (PS)

13.14.1 Personnel Security Policy and Procedures (PS-1)

13.14.2 Position Risk Designation (PS-2)

13.14.3 Personnel Screening (PS-3)

13.14.4 Personnel Screening (PS-3 (3))

13.14.5 Personnel Termination (PS-4)

13.14.6 Personnel Transfer (PS-5)

13.14.7 Access Agreements (PS-6)

13.14.8 Third-Party Personnel Security (PS-7)

13.14.9 Personnel Sanctions (PS-8)

13.15.

Risk Assessment (RA)

13.15.1 Risk Assessment Policy and Procedures (RA-1)

13.15.2 Security Categorization (RA-2)

13.15.3 Risk Assessment (RA-3)

13.15.4 Risk Assessment (RA-3 (DHS-4.5.4.a))

13.15.5 Risk Assessment (RA-3 (DHS-5.3.e))

13.15.6 Vulnerability Scanning (RA-5)

13.15.7 Vulnerability Scanning (RA-5 (1))

13.15.8 Vulnerability Scanning (RA-5 (2))

13.15.9 Vulnerability Scanning (RA-5 (3))

13.15.10 Vulnerability Scanning (RA-5 (5))

13.15.11 Vulnerability Scanning (RA-5 (6))

13.15.12 Vulnerability Scanning (RA-5 (8))

13.15.13 Vulnerability Scanning (RA-5 (DHS-3.15.c))

13.15.14 Vulnerability Scanning (RA-5 (DHS-4.8.4.d))

13.16.

System and Services Acquisition (SA)

13.16.1 System and Services Acquisition Policy and Procedures (SA-1)

13.16.2 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.1.g))

13.16.3 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.2.g))

13.16.4 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.3.a))

13.16.5 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.3.b))

13.16.6 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.14.7.f))

13.16.7 System and Services Acquisition Policy and Procedures (SA-1 (DHS-3.14.7.h))

13.16.8 System and Services Acquisition Policy and Procedures (SA-1 (DHS-5.8.2.b))

13.16.9 Allocation of Resources (SA-2)

13.16.10 System Development Life Cycle (SA-3)

13.16.11 System Development Life Cycle (SA-3 (DHS-3.6.c))

13.16.12 Acquisition Process (SA-4)

13.16.13 Acquisition Process (SA-4 (1))

13.16.14 Acquisition Process (SA-4 (2))

13.16.15 Acquisition Process (SA-4 (8))

13.16.16 Acquisition Process (SA-4 (9))

13.16.17 Acquisition Process (SA-4 (10))

13.16.18 Acquisition Process (SA-4 (DHS-3.14.7.g))

13.16.19 Acquisition Process (SA-4 (DHS-5.7.b))

13.16.20 Information System Documentation (SA-5)

13.16.21 Security Engineering Principles (SA-8)

13.16.22 External Information System Services (SA-9)

13.16.23 External Information System Services (SA-9 (1))

13.16.24 External Information System Services (SA-9 (2))

13.16.25 External Information System Services (SA-9 (4))

13.16.26 External Information System Services (SA-9 (5))

13.16.27 Developer Configuration Management (SA-10)

13.16.28 Developer Configuration Management (SA-10 (1))

13.16.29 Developer Security Testing and Evaluation (SA-11)

13.16.30 Developer Security Testing and Evaluation (SA-11 (1))

13.16.31 Developer Security Testing and Evaluation (SA-11 (2))

13.16.32 Developer Security Testing and Evaluation (SA-11 (8)) 13.17.

System and Communications Protection (SC)

13.17.1 System and Communications Protection Policy and Procedures (SC-1)

13.17.2 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.4.2.a))

13.17.3 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.5.2.a))

13.17.4 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.5.3.b))

13.17.5 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.3.c))

13.17.6 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.e))

13.17.7 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.f))

13.17.8 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.g))

13.17.9 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.h))

13.17.10 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.i))

13.17.11 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.4.j))

13.17.12 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.b))

13.17.13 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.2.e))

13.17.14 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.3.f))

13.17.15 System and Communications Protection Policy and Procedures (SC-1 (DHS-4.6.3.g))

13.17.16 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.1.1.e))

13.17.17 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.4.1.a))

13.17.18 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.4.3.p))

13.17.19 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.4.4.d))

13.17.20 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.5.2.t))

13.17.21 System and Communications Protection Policy and Procedures (SC-1 (DHS-5.5.3.j))

13.17.22 Application Partitioning (SC-2)

13.17.23 Information in Shared Resources (SC-4)

13.17.24 Denial of Service Protection (SC-5)

13.17.25 Denial of Service Protection (SC-5 (DHS-4.6.1.c))

13.17.26 Denial of Service Protection (SC-5 (DHS-4.6.2.4.c))

13.17.27 Resource Availability (SC-6)

13.17.28 Boundary Protection (SC-7)

13.17.29 Boundary Protection (SC-7 (3))

13.17.30 Boundary Protection (SC-7 (4))

13.17.31 Boundary Protection (SC-7 (5))

13.17.32 Boundary Protection (SC-7 (7))

13.17.33 Boundary Protection (SC-7 (8))

13.17.34 Boundary Protection (SC-7 (12))

13.17.35 Boundary Protection (SC-7 (13))

13.17.36 Boundary Protection (SC-7 (18))

13.17.37 Boundary Protection (SC-7 (DHS-5.4.5.a))

13.17.38 Boundary Protection (SC-7 (DHS-5.4.5.b))

13.17.39 Transmission Confidentiality and Integrity (SC-8)

13.17.40 Transmission Confidentiality and Integrity (SC-8 (1))

13.17.41 Network Disconnect (SC-10)

13.17.42 Cryptographic Key Establishment and Management (SC-12)

13.17.43 Cryptographic Key Establishment and Management (SC-12 (2))

13.17.44 Cryptographic Key Establishment and Management (SC-12 (3))

13.17.45 Cryptographic Key Establishment and Management (SC-12 (DHS-4.6.b))

13.17.46 Cryptographic Key Establishment and Management (SC-12 (DHS-5.5.3.a))

13.17.47 Cryptographic Key Establishment and Management (SC-12 (DHS-5.5.3.b))

13.17.48 Cryptographic Key Establishment and Management (SC-12 (DHS-5.5.3.c))

13.17.49 Cryptographic Key Establishment and Management (SC-12 (DHS-5.5.3.i))

13.17.50 Cryptographic Protection (SC-13)

13.17.51 Cryptographic Protection (SC-13 (DHS-5.4.6.k))

13.17.52 Cryptographic Protection (SC-13 (DHS-5.5.1.b))

13.17.53 Cryptographic Protection (SC-13 (DHS-5.5.1.c))

13.17.54 Cryptographic Protection (SC-13 (DHS-5.5.2.v))

13.17.55 Cryptographic Protection (SC-13 (DHS-5.7.d))

13.17.56 Collaborative Computing Devices (SC-15)

13.17.57 Collaborative Computing Devices (SC-15 (DHS-4.5.3.a))

13.17.58 Collaborative Computing Devices (SC-15 (DHS-4.5.3.b))

13.17.59 Collaborative Computing Devices (SC-15 (DHS-4.5.3.c))

13.17.60 Public Key Infrastructure Certificates (SC-17)

13.17.61 Mobile Code (SC-18)

13.17.62 Voice Over Internet Protocol (SC-19)

13.17.63 Secure Name / Address Resolution Service (Authoritative Source) (SC-20)

13.17.64 Secure Name / Address Resolution Service (Recursive or Caching Resolver) (SC-21)

13.17.65 Architecture and Provisioning for Name/Address Resolution Service (SC-22)

13.17.66 Session Authenticity (SC-23)

13.17.67 Protection of Information at Rest (SC-28)

13.17.68 Protection of Information at Rest (SC-28 (1))

13.17.69 Process Isolation (SC-39)

13.18.

System and Information Integrity (SI)

13.18.1 System and Information Integrity Policy and Procedures (SI-1)

13.18.2 System and Information Integrity Policy and Procedures (SI-1 (DHS-5.4.2.a))

13.18.3 System and Information Integrity Policy and Procedures (SI-1 (DHS-5.4.5.c))

13.18.4 Flaw Remediation (SI-2)

13.18.5 Flaw Remediation (SI-2 (2))

13.18.6 Flaw Remediation (SI-2 (3))

13.18.7 Malicious Code Protection (SI-3)

13.18.8 Malicious Code Protection (SI-3 (1))

13.18.9 Malicious Code Protection (SI-3 (2))

13.18.10 Malicious Code Protection (SI-3 (7))

13.18.11 Malicious Code Protection (SI-3 (10))

13.18.12 Information System Monitoring (SI-4)

13.18.13 Information System Monitoring (SI-4 (1))

13.18.14 Information System Monitoring (SI-4 (2))

13.18.15 Information System Monitoring (SI-4 (4))

13.18.16 Information System Monitoring (SI-4 (5))

13.18.17 Information System Monitoring (SI-4 (14))

13.18.18 Information System Monitoring (SI-4 (16))

13.18.19 Information System Monitoring (SI-4 (23))

13.18.20 Security Alerts, Advisories, and Directives (SI-5)

13.18.21 Security Function Verification (SI-6)

13.18.22 Software, Firmware, and Information Integrity (SI-7)

13.18.23 Software, Firmware, and Information Integrity (SI-7 (1))

13.18.24 Software, Firmware, and Information Integrity (SI-7 (7))

13.18.25 Software, Firmware, and Information Integrity (SI-7 (DHS-5.1.1.e))

13.18.26 Spam Protection (SI-8)

13.18.27 Spam Protection (SI-8 (1))

13.18.28 Spam Protection (SI-8 (2))

13.18.29 Information Input Validation (SI-10)

13.18.30 Error Handling (SI-11)

13.18.31 Information Handling and Retention (SI-12)

13.18.32 Memory Protection (SI-16)

13.19.

Privacy (priv)

13.19.1 Privacy Requirements for Contractors and Service Providers (AR-3)

13.19.1 Privacy Monitoring and Auditing (AR-4)

13.19.1 Privacy Awareness and Training (AR-5)

13.19.1 Privacy Reporting (AR-6)

13.19.1 Privacy-Enhanced System Design and Development (AR-7)

13.19.1 Accounting of Disclosures (AR-8)

13.19.1 Data Quality (DI-1)

13.19.1 Data Integrity and Data Integrity Board (DI-2)

13.19.1 Minimization of Personally Identifiable Information (DM-1)

13.19.1 Data Retention and Disposal (DM-2)

13.19.1 Minimization of PII Used in Testing, Training, and Research (DM-3)

13.19.1 Consent (IP-1)

13.19.1 Individual Access (IP-2)

13.19.1 Redress (IP-3)

13.19.1 Complaint Management (IP-4)

13.19.1 Authority to Collect (PRIV-AP-1)

13.19.1 Purpose Specification (PRIV-AP-2)

13.19.1 Governance and Privacy Program (PRIV-AR-1)

13.19.1 Privacy Impact and Risk Assessment (PRIV-AR-2)

13.19.1 Inventory of Personally Identifiable Information (SE-1)

13.19.1 Privacy Incident Response (SE-2)

13.19.1 Privacy Notice (TR-1)

13.19.1 System of Records Notices and Privacy Act Statements (TR-2)

13.19.1 Dissemination of Privacy Program Information (TR-3)

13.19.1 Internal Use (UL-1)

13.19.1 Information Sharing with Third Parties (UL-2)

Acronyms 14.

SYSTEMS SECURITY PLAN ATTACHMENTS

14.1.

ATTACHMENT 1 - [Information Security Policies] 14.2.

ATTACHMENT 2 - [User Guide] 14.3.

ATTACHMENT 3 - [e-Authentication Worksheet] 14.4.

ATTACHMENT 4 - [PTA/PIA]

14.5.

ATTACHMENT 5 - [Rules of Behavior] 14.6.

ATTACHMENT 6 - [IT Contingency Plan] 14.7.

ATTACHMENT 7 - [Configuration Management Plan] 14.8.

ATTACHMENT 8 - [Incident Response Plan] 14.9.

ATTACHMENT 9 - [CIS Workbook]

List of Tables

Table 1-1. Information System Name and Title

Table 2-1. Security Categorization

Table 2-2. Sensitivity Categorization of Information Types

Table 2-3. Security Impact Level

Table 3-1. Information System Owner

Table 5-1. Information System Management Point of Contact

Table 5-2. Information System Technical Point of Contact

Table 6-1. CSP Internal ISSO (or Equivalent)

Table 7-1. System Status

Table 8-1. Service Layers Represented in this SSP

Table 8-2. Leveraged Authorizations

Table 9-1. User Roles and Privileges

Table 10-1. Server Hardware Components

Table 10-2. Software Components

Table 10-3. Network Components

Table 10-4. Ports, Protocols, and Services

Table 11-1. System Interconnections

Table 13-1. Summary of Required Security Controls

List of Figures

Figure 10-1. Network Diagram

Figure 10-2. Data Flow Diagrams

About This Document This document is released in template format. Once populated with content, this document will include detailed information about service provider information security controls.

Who should use this document?

This document is intended to be used by service providers who are applying for a Provisional Authorization through the U.S. federal government FedRAMP program. U.S. federal agencies may want to use it to document information systems security plans that are not part of the FedRAMP program.

Other uses of this template include using it to document organizational information security controls for the purpose of creating a plan to manage a large information security infrastructure. Complex and sophisticated systems are difficult to manage without a documented understanding of how the infrastructure is architected.

How this document is organized This document is divided into six sections and includes attachments. Most sections include subsections.

Section 1 identifies the system.

Section 2 describes the system categorization in accordance with FIPS 199.

Section 3 identifies the system owner and provides contact information.

Section 4 identifies the authorizing official.

Section 5 identifies other designated contacts.

Section 6 identifies the assignment of security responsibility.

Section 7 identifies the operational status of the information system.

Section 8 identifies the type of information system.

Section 9 describes the function and purpose of the information system.

Section 10 describes the information system environment.

Section 11 identifies interconnections between other information systems.

Section 12 describes laws and regulations related to operations of the information system.

Section 13 provides an in-depth description of how each security control is implemented.

How to contact us If you have questions about FedRAMP, or if you have technical questions about this document including how to use it, write to:

info@fedramp.gov For more information about the FedRAMP project, please see the website at:

http://www.fedramp.gov.

System Security Plan Approvals

Cloud Service Provider Signatures

X

[No ISO on file] [date] [No ISO on file] [Cloud Service Provider]

X

[Not Provided] [date] [Not Provided]

X

[Not Provided] [date] [Not Provided]

1. Information System Name/Title This System Security Plan provides an overview of the security requirements for the M-M-M FedRAMP 2.1 ([project acronym not provided]) and describes the controls in place or planned for implementation to provide a level of security appropriate for the information to be transmitted, processed or stored by the system. Information security is an asset vital to our critical infrastructure and its effective performance and protection is a key component of our national security program. Proper management of information technology systems is essential to ensure the confidentiality, integrity and availability of the data transmitted, processed or stored by the M-M-M FedRAMP 2.1 information system.

The security safeguards implemented for the M-M-M FedRAMP 2.1 system meet the policy and control requirements set forth in this System Security Plan. All systems are subject to monitoring consistent with applicable laws, regulations, agency policies, procedures and practices.

Table 1-1. Information System Name and Title

2. Information System Categorization The overall information system sensitivity categorization is noted in the table that follows.

Table 2-1. Security Categorization

Information Types This section describes how the information types used by the information system are categorized for confidentiality, integrity, and availability sensitivity levels.

The following tables identify the information types that are input, stored, processed, and/or output from M-M-M FedRAMP 2.1. The selection of the information types is based on guidance provided by OMB Federal Enterprise Architecture Program Management Office Business Reference Model 2.0, and FIPS Pub 199, Standards for Security Categorization of Federal Information and Information Systems which is based on NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories.

The tables also identify the security impact levels for confidentiality, integrity, and availability for each of the information types expressed as low, moderate, or high. The security impact levels are based on the potential impact definitions for each of the security objectives (i.e., confidentiality, integrity, and availability) discussed in NIST SP 800-60 and FIPS Pub 199.

The potential impact is low if—

- The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

- A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.

The potential impact is moderate if—

- The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

- A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

The potential impact is high if—

- The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

- A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions; (ii) result in major damage to organizational assets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries.

Note:

The information types found in NIST SP 800-60, Volumes I and II

Revision 1 are the same information types found in the Federal Enterprise Architecture (FEA) Consolidated Reference Model.

Table 2-2. Sensitivity Categorization of Information Types

Security Objectives Categorization (FIPS 199) Based on the information provided in Table 2-2, Information Types, for the M-M-M FedRAMP 2.1 default to the high-water mark for the noted Information Types as identified in the table below.

Table 2-3. Security Impact Level

Note:

Please refer to FIPS PUB 199 Standards for Security Categorization of Federal Information and Information Systems.

Through review and analysis it has been determined that the baseline security categorization for the M-M-M FedRAMP 2.1 system is listed in the table that follows.

Using this categorization, in conjunction with the risk assessment and any unique security requirements, we have established the security controls for this system, as detailed in this SSP.

3. Information System Owner The following individual is identified as the system owner or functional proponent/advocate for this system.

Table 3-1. Information System Owner

4. Authorizing Official The Authorizing Official (AO) or Designated Approving Authority (DAA) for this information system is the Federal Risk Authorization Management Program (FedRAMP), Joint Authorization Board (JAB) as comprised of member representatives from the General Services Administration (GSA), Department of Defense (DOD) and Department of Homeland Security (DHS).

5. Other Designated Contacts The following individual(s) identified below possess in-depth knowledge of this system and/or its functions and operation.

Table 5-1. Information System Management Point of Contact

Table 5-2. Information System Technical Point of Contact

6. Assignment of Security Responsibility The Information System Security Officers (ISSO), or their equivalent, identified below, have been appointed in writing and are deemed to have significant cyber and operational role responsibilities.

Table 6-1. CSP Internal ISSO (or Equivalent)

7. Information System Operational Status The system is currently in the life-cycle phase noted in the table that follows.

Table 7-1. System Status System Status

8. Information System Type The M-M-M FedRAMP 2.1 makes use of unique managed service provider architecture layer(s).

Cloud Service Model Information systems, particularly those based on cloud architecture models, are made up of different service layers. The layers of the M-M-M FedRAMP 2.1 that are defined in this SSP, and are not leveraged by any other Provisional Authorizations, are indicated in the table that follows.

[ Place an 'X' in the column left of the most appropriate row, then delete this instruction]

Table 8-1. Service Layers Represented in this SSP Service Provider Architecture Layers

Note:

Please refer to NIST SP 800-145 for information on cloud computing architecture models.

Leveraged Provisional Authorizations

The M-M-M FedRAMP 2.1 (plans to/does not plan to) leverage a pre-existing Provisional Authorization. Provisional Authorizations leveraged by M-M-M FedRAMP 2.1 are noted in the table that follows.

Table 8-2. Leveraged Authorizations

9. General System Description This section includes a general description of the M-M-M FedRAMP 2.1.

System Function or Purpose {This section should discuss the mission of the information system.} Information System Components and Boundaries {This section should include a description, in text, detailing the external boundary of the information system. The description should address applicable environments other than the primary production environment (i.e., maintenance, testing/development or backup environments). Where required the description should detail lines of responsibility demarcation that exist for any controls inherited from other information systems.} Types of Users All users have their employee status categorized with a sensitivity level in accordance with PS-2. Employees (or contractors) of service providers are considered Internal Users. All other users are considered External Users. User privileges (authorization permission after authentication takes place) are described in the table that follows.

[Delete this instruction prior to publishing] Instruction: For an External User, please write "Not Applicable" in the Sensitivity Level Column. Please include systems administrators and database administrators as a role types. (Also include web server administrators, network administrators, and firewall administrators if these individuals have the ability to configure a device or host that could impact the CSP service offering.) Add additional rows if necessary.

Table 9-1. User Roles and Privileges

Master Administrator

Audit/Executive

Administrator

Security Administrator

User

Note: User roles typically align with Active Directory, LDAP, Role based Access Controls, NIS and UNIX groups, and or UNIX netgroups.

There are currently <number> of internal users and <number> of external users. Within one year, it is anticipated that there will be <number> of internal users and <number> of external users.

Network Architecture Figure 10-1. Network Diagram

The following architectural drawings of M-M-M FedRAMP 2.1 provide a visual depiction of the major system hardware elements that constitute M-M-M FedRAMP 2.1.

10. System Environment {Instruction (Delete before publishing): In the space that follows, provide a general description of the technical system environment. Include information about all system environments that are used, e.g. production environment, test environment, staging or QA environments.

This section should also detail any system elements, hardware or software that mitigates the security risks of operating the system.}

10.1.1. Hardware Inventory

The following table lists the principal server hardware components for M-M-M FedRAMP 2.1.

Table 10-1. Server Hardware Components

There is no hardware associated with the project.

Note:

A complete and detailed list of the system hardware and software inventory is required per NIST SP 800-53, Rev 3 CM-8.

10.1.2. Software Inventory

The following table lists the principle software components for M-M-M FedRAMP 2.1.

Table 10-2. Software Components There is no software associated with the project.

10.1.3. Network Inventory

The following table lists the principle network devices and components for M-M-M FedRAMP 2.1.

Table 10-3. Network Components There is no hardware associated with the project.

10.1.4. Data Flow

Figure 10-2. Data Flow Diagrams {Instruction: In the space that follows, describe the flow of data in and out of system boundaries and insert a data flow diagram. See Guide to Understanding FedRAMP for a dataflow example. If necessary, include multiple data flow diagrams.}

10.1.5. Ports, Protocols and Services

The table below lists the Ports, Protocols, and Services enabled in this information system. TCP ports are indicated with a T and UDP ports are indicated with a U.

Table 10-4. Ports, Protocols, and Services

11. System Interconnections Instruction [Delete before publishing]: List all interconnected systems. Provide the IP address and interface identifier (ie0, ie1, ie2) for the CSP system that provides the connection. Name the external organization and the IP address of the external system. Indicate how the connection is being secured. For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number. Add additional rows as needed. This table should be consistent with CA-3.

Table 11-1. System Interconnections

12. Applicable Laws and Regulations Applicable Laws The following laws and regulations apply to the information system:

· Computer Fraud and Abuse Act [PL 99-474, 18 USC 1030]

· E-Authentication Guidance for Federal Agencies [OMB M-04-04]

· Federal Information Security Management Act (FISMA) of 2002 [Title III, PL 107-347]

· Freedom of Information Act As Amended in 2002 [PL 104-232, 5 USC 552]

· Guidance on Inter-Agency Sharing of Personal Data – Protecting Personal Privacy [OMB M-01-05]

· Homeland Security Presidential Directive-7, Critical Infrastructure Identification, Prioritization, and Protection [HSPD-7]

· Internal Control Systems [OMB Circular A-123]

· Management of Federal Information Resources [OMB Circular A-130]

· Management’s Responsibility for Internal Control [OMB Circular A-123, Revised 12/21/2004]

· Privacy Act of 1974 as amended [5 USC 552a]

· Protection of Sensitive Agency Information [OMB M-06-16]

· Records Management by Federal Agencies [44 USC 31]

· Responsibilities for the Maintenance of Records About Individuals by Federal Agencies [OMB Circular A-108, as amended]

· Security of Federal Automated Information Systems [OMB Circular A-130, Appendix III] Applicable Standards and Guidance The following standards and guidance apply to the information system:

· A NIST Definition of Cloud Computing [NIST SP 800-145]

· Computer Security Incident Handling Guide [NIST SP 800—61, Revision 1]

· Contingency Planning Guide for Federal Information Systems [NIST SP 800-34, Revision 1]

· Engineering Principles for Information Technology Security (A Baseline for Achieving Security) [NIST SP 800-27, Revision A]

· Guide for Assessing the Security Controls in Federal Information Systems [NIST SP 800-53A]

· Guide for Developing Security Plans for Federal Information Systems [NIST SP 800-18, Revision 1]

· Guide for Developing the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach [NIST SP 800-37, Revision 1]

· Guide for Mapping Types of Information and Information Systems to Security Categories [NISP SP 800-60, Revision 1]

· Guide for Security-Focused Configuration Management of Information Systems [NIST SP 800-128]

· Information Security Continuous Monitoring for Federal Information Systems and Organizations [NIST SP 800-137]

· Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication 200]

· Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-1]

· Recommended Security Controls for Federal Information Systems [NIST SP 800-53, Revision 3]

· Risk…