AoU_CLAD_ROA-OTA-23-003 Appendix C - ConMon.docx.pdf

APPENDIX C: CONMON READINESS CHECKLIST

ConMon Readiness Checklist

Award Partner: [Organization Name]

Annual Assessment Year: [Enter the year of the assessment (e.g., Y1-2021)]

ATO/Endorsement Date: [Date from the ATO/Endorsement Letter in mm/dd/yyyy]

System: [System Name] Date Checklist Completed: [mm/dd/yyyy]

Item

Compliance Item

Compliance Question Fully Compliant?

Yes, No, or N/A

If No or Not Applicable is selected, provide a reason. For a No response provide a plan to implement

1 Access Control Does the system limit access to authorized users, processes acting on behalf of authorized users, and devices?

2 Access Control Does the system limit access to the types of transactions and functions that authorized users are permitted to execute?

3 Access Control Does the system employ the principle of least privilege, including for specific security functions and privileged accounts?

4 Awareness & Training

Does the organization ensure personnel are trained on security awareness and role-based security responsibilities?

5 Audit & Accountability

Does the organization create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity?

6 Audit & Accountability

Does the organization ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions?

7 Audit & Accountability

Does the organization review and update logged events?

8 Configuration Management

Does the organization maintain baseline configurations and inventories of the system (including hardware, software, firmware, and documentation) throughout the respective system development life cycles?

9 Configuration Management

Has there been a significant change(s) since the authorization/endorsement was granted to the system, system environment, and/or data?

If so, please provide a description of the significant change(s).

10 Identification & Authentication

Does the system identify system users, processes acting on behalf of users, and devices?

11 Identification & Authentication

Does the system use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts?

12 Identification & Authentication

Does the system disable identifiers after a defined period of inactivity? If so, what is the defined period?

13 Continuous Monitoring

Does the organization maintain a software and hardware inventory that is reviewed at minimum annually and updated due to significant changes?

14 Continuous Monitoring

Does the organization have the ability to scan all hosts in the inventory?

15 Continuous Monitoring

Does the organization have the ability to provide scan files in a structured data format, such as CSV, XML, or .nessus files?

16 Continuous Monitoring

Is the organization maintaining Plan of Actions and Milestones (POA&M) that have timely, accurate, and complete information entries?

17 Continuous Monitoring

Does the organization conduct Security Impact Analysis for any major changes to the system?

18 Continuous Monitoring

Is the System Security Plan reviewed at minimum annually and updated for any significant changes?

19 Continuous Monitoring

Does the organization monitor and log system user access?

20 Continuous Monitoring

Does the organization remediate vulnerabilities within timeframes in accordance with policy? If so, what are the timeframes?

21 Continuous Monitoring

Does the organization conduct vulnerability scans within the frequency in accordance with policy? If so, what is the frequency?

22 Continuous Monitoring

Does the organization maintain a current, complete, and accurate baseline configuration of the information system?

23 Continuous Monitoring

If applicable, are the system interconnection security agreements current, complete, and accurate?

24 Continuous Monitoring

Does the organization have the capability to detect unauthorized or malicious use of the system, including insider threat and external intrusions?

25 Continuous Monitoring

Is the system boundary current, complete, and accurate?

26 Continuous Monitoring

Is the data flow diagram current, complete, and accurate? If so, when was the diagram last reviewed?

27 Continuous Monitoring

Are the network and architecture diagrams current, complete, and accurate? If so, when was the diagram last reviewed?

29 Incident Response Does the organization track, document, and report incidents to designated officials and/or authorities both internal and external to the organization?

30 Incident Response Has the organization conducted an Incident Response capability test? If so, when was the last test conducted?