Attachment_4_rev02-_Information_Security_Compliance.xlsx

Tab 1 - FISMA Compliant ATO

Tab 1 - FISMA Compliant ATO

Page &P of &N

Tab 2 - Mandatory 800-53 Ctrls

AC-2 (1)

AC-2 (2)

AC-2 (3)

AC-2 (4)

AC-2 (7) AC-2j.

[Assignment: organization-defined frequency] Parameter: [at least annually]

AC-2 (2)

[Assignment: organization-defined time period for each type of account (temporary and emergency)] Parameter: [no more than ninety days for temporary and emergency account types]

AC-2 (3)

[Assignment: organization-defined time period] Parameter: [sixty days for user accounts] See additional requirements and guidance. AC-2 (3) Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices). The time periods are approved and accepted by the JAB.

[Assignment: organization-defined nondiscretionary access control policies] Parameter: [role-based access control] [Assignment: organization-defined set of users and resources] Parameter: [all users and resources] AC-3 (3) Requirement: The service provider:

a. Assigns user accounts and authenticators in accordance within service provider's role-based access control policies;

b. Configures the information system to request user ID and authenticator prior to system access; and

c. Configures the databases containing federal information in accordance with service provider's security administration guide to provide role-based access controls enforcing assigned privileges and permissions at the file, table, row, column, or cell level, as appropriate.

AC-6 (1)

AC-6 (2) AC-6 (1)

[Assignment: organization-defined list of security functions (deployed in hardware, software, and firmware and security-relevant information] Parameter: [Agency-defined].

AC-6 (2)

[Assignment: organization-defined list of security functions or security-relevant information] Parameter: [Agency-defined] AC-6 (1) Requirement: The service provider defines the list of security functions. The list of functions is approved and accepted by the JAB.

AC-6 (2)

Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions.

AC-7 Unsuccessful Login Attempts AC-7 AC-7a.

[Assignment: organization-defined number] Parameter: [not more than three] AC-7a.

[Assignment: organization-defined time period] Parameter: [fifteen minutes] AC-7b.

Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the JAB.

Requirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the JAB.

Guidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided.

Requirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the JAB.

AC-17 (1)

AC-17 (2)

AC-17 (3)

AC-17 (4)

AC-17 (5)

AC-17 (7)

AC-17 (8) AC-17 (5)

[Assignment: organization-defined frequency] Parameter: [continuously, real time]

AC-17 (7)

[Assignment: organization-defined list of security functions and security-relevant information] Parameter: [Agency-defined].

AC-17 (8)

[Assignment: organization-defined networking protocols within the information system deemed to be non-secure] Parameter: [all non-approved / unnecessary networking protocols] AC-17 (7) Requirement: The service provider defines the list of security functions and security relevant information. Security functions and the implementation of such functions are approved and accepted by the JAB. Guidance: Security functions include but are not limited to: establishing system accounts; configuring access authorizations; performing system administration functions; and auditing system events or accessing event logs; SSH, and VPN.

AC-17 (8)

Requirement: Networking protocols implemented by the service provider are approved and accepted by JAB. Guidance: Exceptions to restricted networking protocols are granted for explicitly identified information system components in support of specific operational requirements.

AC-18 Wireless Access AC-18

AC-18 (1)

AC-18 (2)

AC-18 (3)

AC-18 (4)

AC-19 (1)

AC-19 (2)

Requirement: The service provider defines inspection and preventative measures. The measures are approved and accepted by JAB.

AC-20 Use of External Information Systems AC-20

AC-20 (1)

AU-2 (3)

AU-2 (4) AU-2a.

[Assignment: organization-defined list of auditable events] Parameter: [Account creation, modification, disabling, and deletion; Administrative permissions executed on user accounts; Administrative permissions executed on a system resources; Failed login attempts and account lockout; Use of ‘su’, ‘pu’, ‘root’, and ‘administrator’, or equivalent accounts; Activity log roll-over, deletion, or editing; All computer-readable data extracts from databases containing PII] AU-2d.

[Assignment: organization-defined subset of the auditable events defined in AU-2 a. to be audited] Parameter: [An agency-defined subset of events covered above should be reviewed at least annually if the review is dependent on a manual process. Agencies that have tools in place that allow this review to be done in real-time should perform the reviews in real-time.] AU-2d.

[Assignment: organization-defined frequency of (or situation requiring) auditing for each identified event]. Parameter: [continually]

AU-2 (3)

[Assignment: organization-defined frequency] Parameter: [annually] AU-2d.

Requirement: The service provider defines the subset of auditable events from AU-2a to be audited. The events to be audited are approved and accepted by JAB.

AU-2 (3)

Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB.

AU-2

Requirement: The service provider configures the auditing features of operating systems, databases, and applications to record security-related events, to include logon/logoff and all failed access attempts.

Requirement: The service provider defines audit record types. The audit record types are approved and accepted by the JAB. Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.

AU-6 (1)

[Assignment: organization-defined frequency] Parameter: [Agency-defined]

AU-8 (1)

[Assignment: organization-defined authoritative time source] Parameter: [Agency-defined]. AU-8 (1) Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.

Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server. Guidance: Synchronization of system clocks improves the accuracy of log analysis.

Requirement: The service provider implements FIPS-140-2 validated cryptography (e.g., DOD PKI Class 3 or 4 tokens) for service offerings.

Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements.

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

The service provider describes the types of changes to the information system or the environment of operations that would require a reauthorization of the information system. The types of changes are approved and accepted by the JAB.

[Assignment: organization-defined frequency] Parameter: [at least biannually to coincide with updating the security authorization package]

CA-7 (2)

[Assignment: organization-defined frequency] Parameter: [annually] [Selection: announced; unannounced] Parameter: [unannounced] [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises] Parameter: [penetration testing]

CM-2 (1)

CM-2 (3)

CM-2 (4)

CM-2 (5) CM-2 (1) (a) [Assignment: organization-defined frequency] Parameter: [annually] CM-2 (1) (b) [Assignment: organization-defined circumstances] Parameter: [Defined by DOL] CM-2 (5) (a) [Assignment: organization-defined list of software programs authorized to execute on the information system] Parameter: [DOL’s defined list of software programs not authorized to execute on DOL information systems]. CM-2 (1) (b) Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

The service provider describes the types of changes to the information system or the environment of operations that would require a review and update of the baseline configuration. The types of changes are approved and accepted by the JAB.

CM-2 (5) (a) Requirement: The service provider defines and maintains a list of software programs authorized to execute on the information system. The list of authorized programs is approved and accepted by the JAB.

[Assignment: organization-defined configuration change control element] Parameter: [the Departmental Configuration Control Subcommittee or agency Configuration Control Subcommittee/Board (or equivalent)].

[Selection (one or more): [Assignment: organization- defined frequency]; [Assignment: organization-defined configuration change conditions]] Parameter: [Agency-defined]. CM-3f.

Requirement: The service provider defines the configuration change control element and the frequency or conditions under which it is convened. The change control element and frequency/conditions of use are approved and accepted by the JAB.

Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the JAB.

CM-5 (1)

CM-6 (1)

Requirement: The service provider shall use the Center for Internet Security guidelines (Level 1) to establish configuration settings or establishes its own configuration settings if USGCB is not available. Configuration settings are approved and accepted by the JAB.

CM-6a Requirement: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).

CM-6a.

Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usgcbfdcc .

[Assignment: organization-defined list of prohibited or restricted functions, ports, protocols, and/or services] Parameter: [Domain Name System (DNS), File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), Internet Relay Chat (IRC), Network Basic Input Output System (NetBIOS), Simple Mail Transfer Protocol (SMTP), Structured Query Language (SQL)]

CM-7 (1)

[Assignment: organization-defined frequency] Parameter: [at least on an annual basis] CM-7 Requirement: The service provider uses the Center for Internet Security guidelines (Level 1) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if USGCB is not available. The list of prohibited or restricted functions, ports, protocols, and/or services is approved and accepted by the JAB.

CM-7

Guidance: Information on the USGCB checklists can be found at: http://usgcb.nist.gov/usgcb_faq.html#usgcbfaq_usg cbfdcc.

CM-8 Information System Component Inventory CM-8

CM-8 (1)

CM-8 (3)

CM-8 (5) CM-8d.

[Assignment: organization-defined information deemed necessary to achieve effective property accountability] Parameter: [Manufacturer, Model number, Serial number, Software license information, System/component owner].

CM-8 (3) (a) [Assignment: organization-defined frequency] Parameter: [with a maximum five minute delay in detection] CM-8d.

Requirement: The service provider defines information deemed necessary to achieve effective property accountability. Property accountability information is approved and accepted by the JAB. Guidance: Information deemed necessary to achieve effective property accountability may include hardware inventory specifications (manufacturer, type, model, serial number, physical location), software license information, information system/component owner, and for a networked component/device, the machine name and network address.

[Selection: security plan; risk assessment report; [Assignment: organization-defined document]] Parameter: [Systems Security Plan (SSP)] RA-3c.

[Assignment: organization-defined frequency] Parameter: [annually] RA-3d.

[Assignment: organization-defined frequency] Parameter: [annually] RA-3c.

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

RA-3d.

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

RA-5 Vulnerability Scanning RA-5

RA-5 (1)

RA-5 (2)

RA-5 (3)

RA-5 (9)

RA-5 (6) RA-5a.

[Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] Parameter: [annually] RA-5d.

Assignment: organization-defined response times] Parameter: [of high risks within six months and moderate risks within twelve months]

RA-5 (2)

Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F.

The service provider describes the types of changes to the information system or the environment of operations that would require a reauthorization of the information system. The types of changes are approved and accepted by the JAB.

[Assignment: organization-defined frequency] Parameter: [at least biannually to coincide with updating the security authorization package]

CA-7 (2)

[Assignment: organization-defined frequency] Parameter: [annually] [Selection: announced; unannounced] Parameter: [unannounced] [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises] Parameter: [penetration testing]

IA-5 (1)

IA-5 (2)

IA-5 (3)

IA-5 (6)

IA-5 (7) IA-5g.

[Assignment: organization-defined time period by authenticator type] Parameter: [Defined by DOL] IA-5 (1) (a) [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type] Parameter: [at least 8 characters long, include at least 1 uppercase letter, include at least 1 lowercase letter, include at least 1 number, include at least 1 special character] IA-5 (1) (b) [Assignment: organization-defined number of changed characters] Parameter: [Defined by DOL] IA-5 (1) (d) [Assignment: organization-defined numbers for lifetime minimum, lifetime maximum] Parameter: [15 days and 90 days respectively] IA-5 (1) (e) [Assignment: organization-defined number] Parameter: [12]

IA-5 (3)

[Assignment: organization-defined types of and/or specific authenticators] Parameter: [any strong authentication tokens] IA-5 (1) (a) Guidance: Mobile devices are excluded from the password complexity requirement.

[Assignment: organization-defined frequency] Parameter: [annually] [Assignment: organization-defined tests and/or exercises] Parameter: [scenario-based exercises]. IR-3 Requirement: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended).

IR-3

Requirement: The service provider provides test plans to FedRAMP annually. Test plans are approved and accepted by the JAB prior to test commencing.

Requirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.

IR-7 (1)

[Assignment: organization-defined list of incident response personnel (identified by name and/or by role) and organizational elements] Parameter: [appropriate department/agency personnel].

IR-8c.

[Assignment: organization-defined frequency] Parameter: [as frequently as the agency environment changes] IR-8e.

[Assignment: organization-defined list of incident response personnel (identified by name and/or by role) and organizational elements] Parameter: [designated officials within the department]. IR-8b.

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.

IR-8e.

Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.

SC-12 (2)

SC-13 (1)

SI-3 (1)

SI-3 (2)

SI-3 (3) SI-3c.

[Assignment: organization-defined frequency] Parameter: [at least weekly]

Tab 2 - Mandatory 800-53 Ctrls

Page &P of &N

Tab 3 - Other 800-53 Ctrls

CP-2 (1)

CP-2 (2) CP-2b.

[Assignment: organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements] Parameter: [key maintenance personnel (identified by name and/or by role) and agency elements.].

CP-2d.

[Assignment: organization-defined frequency] Parameter: [on an annual basis] CP-2f.

[Assignment: organization-defined list of key contingency personnel (identified by name and/or by role) and organizational elements] Parameter: See additional requirements and guidance. CP-2b.

Requirement: The service provider defines a list of key contingency personnel (identified by name and/or by role) and organizational elements. The contingency list includes designated FedRAMP personnel.

CP-2f.

Requirement: The service provider defines a list of key contingency personnel (identified by name and/or by role) and organizational elements. The contingency list includes designated FedRAMP personnel.

[Assignment: organization-defined frequency] Parameter: [at least annually for moderate and high impact systems and at least every three years for low impact systems using minimum functional exercises for moderate and high systems and classroom/tabletop exercises for low impact systems] [Assignment: organization-defined tests and/or exercises] Parameter: [at a minimum functional exercises for moderate and high impact systems and classroom / tabletop exercises for low impact systems] CP-4a.

Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended) and provides plans to FedRAMP prior to initiating testing. Test plans are approved and accepted by the JAB.

CP-6 Alternate Storage Site CP-6

CP-6 (1)

CP-7 (1)

CP-7 (2)

CP-7 (3)

Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis. The time period is approved and accepted by the JAB.

CP-8 Telecommunications Services CP-8

CP-8 (1)

Requirement: The service provider defines a time period consistent with the business impact analysis. The time period is approved and accepted by the JAB.

CP-9 Information System Backup CP-9

CP-9 (1)

CP-9 (3) CP-9a.

[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives] Parameter: [daily incremental; weekly full] CP-9b.

[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives] Parameter: [daily incremental; weekly full] CP-9c.

[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives] Parameter: [daily incremental; weekly full]

CP-9 (1)

[Assignment: organization-defined frequency] Parameter: [at least annually] CP-9a.

Requirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative. The backup storage capability is approved and accepted by the JAB.

CP-9b.

Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative. The backup storage capability is approved and accepted by the JAB.

CP-9c.

Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative. The backup storage capability is approved and accepted by the JAB.

CP-10 Information System Recovery and Reconstitution CP-10

CP-10 (2)

Requirement: The service provider defines circumstances that can inhibit recovery and reconstitution to a known state in accordance with the contingency plan for the information system and business impact analysis.

MA-3 (1)

MA-3 (2)

MA-4 (1)

[Assignment: organization-defined list of security-critical information system components and/or key information technology components] Parameter: [key components of the information system].

[Assignment: organization-defined time period] Parameter: [48 hours]. MA-6 Requirement: The service provider defines a list of security-critical information system components and/or key information technology components. The list of components is approved and accepted by the JAB.

Requirement: The service provider defines a time period to obtain maintenance and spare parts in accordance with the contingency plan for the information system and business impact analysis. The time period is approved and accepted by the JAB.

IA-2 (1)

IA-2 (2)

IA-2 (3)

Requirement: The service provider defines replay- resistant authentication mechanisms. The mechanisms are approved and accepted by the JAB.

Requirement: The service provider defines a list a specific devices and/or types of devices. The list of devices and/or device types is approved and accepted by the JAB.

[Assignment: organization-defined time period] Parameter: [up to 3 years after the user or device has been deleted] IA-4e.

[Assignment: organization-defined time period of inactivity] Parameter: [ninety days for user identifiers] Parameter: [60 days of inactivity].

IA-4 (4)

[Assignment: organization-defined characteristic identifying user status] Parameter: [contractors; foreign nationals] IA-4e.

Requirement: The service provider defines time period of inactivity for device identifiers. The time period is approved and accepted by JAB.

IA-5 Authenticator Management IA-5

IA-5 (1)

IA-5 (2)

IA-5 (3)

IA-5 (6)

IA-5 (7) IA-5g.

[Assignment: organization-defined time period by authenticator type] Parameter: [Defined by DOL] IA-5 (1) (a) [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type] Parameter: [at least 8 characters long, include at least 1 uppercase letter, include at least 1 lowercase letter, include at least 1 number, include at least 1 special character] IA-5 (1) (b) [Assignment: organization-defined number of changed characters] Parameter: [Defined by DOL] IA-5 (1) (d) [Assignment: organization-defined numbers for lifetime minimum, lifetime maximum] Parameter: [15 days and 90 days respectively] IA-5 (1) (e) [Assignment: organization-defined number] Parameter: [12]

IA-5 (3)

[Assignment: organization-defined types of and/or specific authenticators] Parameter: [any strong authentication tokens] Control moved to mandatory

IA-5 (1) (a) Guidance: Mobile devices are excluded from the password complexity requirement.

[Assignment: organization-defined types of digital and non-digital media] Parameter: [sensitive media including but not limited to diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, compact disks, digital video disks) and non-digital media including but not limited to paper, microfilm].

[Assignment: organization-defined list of authorized individuals] Parameter: [Agency-defined].

[Assignment: organization-defined security measures] Parameter: [physically secure locations] MP-2 Requirement: The service provider defines types of digital and non-digital media. The media types are approved and accepted by the JAB.

Requirement: The service provider defines a list of individuals with authorized access to defined media types. The list of authorized individuals is approved and accepted by the JAB.

Requirement: The service provider defines the types of security measures to be used in protecting defined media types. The security measures are approved and accepted by the JAB.

MP-3 Media Marking MP-3 MP-3b.

[Assignment: organization-defined list of removable media types] Parameter: [specific types of media or hardware components]

[Assignment: organization-defined types of digital and non-digital media] Parameter: [sensitive media including but not limited to diskettes, magnetic tapes, external/removable hard drives, flash/thumb drives, compact disks, digital video disks and non-digital media including but not limited to paper, microfilm] [Assignment: organization-defined controlled areas] Parameter: [Defined by DOL].

[Assignment: organization-defined security measures] Parameter: [physically secure locations] MP-4a.

Requirement: The service provider defines controlled areas within facilities where the information and information system reside.

MP-5 Media Transport MP-5

MP-5 (2)

MP-5 (4) MP-5a.

[Assignment: organization-defined types of digital and non-digital media] Parameter: [information system media (both paper and digital)] [Assignment: organization-defined security measures] Parameter: [hand delivery and restrict the activities associated with transport of such media to authorized personnel] MP-5a.

Requirement: The service provider defines security measures to protect digital and non-digital media in transport. The security measures are approved and accepted by the JAB.

[Assignment: organization-defined frequency] Parameter: [at least annually] PE-3g.

Requirement: The service provider defines emergency shutoff switch locations. The locations are approved and accepted by the JAB.

PE-13 (1)

PE-13 (2)

[Assignment: organization-defined acceptable levels] Parameter: [acceptable levels] PE-14b.

[Assignment: organization-defined frequency] Parameter: [Defined by DOL] PE-14a.

Requirements: The service provider measures temperature at server inlets and humidity levels by dew point.

Requirement: The service provider defines management, operational, and technical information system security controls for alternate work sites. The security controls are approved and accepted by the JAB.

[Assignment: organization-defined frequency] Parameter: [periodically]

[Assignment: organization-defined transfer or reassignment actions] Parameter: See additional requirements and guidance.

[Assignment: organization-defined time period following the formal transfer action] Parameter: [within five days] PS-5 Requirement: The service provider defines transfer or reassignment actions. Transfer or reassignment actions are approved and accepted by the JAB.

SA-4 (1)

SA-4 (4)

SA-4 (7) None. SA-4 Guidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See http://www.niap-ccevs.org/vpl or http://www.commoncriteriaportal.org/products.html.

SA-5 Information System Documentation SA-5

SA-5 (1)

Requirement: The service provider documents all existing outsourced security services and conducts a risk assessment of future outsourced security services. Future, planned outsourced services are approved and accepted by the JAB.

Requirement: The service provider submits a code analysis report as part of the authorization package and updates the report in any reauthorization actions.

SA-11 (1)

Requirement: The service provider documents in the Continuous Monitoring Plan, how newly developed code for the information system is reviewed.

Requirement: The service provider defines a list of types of denial of service attacks (including but not limited to flooding attacks and software/logic attacks) or provides a reference to source for current list. The list of denial of service attack types is approved and accepted by JAB.

SC-7 Boundary Protection SC-7

SC-7 (1)

SC-7 (2)

SC-7 (3)

SC-7 (4)

SC-7 (5)

SC-7 (7)

SC-7 (8)

SC-7 (12)

SC-7 (13)

SC-7 (18) SC-7 (4) (e) [Assignment: organization-defined frequency] Parameter: [at least once per ATO period or where there is a significant change to the boundary]

SC-7 (8)

[Assignment: organization-defined internal communications traffic] Parameter: [Agency-defined].

[Assignment: organization-defined external networks] Parameter: [Agency-defined].

SC-7 (13)

[Assignment: organization-defined key information security tools, mechanisms, and support components] Parameter: See additional requirements and guidance. Requirement: The service provider and service consumer ensure that federal information (other than unrestricted information) being transmitted from federal government entities to external entities using information systems providing cloud services is inspected by TIC processes.

SC-7 (8)

Requirements: The service provider defines the internal communications traffic to be routed by the information system through authenticated proxy servers and the external networks that are the prospective destination of such traffic routing. The internal communications traffic and external networks are approved and accepted by JAB.

SC-7 (13)

Requirement: The service provider defines key information security tools, mechanisms, and support components associated with system and security administration and isolates those tools, mechanisms, and support components from other internal information system components via physically or logically separate subnets.

Requirement: The service provider must implement a hardened or alarmed carrier Protective Distribution System (PDS) when transmission confidentiality cannot be achieved through cryptographic mechanisms.

Guidance: Long running batch jobs and other operations are not subject to this time limit.

SC-12 Cryptographic Key Establishment and Management SC-12

SC-12 (2)

SC-13 (1)

Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use.

Requirement: The service provider defines the public key infrastructure certificate policy.