FedRAMP_Continuous_Monitoring_Reporting_and_POA M_Template.docx

FedRAMP seeks to standardize continuous monitoring reporting across the FedRAMP program to ensure that Cloud Service Provider (CSP) reporting provides a consistent level of quality government wide. As part of this effort, FedRAMP has released draft guidance and templates to CSPs for public comment.

The “FedRAMP Continuous Monitoring Monthly Reporting Summary Guide” contains information on the definitions and requirements needed to assemble the Continuous Monitoring Monthly Reporting Summary and POA&M deliverables. The monthly reporting summary is derived from the required monthly submission of Plan of Action and Milestones and vulnerability scans. This guide is also intended to replace Appendix B in the “FedRAMP Continuous Monitoring Strategy and Guide.”

FedRAMP seeks industry and expert comment and feedback on this document. The 30 day open public comment starts August 20 and ends September 19. There is no specified format for feedback. Please send any suggestions or changes to Info@FedRAMP.gov.

Continuous Monitoring Monthly Reporting Summary Guide

Version 1.0 August 20, 2014

Executive Summary As the Federal Government transitions to continuous authorization for Federal computer systems, agencies and Cloud Service Providers (CSPs) are challenged to provide continuous monitoring reporting in a format that allows Authorizing Officials (AOs) to identify security risks, and provide a consistent level of quality government wide.

FedRAMP has developed guidance on the FedRAMP Continuous Monitoring Monthly Reporting Summary to assist CSPs in standardizing and submitting their monthly reporting data. Authorizing officials must use this guide to assess CSP Continuous Monitoring data in the Continuous Monitoring Monthly Reporting Summary.

Document Revision History

8/15/2014

Table of Contents

List of Tables

List of Figures

About this document This document provides guidance on the FedRAMP Continuous Monitoring Monthly Reporting Summary in support of maintaining a FedRAMP compliant authorization.

Who should use this document?

This document is intended to be used by Cloud Service Providers (CSPs), Third Party Assessor Organizations (3PAOs), Federal Agencies and other stakeholders interested in the security management of CSPs. This document may also prove useful for other organizations that are developing a continuous monitoring program.

How this document is organized This document is divided into three sections.

How to contact us Questions about FedRAMP or this document may be directed to info@fedramp.gov.

For more information about FedRAMP, visit the website at http://www.fedramp.gov.

Continuous Monitoring Monthly Reporting Summary v1.0 August 20, 2014

FedRAMP Continuous Monitoring Monthly Reporting Summary Overview CSPs must submit a FedRAMP Continuous Monitoring Monthly Reporting Summary along with vulnerability scans, updated Plans of Actions and Milestones (POA&Ms) and updated inventories (upon request) to Authorizing Officials. A summary of these monthly deliverables in the Continuous Monitoring Monthly Reporting Summary must be made available to Authorizing Officials (AOs) who examine the reports to ensure the CSP is maintaining an appropriate risk posture that supports an authorization.

Deliverables summarized in the report are a subset of the evidence required at time of authorization. In this vein, the analysis of these scan results should be performed in the same manner they were at the time of authorization. In particular, this means:

· All scan findings must be documented (including low findings)

· Each unique vulnerability is tracked as an individual POA&M item

· Deviation requests (e.g. risk adjustments, False Positives (FPs), and Operationally Required (ORs) must be submitted for any requested changes to scan findings) Part of any authorization is predicated on a CSP’s ability to continue to implement their security controls effectively and maintain an appropriate risk posture. In order to track this, AOs will review the Continuous Monitoring Monthly Reporting Summary and CSPs should understand that this means their continuous monitoring deliverables and associated view of risk posture leads to a continuous authorization decision every month.

Analysis Of The Continuous Monitoring Monthly Reporting Summary The following section provides details on how AOs should analyze the report and monthly continuous monitoring deliverables.

Notes on the analysis of reporting within continuous monitoring monthly reporting summary:

· Summary information is requested from CSPs in order to provide easier analysis of the continuous monitoring reporting.

· AOs should review the data provided in monthly Continuous Monitoring submissions to verify the risk posture is accurately depicted in the Continuous Monitoring Monthly Reporting Summary.

· AOs review trending data in order to understand the overall effectiveness of a CSP’s continuous monitoring program.

· If an AO needs to review full copies of vulnerability scans, updated POA&Ms and updated inventories, in order to validate information contained in the report, these documents should be made available by the CSP.

Past due POA&M Items Past due POA&M items represent key risks to AOs. This is interpreted as an inability of CSP to meet the FedRAMP requirements and identifies key risks that AOs should be aware of. Also, a repeated history of past due POA&Ms is a key indicator of risk and may also indicate misaligned business processes and operations within a CSP.

Deviation Requests It is normal to have deviation requests related to unique items for each CSP that must also be analyzed. Some specifics on how AOs address these unique items are as follows:

Date Adjustments:

Date adjustments are not treated as deviation requests, as this does not change the fact that a POA&M is past due for remediation if it is not corrected within the required timeframe.

Vendor Dependent Risks:

CSPs frequently buy and incorporate products and services into cloud environments to deliver services. These products and services represent “vendor dependent” risks. These risks are considered “vendor dependent” because remediation of these risks requires action on the part of the product vendor.

· If the vulnerability cannot be remediated within 30 days, vendor dependencies at a high risk level must be mitigated to a moderate impact level by the CSP within 30 days. The CSP can implement compensating and mitigating factors that address the risk associated with the vulnerability. Otherwise, they are considered past due.

· Vendor dependencies require CSPs actively follow up with their product vendors every 30 days (at a minimum) to ensure there are no updates available and track when updates will be available that would remediate the known vulnerabilities. CSPs should be active in working with the vendor to get the vulnerability remediated as quickly as possible.

· If a CSP contacts their vendors as required and provides evidence with their monthly deliverables of this, then a vendor dependency POA&M item is not considered past due.

Operationally Required Vulnerabilities:

Operationally Required (OR) exist only for vulnerabilities where the ability to remediate a vulnerability does not exist or remediating the vulnerability will cause failure of the CSP’s service.

OR at a high risk level must be mitigated to a moderate impact level by implementing and describing compensating and mitigating factors that address the risk associated with the vulnerability. Otherwise, they are considered past due.

False Positive Scan Results:

False Positives are defined as scan results that are erroneously reported by vulnerability scanning tools as a vulnerability but under manual review are determined to not to be a vulnerability.

While scanning report on vulnerabilities, the results are not always accurate. CSPs should make sure to verify scan results to identify false positives.

Approval of Deviation Requests AOs review requests to adjust the risk levels of POA&M items based on the information contained in the deviation requests. During the approval process the requests are provided to the AO for review and approval. Whether or not the item is approved affects the item’s risk level and how the item’s status is tracked in the POA&M table and/or the scanning summary graphs.

POA&M items pending approval for risk adjustment are categorized at the highest risk level applicable for an item. If the item is approved, the risk is adjusted to the approved risk level.

Table 2-1 – Adjusted Risk Level Descriptions FedRAMP Continuous Monitoring Monthly Reporting Summary Template Structure and Completion Instructions The Continuous Monitoring Monthly Reporting Summary template is embedded below. CSPs are required to submit this report to the AO on a monthly basis. The report highlights key considerations for the AO’s review of the CSP’s risk posture. The following section details what is contained within the Continuous Monitoring Monthly Reporting Summary and defines key metrics for each section.

System Status Provides a high level indicator of the overall level of risk for the system stated as “Acceptable,” “Minor Concern” or “Major Concern.” AOs make this determination based on a review of the monthly deliverables and a combination of number of vulnerabilities (especially high impact vulnerabilities), age of vulnerabilities, and information in items of note and considerations.

Overview Provides a brief summary of information related to the determination of the overall risk status determination.

Scanning Summaries The report contains two scanning summary graphs. For both graphs, network and operating system scan results are represented as lines in the graph and database and web application scan results are represented as bar graphs.

Scanner vulnerabilities in these graphs are classified using the scale of High, Moderate or Low risk impact level. Risk adjusted items, such as a vulnerability with an associated POA&M with a pending deviation request are categorized at the highest risk level until approved as detailed in the Plot Line Categorization table below.

· Pending (High/ Moderate) Risk Adjusted Items

· Pending Operationally Required Items N/A

· Pending (Moderate/Low) Risk Adjusted Items

· Pending Operationally Required Items

· High/Moderate Approved Risk Adjusted Items

· Pending Operationally Required Items

· (High/Low Approved) Risk Adjusted Items

· (Moderate/Low) Approved Risk Adjusted Items

Table 3-1 –Plot Line Categorization of Risk Reduced Items

The graph represents total results that have been modified based on approved risk impact level adjustments and removal of approved False Positives and removal of approved Operationally Required findings. The total of network and operating system vulnerabilities are represented as a black line.

The Unique Scanning Summary graph provides a count of each unique vulnerability found in the automated scanning results. Each unique vulnerability identifier (as identified by the scanner) is only counted once.

Figure 3.1 Unique Scanning Summary The Raw Scanning Summary Graph plots the count of all instances of all unique vulnerabilities found in the automated scanning results.

Figure 3.2 Raw Scanning Summary

Open POA&M Summary Reporting for POA&M items in the open POA&M summary report includes the following items:

· The first table contains counts of all open POA&M items by month and year starting with the date of ATO or the latest annual assessment.

· The second table contains counts of all past due POA&M items, based on the number of days from date of discovery (e.g., date of the vulnerability scan report).

· Open POA&Ms items.

· Includes POA&Ms marked for closure until the AO provides final approval for closure.

· Includes POA&M items related to vendor dependencies.

· Risk reduced items require approval. Whether they are approved (Active) or pending (Pending) affects how they are counted in the table. Additional details on the approval and categorization of risk reduced items is included in the Risk Reduced POA&M Items section below.

· POA&M items related to Deviation Requests for Operationally Required (OR) vulnerabilities are listed with two values: the first number represents the number pending approval and the second number represents the number of previously approved (or “active”) items. (See Figure 3.3, Open POA&M Summary Tables).

· POA&M items related to False Positives are listed in the “Pending FP” column. (See Figure 3.3, Open POA&M Summary Tables).

Figure 3.3 Open POA&M Summary Tables

· The impact level presented by POA&M items are categorized by the following key:

Table 3-2 – Risk Level Descriptions Total POA&M Count Table:

Figure 3.4 Total POA&M Count Table

The first POA&M table provides the total POA&M items by month and year. The count is categorized by the risk level in each row. This table also includes columns for False Positives (FP) pending approval, and operational required (OR) POA&M items (first number is the number items pending approval and the second number is the number of approved items). Pending FP and OR counts are included in columns for monthly POA&M counts. Approved FPs and approved ORs are not included in the monthly POA&M counts. Approved FPs are excluded from the table entirely. Guidance on adding approved (active) and pending approval risk adjusted items to the POA&M table is provided in the following section.

Risk Adjusted POA&M Item Counts The table below provides additional guidance on where approved and pending approval risk adjusted items are placed in both POA&M tables. Note that if the Deviation Request is for risk adjustment and FP or risk adjustment and OR, the numbers are placed in the appropriate row defined in Table 3-3 Risk Reduced POA&M Item Counts.

· Pending Operationally Required Items Approved ORs

· Pending False Positive Items

· Pending Operationally Required Items N/A

· Pending Operationally Required Items

· Approved High/Moderate Risk Adjusted Items

· Approved ORs

· Unapproved False Positive Items

· Unapproved Operationally Required Items N/A

· Unapproved False Positive Items

· Unapproved Operationally Required Items N/A

· Unapproved Operationally Required Items

· Approved Risk Adjusted Items (High/Low, Moderate/Low)

· Approved ORs

Table 3-3 –Risk Reduced POA&M Item Count Example of Counts for Approved and Unapproved Items As an example, CSP “A” has the following POA&M items in June 2014:

· 1 High item

· 3 High/Moderate Risk Adjusted Items Pending Approval

· 7 Moderate/Low Risk Adjusted Items Pending Approval

· 4 Moderate Items

· 3 Approved High/Moderate

· 4 Low Items

· 3 Approved Moderate / Low Items

· 3 FP Moderate Pending Approval

· 1 OR High Item Approved

· 2 OR High Items Pending Approval

· 2 Approved OR Moderate Items

· 4 OR Moderate Pending Approval

· 8 Approved OR Low Items

The counts in the Table would be provided as follows:

Table 3-4 –Example Count of Approved and Unapproved Items Based on the table above, here is how each item was categorized in the June 2014 column:

· 3 High Items - (Including 1 High Item and 2 ORs pending approval - Categorized as High in table)

· 3 High/Moderate Risk Adjusted Items Pending Approval - (Categorized as High / Mod in table)

· 14 Moderate Items (Including 4 Moderate Items, 3 approved High/Moderate Items, 3 FP Items pending approval, and 4 OR Items pending approval - Categorized as moderate in table)

· 7 Moderate/Low Risk Adjusted Items Pending Approval (Categorized as Moderate/Low in table)

· 7 Low Items (Including 4 Low Items and 3 approved Moderate/Low Items in table – Categorized as Low in table) Past Due POA&M Summary Table

Figure 3.5 Past Due POA&M Summary Table

The second table lists past due POA&M items.

Note: CSPs are required to use the initial date of discovery of the finding in calculating the age of the open POA&M item.

Past due POA&Ms are defined and listed as follows (based on the initial date of discovery of the finding):

· High items (including High/Mod and High/Low pending risk adjustment requests) that were not remediated by the FedRAMP requirement of 30 days (Listed in black in the table)

· Moderate items (including Mod/Low pending risk adjustment requests) that were not remediated by the FedRAMP requirement of 90 days (Listed in black in the table)

· Items that were not remediated by an earlier deadline set by the CSP (Listed in grey in the table)

· Pending FP items that are past due are included in the count columns and tracked in the Pending FP column.

· Pending OR items that are past due are included in the count columns and tracked in the Pending OR column.

· Approved FP and OR items are not included in the monthly count columns.

· Past due POA&M items include vendor dependencies where the CSP has not provided evidence of contacting the vendor for updates within the last 30 days. If evidence has been provided, vendor dependencies are not considered late and are not included in the monthly count columns.

· FedRAMP defines applicable evidence as an email or screenshot of the ticketing system showing the CSP checking the progress of the vulnerabilities with the vendor. Information about the date and applicable evidence must be included in the POA&M.

Note: When completing this table, there is no need to recolor values as grey or black; just fill in the number and retain the color coding of the template.

Identifying Past Due POA&M Guidance Vulnerability discovery dates must be identified by the CSP in the POA&M to support age calculation. CSPs should calculate the scheduled completion date in the POA&M as less than or equal to the FedRAMP required timeframe for mitigating the risk for the POA&M based on impact level (e.g., 30 days for high items, 90 days for moderate items, CSP determined for low items). CSPs validate that POA&M items are past due by calculating the age of the item based on the initial discovery date and comparing the age to the due date.

Risk adjusted items that are approved should have a timeframe appropriate for that adjusted risk rating.

Continuous Monitoring Monthly Reporting Summary v1.0 August 15, 2014

Past Due POA&M ITem CouNTs The table below provides additional guidance on where past due POA&M items are placed in Past Due POA&M table.

Age of Past Due POA&M Items

· High Pending FP

· High Pending OR

· High Vendor Dependencies without update

· High items

· High Pending FP

· High Pending OR

· High Vendor Dependencies without update

· High items

· High Pending FP

· High Pending OR

· High Vendor Dependencies without update

· High items

· High Pending FP

· High Pending OR

· High Vendor Dependencies without update

· High Pending FP

· High Pending OR

· High/Moderate Pending OR

· High/Moderate Vendor Dependencies without update

· (High /Moderate ) Pending Risk Adjusted Items

· High/Moderate Pending OR

· High/Moderate Vendor Dependencies without update

· (High /Moderate ) Pending Risk Adjusted Items

· High/Moderate Pending OR

· High/Moderate Vendor Dependencies without update

· (High /Moderate ) Pending Risk Adjusted Items

· High/Moderate Pending OR

· High/Moderate Vendor Dependencies without update

· High/Low Pending OR

· High/Low Vendor Dependencies without update

· (High /Low ) Pending Risk Adjusted Items

· High/Low Pending OR

· High/Low Vendor Dependencies without update

· (High /Low ) Pending Risk Adjusted Items

· High/Low Pending OR

· High/Low Vendor Dependencies without update

· (High /Low ) Pending Risk Adjusted Items

· High/Low Pending OR

· High/Low Vendor Dependencies without update

· Moderate Pending FP

· Moderate Pending OR

· Moderate Vendor Dependencies without update

· Moderate items

· Moderate Pending FP

· Moderate Pending OR

· Moderate Vendor Dependencies without update

· Moderate Pending FP

· Moderate Pending OR

· Moderate /Low Pending OR

· Moderate /Low Vendor Dependencies without update

· (Moderate /Low ) Pending Risk Adjusted Items

· Moderate /Low Pending OR

· Moderate /Low Vendor Dependencies without update

· Low Pending OR

Table 3-5 –Past Due POA&M Item Count

Example of Counts for Past Due POA&M Items CSP “A” has the following past due POA&M items in June 2014:

· 1 High item – 41 Days Old

· 3 High/Moderate Risk Adjusted Items Pending Approval – 98 Days Old

· 7 Moderate/Low Risk Adjusted Items Pending Approval – 110 Days Old

· 2 Moderate Items that Are Vendor Dependencies that do not have evidence of vendor status contact within the last 30 days – 115 Days Old

· 2 Moderate Items pending remediation with an early 21 day deadline set by the CSP – 29 Days Old

· 4 Low Items with an 120 day deadline set by the CSP – 135 Days Old

· 3 FP Moderate Pending Approval – 125 Days Old

· 2 OR High Items Pending Approval – 36 Days Old

· 4 OR Moderate Pending Approval – 93 Days Old

POA&M Age for Past Due Items

Table 3-6 –Example Count of Past Due Items Based on the table above, here is how each item was categorized:

· 3 Past Due High Items - (Including 1 High Item (41 Days Old) and 2 ORs Pending Approval (36 Days Old))

· 3 Past Due High/Moderate Risk Adjusted Items Pending Approval - (98 Days Old)

· 11 Past Due Moderate Items (Including 2 Moderate Items with an early due date set by the CSP (29 Days Old), 4 OR Moderate Pending Approval (93 days Old), 2 Moderate Vendor Dependencies (115 Days Old), 3 FP Moderate Pending Approval (125 Days Old))

· 7 Past Due Moderate/Low Risk Adjusted Items Pending Approval (110 Days Old)

· 4 Low Items (135 Days Old) Items of Note Provides additional information on clarifying results and/or provides additional information related to continuous monitoring results identified in the report.

Considerations for Review Provides a summary of the additional continuous monitoring information, such as information about deviation requests, annual assessment schedules, planned system changes, and any additional information about irregularities identified during continuous monitoring.

Additional Information Provides a summary of any items that the AO should be aware of in terms of systems leveraging the CSP, new services, and/or other general information related to the CSP’s risk posture and services.

FedRAMP Plan of action and milestones (POA&M) template The FedRAMP POA&M template is embedded below. CSPs are required to submit this report to the AO on a monthly basis. The report highlights the POA&Ms for each vulnerability of the system for the AO’s review of the CSP’s risk posture.

image1.jpeg image2.jpeg image3.jpeg image4.jpeg image5.png image6.emf

ConMon Monthly Reporting Summary 08152014.doc FOUO – For Official Use Only

Risk Level

ATO Sep 2013

Dec 2013

Mar 2014

Jun 2014

Sep 2014

Dec 2014

Pending FP

OR (Pending / Active)

High

0/0

High / Mod

0/0

High / Low

0/0

Moderate

0/0

Mod / Low

0/0

Low

0/0

Total

0/0

Cloud Service Provider

FedRAMP ConMon Monthly Reporting Summary– Month xx, 20xx

Overview (Selection

System Status (Select One): Acceptable / Minor Concern / Major Concern

[Summary of Continuous Monitoring results for vendor]

Open POA&M Summary

Unique Scanning Summary*

*Data is risk adjusted for approved deviations.

[Clarifiers for reviews]

[Considerations for trends]

Additional Information

[Things the Authorizing Official’s (AO) team should be aware of regarding vendor, expected changes upcoming, new services, etc.]

Past Due POA&M Summary

Raw Scanning Summary*

*Data is risk adjusted for approved deviations.

POA&M Age for

Past Due Items�

0-30�

31-60�

61-90�

91-120�

121+�

Past Due Total�

Pending FP�

Pending OR�

High�

0�

0�

0�

0�

0�

0�

0�

0�

High / Mod�

0�

0�

0�

0�

0�

0�

0�

0�

High / Low�

0�

0�

0�

0�

0�

0�

0�

0�

Moderate�

0�

0�

0�

0�

0�

0�

0�

0�

Mod / Low�

0�

0�

0�

0�

0�

0�

0�

0�

Low�

0�

0�

0�

0�

0�

0�

0�

0�

Considerations for Review

Items of Note

[Deviation requests summary]

[Any irregularities in deliverables]

FOUO – For Official Use Only image7.jpeg image8.jpeg image9.jpeg image10.jpeg image11.jpeg image12.emf

FedRAMP POA&M Templates.xlsx POAM Template

FedRAMP POA&M Template

CSP System Name Impact Level POAM Date text text Low,Moderate,High xxxx-xx-xx

POAM ID Controls Weakness Name Weakness Description Original Source Detector Original Source Identifier Asset Identifier Point of Contact Overall Remediation Plan Original Detection Date Scheduled Completion Date Planned Milestones Milestone Changes Latest Status Status Date Vendor Dependency Last Vendor Check-in Date Deviation Request ID Original Risk Rating Adjusted Risk Rating Risk Adjustment Risk Adjustment Rationale False Positive Operational Requirement Comments

This is a unique string associated with the asset, it could just be ip, if desired, or any arbitrary naming scheme This Field should include complete IP, DNS name with port and protocol, or URL (no short hand)

(Milestone Number) [Type of update] [milestone date] : How and why the date changed, or the milestone was altered

1 AC-1 Example 1 Not all Access Control procedures listed in the SSP show evidence of having been reviewed or updated within the last two years. (AC-1) Nessus 12345 172.246.15.3 (80/tcp) http://vuln.gov/queries

172.246.16.17 (80/tcp) John Doe - CSP Vendor X Implement a technical solution to the problem. 2/12/14 7/2/14 (1) 2014-05-23: Milestone Description

(2) 2014-06-12: Milestone Description (2) Update 2014-06-18 : That milestone was delayed due to a Vendor Dependancy

Closed Poam Items

POAM ID Controls Weakness Name Weakness Description Original Source Detector Original Source Identifier Asset Identifier Point of Contact Overall Remediation Plan Original Detection Date Scheduled Completion Date Planned Milestones Milestone Changes Latest Status Status Date Vendor Dependency Last Vendor Check-in Date Deviation Request ID Original Risk Rating Adjusted Risk Rating Risk Adjustment Risk Adjustment Rationale False Positive Operational Requirement Comments

Inventory Template

Unique Asset Identifier IPv4 IPv6 DNS Name Netbios Name Mac Address Asset Weight Authenticated Scan Baseline Configuration Name OS Name OS Version Location Asset Type Virtual Public In Latest Scan Comments any unique string associated with the asset This is to be used in the POAM

123.45.78.90 123.45.78.90 asset.gsa.gov asset.gsa.gov fe:2a:d7:e3:84 5 yes Centos Server CentOS 5.1 Washington DC Server no yes no Decommissioned