CSP Name | Information System Name Version #.#, YYYYMMDD

Template

StateRAMP System Security Plan (SSP) Service Provider Name Information System Name

VERSION:

X.X

DATE:

YYYYMMDD

This template contains a number of features to facilitate data entry. As you go through the template entering data, you will see prompts for you to enter different types of data.

Repeatable Field Some multiple-occurring data fields have been linked together and you need only enter the data once. Enter the data once; then click outside the data entry field and all occurrences of that field will be populated. For example, when you see “Information System Abbreviation” and replace it with your system abbreviation, all instances of the abbreviation throughout the document will be replaced with the value you entered. This document contains the following repeatable fields:

If you find a data field from the above list that has not populated, then press the F9 key to refresh the data. If you make a change to one of the above data fields, you may also have to press the F9 key to refresh the data throughout the document. Remember to save the document after refreshes. The one exception to the repeatable fields is information system names for StateRAMP or leveraged authorizations that are identified as “Leveraged information system name:

Date Selection Data fields that must contain a date will present a date selection menu.

Item Choice Data fields that have a limited number of value choices will present a selection list.

Number Entry Data fields that must have numeric values display “number.”

Text Entry Many data fields, particularly in tables, that can contain any text display “Enter text” or “Click here to enter text.”

Delete this instruction from your final version of this document.

SYSTEM SECURITY PLAN

Prepared by:

Identification of Organization that Prepared this Document

Prepared for:

Identification of Cloud Service Provider

Template Revision History

3/31/2021 Original publication

Document Revision History

How to contact us For questions about StateRAMP, or for technical questions about this document including how to use it, contact pmo@StateRAMP.org. For more information about the StateRAMP project, see www.StateRAMP.org.

TABLE OF CONTENTS

List of Figures

List of Tables

System Security Plan Approvals Cloud Service Provider Signatures

Information System Name/Title This System Security Plan provides an overview of the security requirements for the Information System Name <Enter Information System Abbreviation> and describes the controls in place or planned for implementation to provide a level of security appropriate for the information to be transmitted, processed, or stored by the system. Information security is vital to our critical infrastructure and its effective performance and protection is a key component of our national security program. Proper management of information technology systems is essential to ensure the confidentiality, integrity and availability of the data transmitted, processed, or stored by the <Enter Information System Abbreviation> information system.

The security safeguards implemented for the <Enter Information System Abbreviation> system meet the policy and control requirements set forth in this System Security Plan. All systems are subject to monitoring consistent with applicable laws, regulations, agency policies, procedures, and practices.

Table 1. Information System Name and Title

Information System Categorization The overall information system sensitivity categorization is recorded in Table 2 Security Categorization that follows.

Table 2. Security Categorization

Information Types Category 1 The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.

A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals.

Category 3 The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

Security Objectives Categorization For the <Enter Information System Abbreviation>, default to the high-water mark for the Information Types as identified in Table 3 Security Impact Level below.

Table 3. Security Impact Level

Through review and analysis, it has been determined that the baseline security categorization for the Enter Information System Abbreviation system is listed in the Table 4 Baseline Security Configuration that follows.

Table 4. Baseline Security Configuration

Using this categorization, in conjunction with the risk assessment and any unique security requirements, we have established the security controls for this system, as detailed in this SSP.

Digital Identity Determination The digital identity information may be found in Section 15 – Digital Identity Worksheet Note: NIST SP 800-63-3, Digital Identity Guidelines, does not recognize the four Levels of Assurance model previously used by federal agencies and described in OMB M-04-04, instead requiring agencies to individually select levels corresponding to each function being performed. The digital identity level is Choose an item.

Information System Owner The following individual is identified as the system owner or functional proponent/advocate for this system.

Table 5. Information System Owner Information System Owner Information

Authorizing Official Instruction: The Authorizing Official is determined by the path that the CSP is using to obtain an authorization.

JAB P-ATO: StateRAMP, JAB, as comprised of member representatives from the General Services Administration (GSA), Department of Defense (DoD) and Department of Homeland Security (DHS). Agency Authority to Operate (ATO): Agency Authorizing Official name, title and contact information. Delete this and all other instructions from your final version of this document.

The Authorizing Official (AO) for this information system is the <Insert AO information as instructed above>.

Other Designated Contacts Instruction: AOs should use the following section to identify points of contact that understand the technical implementations of the identified cloud system. AOs should edit, add, or modify the contacts in this section as they see fit.

Delete this and all other instructions from your final version of this document.

The following individual(s) identified below possess in-depth knowledge of this system and/or its functions and operation.

Table 6. Information System Management Point of Contact Information System Management Point of Contact

Table 7. Information System Technical Point of Contact Information System Technical Point of Contact

Instruction: Add more tables as needed. Delete this and all other instructions from your final version of this document.

Point of Contact

Assignment of Security Responsibility The Information System Security Officers (ISSO), or their equivalent, identified below, have been appointed in writing and are deemed to have significant cyber and operational role responsibilities.

Table 8. CSP Name Internal ISSO (or Equivalent) Point of Contact CSP Name Internal ISSO (or Equivalent) Point of Contact

Table 9. AO Point of Contact AO Point of Contact

Information System Operational Status The system is currently in the lifecycle phase shown in Table 10 System Status that follows. (Only operational systems can be granted an ATO).

Table 10. System Status System Status

Instruction: Select as many status indicators as apply. If more than one status is selected, list which components of the system are covered under each status indicator.

Delete this and all other instructions from your final version of this document.

Information System Type The <Enter Information System Abbreviation> makes use of unique managed service provider architecture layer(s).

Cloud Service Models Information systems, particularly those based on cloud architecture models, are made up of different service layers. Below are some questions that help the system owner determine if their system is a cloud followed by specific questions to help the system owner determine the type of cloud.

The layers of the <Enter Information System Abbreviation> defined in this SSP are indicated in Table 11 Service Layers Represented in this SSP that follows.

Instruction: Check all layers that apply. Delete this and all other instructions from your final version of this document.

Table 11. Service Layers Represented in this SSP Service Provider Architecture Layers

Note: Refer to NIST SP 800-145 for information on cloud computing architecture models.

Cloud Deployment Models Information systems are made up of different deployment models. The deployment models of the <Enter Information System Abbreviation> that are defined in this SSP and are not leveraged by any other StateRAMP Authorizations, are indicated in Table 12 Cloud Deployment Model Represented in this SSP that follows.

Instruction: Check deployment model that applies. Delete this and all other instructions from your final version of this document.

Table 12. Cloud Deployment Model Represented in this SSP Service Provider Cloud Deployment Model

Click here to enter text.

Leveraged Authorizations Instruction: The StateRAMP program qualifies different service layers for Authorizations. One or multiple service layers can be qualified in one System Security Plan. If a lower level layer has been granted an Authorization and another higher-level layer represented by this SSP plans to leverage a lower layer’s Authorization, this System Security Plan must clearly state that intention.

If an information system does not leverage any pre-existing Authorizations, write “None” in the first column of the table that follows. Add as many rows as necessary in the table that follows. Delete this and all other instructions from your final version of this document.

The <Enter Information System Abbreviation> Choose an item leverages a pre-existing StateRAMP Authorization. StateRAMP Authorizations leveraged by this <Enter Information System Abbreviation> are listed in Table 13 Leveraged Authorizations that follows.

Table 13. Leveraged Authorizations

General System Description This section includes a general description of the Enter Information System Abbreviation.

System Function or Purpose Instruction: In the space that follows, describe the purpose and functions of this system. Delete this and all other instructions from your final version of this document.

Information System Components and Boundaries Instruction: In the space that follows, provide an explicit definition of the system’s Authorization Boundary. Provide a diagram that portrays this Authorization Boundary and all its connections and components, including the means for monitoring and controlling communications at the external boundary and at key internal boundaries within the system. Address all components and managed interfaces of the information system authorized for operation (e.g., routers, firewalls).

The diagram must include a predominant border drawn around all system components and services included in the authorization boundary. The diagram must be easy to read and understand.

Formal names of components as they are known at the service provider organization in functional specifications, configuration guides, other documents and live configurations shall be named on the diagram and described. Components identified in the Boundary diagram should be consistent with the Network diagram and the inventory(ies). Provide a key to symbols used. Ensure consistency between the boundary and network diagrams and respective descriptions (Section 9.2) and the appropriate Security Controls [AC-20, CA-3(1)].

A detailed and explicit definition of the system authorization boundary diagram is represented in Figure 9‑2 Authorization Boundary Diagram below.

Figure 9‑2 Authorization Boundary Diagram

Types of Users All personnel have their status categorized with a sensitivity level in accordance with PS-2. Personnel (employees or contractors) of service providers are considered Internal Users. All other users are considered External Users. User privileges (authorization permission after authentication takes place) are described in Table 14 Personnel Roles and Privileges that follows.

Instruction: For an External User, write “Not Applicable” in the Sensitivity Level Column. This table must include all roles including systems administrators and database administrators as a role types. (Also include web server administrators, network administrators and firewall administrators if these individuals have the ability to configure a device or host that could impact the CSP service offering.)

This table must also include whether these roles are fulfilled by foreign nationals or systems outside the United States. Delete this and all other instructions from your final version of this document.

Table 14. Personnel Roles and Privileges

Choose an item. Choose an item. Choose an item.

Choose an item. Choose an item. Choose an item.

Choose an item. Choose an item. Choose an item.

Choose an item. Choose an item. Choose an item.

There are currently <number> internal personnel and <number> external personnel. Within one year, it is anticipated that there will be <number> internal personnel and <number> external personnel.

Network Architecture Instruction: Insert a network architectural diagram in the space that follows. Ensure that the following items are labeled on the diagram: hostnames, Domain Name System (DNS) servers, DHCP servers, authentication and access control servers, directory servers, firewalls, routers, switches, database servers, major applications, storage, Internet connectivity providers, telecom circuit numbers, network interfaces and numbers, VLANs. Major security components should be represented. If necessary, include multiple network diagrams.

Assessors should be able to easily map hardware, software, and network inventories back to this diagram. The logical network topology is shown in Figure 9‑2 Network Diagram mapping the data flow between components. The following Figure 9‑2 Network Diagram(s) provides a visual depiction of the system network components that constitute Enter Information System Abbreviation.

Figure 9‑2 Network Diagram

Data Flow Instruction: In the space that follows, describe the flow of data in and out of system boundaries and insert a data flow diagram. Describe protections implemented at all entry and exit points in the data flow as well as internal controls between customer and project users. Include data flows for privileged and non-privileged authentication/authorization to the system for internal and external users. If necessary, include multiple data flow diagrams.

The data flow in and out of the system boundaries is represented in Figure 10‑1 Data Flow Diagram below.

Figure 10‑1 Data Flow Diagram Ports, Protocols and Services Table 15 Ports, Protocols, and Services below lists the ports, protocols and services enabled in this information system.

Instruction: In the column labeled “Used By” please indicate the components of the information system that make use of the ports, protocols, and services. In the column labeled “Purpose” indicate the purpose for the service (e.g., system logging, HTTP redirector, load balancing). This table should be consistent with CM-6 and CM-7. You must fill out this table, even if you are leveraging a pre-existing StateRAMP Authorization. Add more rows as needed.

Delete this and all other instructions from your final version of this document.

Table 15 Ports, Protocols, and Services

* Transmission Control Protocol (TCP), User Diagram Protocol (UDP)

CSP Name | Information System Name Version #.#, YYYYMMDD CSP Name | Information System Name Version #.#, YYYYMMDD

System Interconnections Instruction: List all interconnected systems. Provide the IP address and interface identifier (eth0, eth1, eth2) for the CSP system that provides the connection. Name the external organization and the IP address of the external system. Provide a point of contact and phone number for the external organization.

For Connection Security indicate how the connection is being secured. For Data Direction, indicate which direction the packets are flowing. For Information Being Transmitted, describe what type of data is being transmitted. If a dedicated telecom line is used, indicate the circuit number. Add additional rows as needed.

Table 16. System Interconnections

(incoming, outgoing, or both)

<SP IP Address/Interface> <External Org/IP> <External Org POC> <Phone 555-555-5555>

<Phone 555-555-5555>

<Phone 555-555-5555>

<Phone 555-555-5555>

<Phone 555-555-5555>

<Phone 555-555-5555> <Enter Connection Security> Choose an item. <Information Transmitted> <Port/Circuit Numbers>

*Service Processor **Internet Protocol Security (IPSec), Virtual Private Network (VPN), Secure Sockets Layer (SSL)

CSP Name | Information System Name

Minimum Security Controls Security controls must meet minimum security control baseline requirements. Upon categorizing a system as Category 1,2, or 3 the corresponding security control baseline standards apply. Some of the control baselines have enhanced controls which are indicated in parentheses.

Security controls that are representative of the sensitivity of <Enter Information System Abbreviation> are described in the sections that follow. Security controls that are designated as “Not Selected” or “Withdrawn by NIST” are not described unless they have additional StateRAMP controls. Guidance on how to describe the implemented standard can be found in NIST 800-53, Rev 4. Control enhancements are marked in parentheses in the sensitivity columns.

A summary of which security standards pertain to which sensitivity level is found in Table 17 Summary of Required Security Controls that follows.

Table 17. Summary of Required Security Controls

AC

AT

AU

CA

CM

CP

IA

IR

MA

MP

PE

PL

PS

RA

SA

SC

SI

The definitions in Table 18 Control Origination and Definitions indicate where each security control originates.

Table 18. Control Origination and Definitions

SYSTEM SECURITY PLAN ATTACHMENTS

Instruction: Attach any documents that are referred to in the Information System Name (Enter Information System Abbreviation) System Security Plan. Documents and attachments should, provide the title, version, and exact file name, including the file extension. All attachments and associated documents must be delivered separately. No embedded documents will be accepted.

Delete this and all other instructions from your final version of this document.

Attachments A recommended attachment file naming convention is <information system abbreviation> <attachment identifier> <document abbreviation> <version number> (for example, "Information System Abbreviation A8 IRP v1.0"). Use this convention to generate names for the attachments. Enter the appropriate file names and file extensions in Table 19 to describe the attachments provided. Make only the following additions/changes to Table 19:

· The first item, Information Security Policies and Procedures (ISPP) may be fulfilled by multiple documents. If that is the case, add lines to Table 19. Attachment File Naming Convention to differentiate between them using the “xx” portion of the File Name. Enter Information System Abbreviation A1 ISPP xx v1.0. Delete the “xx” if there is only one document.

· Enter the file extension for each attachment.

· Do not change the Version Number in the File Name in Table 19. Names of Provided Attachments. (Information System Abbreviation, attachment number, document abbreviation, version number) Table 19. Names of Provided Attachments

SSP Operations Matrix (Includes Control Implementations, CIS Matrix, Inventory Workbook, Laws & Regulations)

CSP Name | Information System Name

Digital Identity Worksheet This Attachment Section has been revised to include the Digital Identity template. Therefore, a separate attachment is not needed. Delete this note and all other instructions from your final version of this document.

The Digital Identity section explains the objective for selecting the appropriate Digital Identity levels for the candidate system. Guidance on selecting the system authentication technology solution is available in NIST SP 800-63, Revision 3, Digital Identity Guidelines.

Introduction and Purpose This document provides guidance on digital identity services (Digital Identity, which is the process of establishing confidence in user identities electronically presented to an information system). Authentication focuses on the identity proofing process (IAL), the authentication process (AAL), and the assertion protocol used in a federated environment to communicate authentication and attribute information (if applicable) (FAL).

NIST SP 800-63-3, Digital Identity Guidelines, does not recognize the four Levels of Assurance model previously used by federal agencies and described in OMB M-04-04, instead requiring agencies to individually select levels corresponding to each function being performed. NIST SP 800-63-3 can be found at the following URL: NIST SP 800-63-3.

Information system name/title This Digital Identity Plan provides an overview of the security requirements for the <Information System Name> <Enter Information System Abbreviation> in accordance with NIST SP 800-63-3.

Table 20. Information System Name and Title

Digital Identity Level Definitions NIST SP 800-63-3 defines three levels in each of the components of identity assurance to categorize a federal information system’s Digital Identity posture. NIST SP 800-63-3 defines Digital Identity levels below. StateRAMP maps its system categorization levels to NIST 800-63-3’s levels as shown in Table 21.

· IAL – refers to the identity proofing process.

· AAL – refers to the authentication process.

· FAL – refers to the strength of an assertion in a federated environment, used to communicate authentication and attribute information (if applicable) to a relying party (RP).

Table 21. Mapping StateRAMP Levels to NIST SP 800-63-3 Levels

Selecting the appropriate Digital Identity level for a system enables the system owner to determine the right system authentication technology solution for the selected Digital Identity levels. Guidance on selecting the system authentication technology solution is available in NIST SP 800-63-3.

Review Maximum Potential Impact Levels <CSP Name> has assessed the potential risk from Digital Identity errors, or Digital Identity misuse, related to a user’s asserted identity. <CSP Name> has taken into consideration the potential for harm (impact) and the likelihood of the occurrence of the harm and has identified an impact profile as found in Table 22 Potential Impacts for Assurance Levels.

Assurance is defined as 1) the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued.

Table 22. Potential Impacts for Assurance Levels

Assurance Level Impact Profile

Digital Identity Level Selection Instruction: Select the lowest level that will cover all potential impact identified from Table 22 Potential Impacts for Assurance Levels.

Delete this instruction from your final version of this document.

The <CSP Name> has identified that they support the Digital Identity Level that has been selected for the <Information System Name> as noted in Table 23 Digital Identity Level. The selected Digital Identity Level indicated is supported for federal agency consumers of the cloud service offering. Implementation details of the Digital Identity mechanisms are provided in the System Security Plan under control IA-2.

Table 23. Digital Identity Level

Other

PTA and PIA This Attachment Section has been revised to include the PTA Template. Therefore, a separate PTA/PIA attachment is not needed. If any of the answers to Question 1-4 are “Yes” then complete the Privacy Impact Assessment.

Delete this note and all other instructions from your final version of this document.

All Authorization Packages must include a Privacy Threshold Analysis (PTA) and if necessary, the Privacy Impact Assessment (PIA) attachment, which will be reviewed for quality. The PTA is included in this section, and the PIA Template can be found on the StateRAMP website. The PTA and PIA Template includes a summary of laws, regulations and guidance related to privacy issues.

Privacy Overview and Point of Contact (POC) The Table 24 Information System Name; Privacy POC individual is identified as the Information System Name; Privacy Officer and POC for privacy at CSP Name.

Table 24. Information System Name; Privacy POC

Personally Identifiable Information (PII) Personally Identifiable Information (PII) as defined in OMB Memorandum M-07-16 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. Information that could be tied to more than one person (date of birth) is not considered PII unless it is made available with other types of information that together could render both values as PII (for example, date of birth and street address). A non-exhaustive list of examples of types of PII includes:

· Social Security numbers

· Passport numbers

· Driver’s license numbers

· Biometric information

· DNA information

· Bank account numbers

· Voice recordings PII refers to information that can be traced back to an individual person.

Privacy Designation Service providers perform an annual analysis to determine if PII is collected by any of the system components. Clouds that do not collect PII and would like to opt-out of hosting privacy information may elect to do so and are not required to fill out the Privacy Impact Assessment Questions. If a CSP is willing to host PII, the Privacy Impact Assessment Questions should be answered given the current knowledge of the CSP. A CSP is not required to solicit customers for the information.

Cloud customers (data owner/system owners) are required to perform their own Privacy Impact Assessments and may share this information with the CSP if they so desire (for informational purposes and/or to work with the CSP to develop processes and procedures for managing their PII).

Threshold Analysis Check one.

☐ Opt-out. This cloud will not host privacy information.

☐ This cloud is willing to host privacy information.

Select the cloud layers that are represented by <System Name>. Select all that apply.

☐ This cloud includes Software as a Service (SaaS).

☐ This cloud includes Platform as a Service (PaaS).

☐ This cloud includes Infrastructure as a Service (IaaS).

Privacy Impact Assessment Talking Points According to NIST SP 800-122, Appendix D, there must be no personal data…