FRC-CSF-BSL FedRAMP Rev5 Baselines – Class B

Providers seeking FedRAMP Rev5 Class B Certification MUST include at least the following NIST SP 800-53 Rev. 5 controls in their Security Decision Record:

NIST SP 800-53 Rev. 5 controls (155)

• AC: AC-01, AC-02, AC-03, AC-07, AC-08, AC-14, AC-17, AC-18, AC-19, AC-20, AC-22
• AT: AT-01, AT-02, AT-02 (02), AT-03, AT-04
• AU: AU-01, AU-02, AU-03, AU-04, AU-05, AU-06, AU-08, AU-09, AU-11, AU-12
• CA: CA-01, CA-02, CA-02 (01), CA-03, CA-06, CA-07, CA-07 (04), CA-08, CA-09
• CM: CM-01, CM-02, CM-04, CM-05, CM-06, CM-07, CM-08, CM-10, CM-11
• CP: CP-01, CP-02, CP-03, CP-04, CP-09, CP-10
• IA: IA-01, IA-02, IA-02 (01), IA-02 (02), IA-02 (08), IA-02 (12), IA-04, IA-05, IA-05 (01), IA-06, IA-07, IA-08, IA-08 (01), IA-08 (02), IA-08 (04), IA-11
• IR: IR-01, IR-02, IR-04, IR-05, IR-06, IR-07, IR-08
• MA: MA-01, MA-02, MA-04, MA-05
• MP: MP-01, MP-02, MP-06, MP-07
• PE: PE-01, PE-02, PE-03, PE-06, PE-08, PE-12, PE-13, PE-14, PE-15, PE-16
• PL: PL-01, PL-02, PL-04, PL-04 (01), PL-08, PL-10, PL-11
• PS: PS-01, PS-02, PS-03, PS-04, PS-05, PS-06, PS-07, PS-08, PS-09
• RA: RA-01, RA-02, RA-03, RA-03 (01), RA-05, RA-05 (02), RA-05 (11), RA-07
• SA: SA-01, SA-02, SA-03, SA-04, SA-04 (10), SA-05, SA-08, SA-09, SA-22
• SC: SC-01, SC-05, SC-07, SC-08, SC-08 (01), SC-12, SC-13, SC-15, SC-20, SC-21, SC-22, SC-28, SC-28 (01), SC-39
• SI: SI-01, SI-02, SI-03, SI-04, SI-05, SI-12
• SR: SR-01, SR-02, SR-02 (01), SR-03, SR-05, SR-08, SR-10, SR-11, SR-11 (01), SR-11 (02), SR-12

1. Přehled

1.1 Odkazy

• AC-01 Policy and Procedures
• AC-02 Account Management
• AC-03 Access Enforcement
• AC-07 Unsuccessful Logon Attempts
• AC-08 System Use Notification
• AC-14 Permitted Actions Without Identification or Authentication
• AC-17 Remote Access
• AC-18 Wireless Access
• AC-19 Access Control for Mobile Devices
• AC-20 Use of External Systems
• AC-22 Publicly Accessible Content
• AT-01 Policy and Procedures
• AT-02 Literacy Training and Awareness
• AT-02(02) Insider Threat
• AT-03 Role-based Training
• AT-04 Training Records
• AU-01 Policy and Procedures
• AU-02 Event Logging
• AU-03 Content of Audit Records
• AU-04 Audit Log Storage Capacity
• AU-05 Response to Audit Logging Process Failures
• AU-06 Audit Record Review, Analysis, and Reporting
• AU-08 Time Stamps
• AU-09 Protection of Audit Information
• AU-11 Audit Record Retention
• AU-12 Audit Record Generation
• CA-01 Policy and Procedures
• CA-02 Control Assessments
• CA-02(01) Independent Assessors
• CA-03 Information Exchange
• CA-06 Authorization
• CA-07 Continuous Monitoring
• CA-07(04) Risk Monitoring
• CA-08 Penetration Testing
• CA-09 Internal System Connections
• CM-01 Policy and Procedures
• CM-02 Baseline Configuration
• CM-04 Impact Analyses
• CM-05 Access Restrictions for Change
• CM-06 Configuration Settings
• CM-07 Least Functionality
• CM-08 System Component Inventory
• CM-10 Software Usage Restrictions
• CM-11 User-installed Software
• CP-01 Policy and Procedures
• CP-02 Contingency Plan
• CP-03 Contingency Training
• CP-04 Contingency Plan Testing
• CP-09 System Backup
• CP-10 System Recovery and Reconstitution
• IA-01 Policy and Procedures
• IA-02 Identification and Authentication (Organizational Users)
• IA-02(01) Multi-factor Authentication to Privileged Accounts
• IA-02(02) Multi-factor Authentication to Non-privileged Accounts
• IA-02(08) Access to Accounts — Replay Resistant
• IA-02(12) Acceptance of PIV Credentials
• IA-04 Identifier Management
• IA-05 Authenticator Management
• IA-05(01) Password-based Authentication
• IA-06 Authentication Feedback
• IA-07 Cryptographic Module Authentication
• IA-08 Identification and Authentication (Non-organizational Users)
• IA-08(01) Acceptance of PIV Credentials from Other Agencies
• IA-08(02) Acceptance of External Authenticators
• IA-08(04) Use of Defined Profiles
• IA-11 Re-authentication
• IR-01 Policy and Procedures
• IR-02 Incident Response Training
• IR-04 Incident Handling
• IR-05 Incident Monitoring
• IR-06 Incident Reporting
• IR-07 Incident Response Assistance
• IR-08 Incident Response Plan
• MA-01 Policy and Procedures
• MA-02 Controlled Maintenance
• MA-04 Nonlocal Maintenance
• MA-05 Maintenance Personnel
• MP-01 Policy and Procedures
• MP-02 Media Access
• MP-06 Media Sanitization
• MP-07 Media Use
• PE-01 Policy and Procedures
• PE-02 Physical Access Authorizations
• PE-03 Physical Access Control
• PE-06 Monitoring Physical Access
• PE-08 Visitor Access Records
• PE-12 Emergency Lighting
• PE-13 Fire Protection
• PE-14 Environmental Controls
• PE-15 Water Damage Protection
• PE-16 Delivery and Removal
• PL-01 Policy and Procedures
• PL-02 System Security and Privacy Plans
• PL-04 Rules of Behavior
• PL-04(01) Social Media and External Site/Application Usage Restrictions
• PL-08 Security and Privacy Architectures
• PL-10 Baseline Selection
• PL-11 Baseline Tailoring
• PS-01 Policy and Procedures
• PS-02 Position Risk Designation
• PS-03 Personnel Screening
• PS-04 Personnel Termination
• PS-05 Personnel Transfer
• PS-06 Access Agreements
• PS-07 External Personnel Security
• PS-08 Personnel Sanctions
• PS-09 Position Descriptions
• RA-01 Policy and Procedures
• RA-02 Security Categorization
• RA-03 Risk Assessment
• RA-03(01) Supply Chain Risk Assessment
• RA-05 Vulnerability Monitoring and Scanning
• RA-05(02) Update Vulnerabilities to Be Scanned
• RA-05(11) Public Disclosure Program
• RA-07 Risk Response
• SA-01 Policy and Procedures
• SA-02 Allocation of Resources
• SA-03 System Development Life Cycle
• SA-04 Acquisition Process
• SA-04(10) Use of Approved PIV Products
• SA-05 System Documentation
• SA-08 Security and Privacy Engineering Principles
• SA-09 External System Services
• SA-22 Unsupported System Components
• SC-01 Policy and Procedures
• SC-05 Denial-of-service Protection
• SC-07 Boundary Protection
• SC-08 Transmission Confidentiality and Integrity
• SC-08(01) Cryptographic Protection
• SC-12 Cryptographic Key Establishment and Management
• SC-13 Cryptographic Protection
• SC-15 Collaborative Computing Devices and Applications
• SC-20 Secure Name/Address Resolution Service (Authoritative Source)
• SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
• SC-22 Architecture and Provisioning for Name/Address Resolution Service
• SC-28 Protection of Information at Rest
• SC-28(01) Cryptographic Protection
• SC-39 Process Isolation
• SI-01 Policy and Procedures
• SI-02 Flaw Remediation
• SI-03 Malicious Code Protection
• SI-04 System Monitoring
• SI-05 Security Alerts, Advisories, and Directives
• SI-12 Information Management and Retention
• SR-01 Policy and Procedures
• SR-02 Supply Chain Risk Management Plan
• SR-02(01) Establish SCRM Team
• SR-03 Supply Chain Controls and Processes
• SR-05 Acquisition Strategies, Tools, and Methods
• SR-08 Notification Agreements
• SR-10 Inspection of Systems or Components
• SR-11 Component Authenticity
• SR-11(01) Anti-counterfeit Training
• SR-11(02) Configuration Control for Component Service and Repair
• SR-12 Component Disposal

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.