+SCG-ENH Enhanced Capabilities
---+SCG-ENH-CMP Comparison Capability
---+SCG-ENH-EXP Export Capability
---+SCG-ENH-API API Capability
---+SCG-ENH-MRG Machine-Readable Guidance
---+SCG-ENH-VRH Versioning and Release History
|
SCG-ENH Enhanced Capabilities
These recommendations apply to providers with FedRAMP Certifications of any type. - Types: 20x, Rev5
- Paths: Program, Agency
- Classes: B, C, D
- Affects: Providers
1. Oversigt
| Titel |
Standard |
|
SCG-ENH-CMP Comparison Capability
|
Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults. Artifacts- Explanation of how to access this information
- or explanation why this functionality is not available
Defined terms: Privileged Account, Top-Level Administrative Account
|
|
SCG-ENH-EXP Export Capability
|
Providers SHOULD offer the capability to export all security settings in a machine-readable format. Artifacts- Explanation of how to access this information
- or explanation why this functionality is not available
Defined terms: Machine-Readable
|
|
SCG-ENH-API API Capability
|
Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability. Artifacts- Explanation of how to access this information
- or explanation why this functionality is not available
|
|
SCG-ENH-MRG Machine-Readable Guidance
|
Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings. Artifacts- Explanation of how to access this information
- or explanation why this functionality is not available
Defined terms: Machine-Readable
|
|
SCG-ENH-VRH Versioning and Release History
|
Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time. Artifacts- Explanation of how to access this information
- or explanation why this functionality is not available
Defined terms: Privileged Account, Top-Level Administrative Account
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|