+SCG-CSO General Provider Responsibilities
---+SCG-CSO-RSC Recommended Secure Configuration
---+SCG-CSO-AUP Use Instructions
---+SCG-CSO-PUB Public Secure Configuration Guidance
---+SCG-CSO-SDF Secure Defaults

SCG-CSO General Provider Responsibilities

These rules apply to providers with FedRAMP Certifications of any type.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1. Übersicht

SCG-CSO-RSC Recommended Secure Configuration

Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:

  • Required: Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts that control enterprise access to the entire cloud service offering.
  • Required: Explanations of security-related settings that can be operated only by top-level administrative accounts and their security implications.
  • Recommended: Explanations of security-related settings that can be operated only by privileged accounts and their security implications.

Notes

These rules refer to this guidance as a Secure Configuration Guide but cloud service providers may make this guidance available in various appropriate forms that provide the best customer experience.

This guidance should explain how top-level administrative accounts and privileged accounts are named and referred to in the cloud service offering.

Artifacts

  • URL to the human-readable data.
  • URL to the machine-readable data.

Schema: FedRAMP Certification Package Overview (FRC-CSO-PKG)

NIST SP 800-53 Rev. 5 controls: CM-7

Defined terms: Cloud Service Offering, Privileged Account, Top-Level Administrative Account
SCG-CSO-AUP Use Instructions

Providers MUST include instructions in the FedRAMP Certification Package that explain how to obtain and use the Secure Configuration Guide.

Note

These instructions may appear in a variety of ways; it is up to the provider to do so in the most appropriate and effective ways for their specific customer needs.

Artifacts

  • URL or explanation of how to request these materials.
  • Explanation of how the provider decides whether or not to share these materials or other related policies.

Defined terms: Certification Package
SCG-CSO-PUB Public Secure Configuration Guidance

Providers SHOULD make the Secure Configuration Guide available publicly.

Artifacts

  • Explanation of how to access this information
  • or explanation why this functionality is not available
SCG-CSO-SDF Secure Defaults

Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned.

Artifacts

  • Explanation of how to access this information
  • or explanation why this functionality is not available

Defined terms: Privileged Account, Top-Level Administrative Account

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.