IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D

Providers with Rev5 Class D Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:

NIST SP 800-53 Rev. 5 controls (101)

• AC: AC-02, AC-02 (01), AC-02 (02), AC-02 (03), AC-02 (04), AC-02 (05), AC-02 (07), AC-02 (09), AC-02 (11), AC-02 (12), AC-02 (13), AC-03, AC-06, AC-06 (02), AC-06 (03), AC-06 (05), AC-06 (08), AC-06 (10), AC-17 (02)
• AU: AU-02, AU-03, AU-03 (01), AU-04, AU-05, AU-05 (01), AU-05 (02), AU-06, AU-06 (01), AU-06 (03), AU-06 (04), AU-06 (05), AU-06 (06), AU-06 (07), AU-08, AU-10, AU-11, AU-12, AU-12 (01), AU-12 (03)
• CA: CA-08 (01), CA-08 (02)
• CM: CM-05, CM-06, CM-06 (01), CM-06 (02), CM-07, CM-07 (01), CM-07 (02), CM-07 (05), CM-08
• CP: CP-04
• IA: IA-02, IA-02 (01), IA-02 (02), IA-02 (05), IA-02 (06), IA-02 (08), IA-02 (12), IA-04, IA-05
• IR: IR-03, IR-04, IR-04 (01), IR-04 (02), IR-04 (04), IR-04 (06)
• MA: MA-03 (02)
• PE: PE-03
• RA: RA-05, RA-05 (02), RA-05 (03)
• SA: SA-09, SA-11 (01)
• SC: SC-07, SC-07 (03), SC-07 (04), SC-07 (05), SC-07 (07), SC-07 (08), SC-07 (12), SC-07 (18), SC-07 (20), SC-07 (21), SC-08, SC-12, SC-13, SC-21, SC-28, SC-45 (01)
• SI: SI-03, SI-04 (01), SI-04 (02), SI-04 (10), SI-04 (16), SI-04 (19), SI-04 (20), SI-04 (23), SI-06, SI-07, SI-07 (01), SI-10

1. Επισκόπηση

1.1 Παραπομπές

• AC-02 Account Management
• AC-02(01) Automated System Account Management
• AC-02(02) Automated Temporary and Emergency Account Management
• AC-02(03) Disable Accounts
• AC-02(04) Automated Audit Actions
• AC-02(05) Inactivity Logout
• AC-02(07) Privileged User Accounts
• AC-02(09) Restrictions on Use of Shared and Group Accounts
• AC-02(11) Usage Conditions
• AC-02(12) Account Monitoring for Atypical Usage
• AC-02(13) Disable Accounts for High-risk Individuals
• AC-03 Access Enforcement
• AC-06 Least Privilege
• AC-06(02) Non-privileged Access for Nonsecurity Functions
• AC-06(03) Network Access to Privileged Commands
• AC-06(05) Privileged Accounts
• AC-06(08) Privilege Levels for Code Execution
• AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions
• AC-17(02) Protection of Confidentiality and Integrity Using Encryption
• AU-02 Event Logging
• AU-03 Content of Audit Records
• AU-03(01) Additional Audit Information
• AU-04 Audit Log Storage Capacity
• AU-05 Response to Audit Logging Process Failures
• AU-05(01) Storage Capacity Warning
• AU-05(02) Real-time Alerts
• AU-06 Audit Record Review, Analysis, and Reporting
• AU-06(01) Automated Process Integration
• AU-06(03) Correlate Audit Record Repositories
• AU-06(04) Central Review and Analysis
• AU-06(05) Integrated Analysis of Audit Records
• AU-06(06) Correlation with Physical Monitoring
• AU-06(07) Permitted Actions
• AU-08 Time Stamps
• AU-10 Non-repudiation
• AU-11 Audit Record Retention
• AU-12 Audit Record Generation
• AU-12(01) System-wide and Time-correlated Audit Trail
• AU-12(03) Changes by Authorized Individuals
• CA-08(01) Independent Penetration Testing Agent or Team
• CA-08(02) Red Team Exercises
• CM-05 Access Restrictions for Change
• CM-06 Configuration Settings
• CM-06(01) Automated Management, Application, and Verification
• CM-06(02) Respond to Unauthorized Changes
• CM-07 Least Functionality
• CM-07(01) Periodic Review
• CM-07(02) Prevent Program Execution
• CM-07(05) Authorized Software — Allow-by-exception
• CM-08 System Component Inventory
• CP-04 Contingency Plan Testing
• IA-02 Identification and Authentication (Organizational Users)
• IA-02(01) Multi-factor Authentication to Privileged Accounts
• IA-02(02) Multi-factor Authentication to Non-privileged Accounts
• IA-02(05) Individual Authentication with Group Authentication
• IA-02(06) Access to Accounts —separate Device
• IA-02(08) Access to Accounts — Replay Resistant
• IA-02(12) Acceptance of PIV Credentials
• IA-04 Identifier Management
• IA-05 Authenticator Management
• IR-03 Incident Response Testing
• IR-04 Incident Handling
• IR-04(01) Automated Incident Handling Processes
• IR-04(02) Dynamic Reconfiguration
• IR-04(04) Information Correlation
• IR-04(06) Insider Threats
• MA-03(02) Inspect Media
• PE-03 Physical Access Control
• RA-05 Vulnerability Monitoring and Scanning
• RA-05(02) Update Vulnerabilities to Be Scanned
• RA-05(03) Breadth and Depth of Coverage
• SA-09 External System Services
• SA-11(01) Static Code Analysis
• SC-07 Boundary Protection
• SC-07(03) Access Points
• SC-07(04) External Telecommunications Services
• SC-07(05) Deny by Default — Allow by Exception
• SC-07(07) Split Tunneling for Remote Devices
• SC-07(08) Route Traffic to Authenticated Proxy Servers
• SC-07(12) Host-based Protection
• SC-07(18) Fail Secure
• SC-07(20) Dynamic Isolation and Segregation
• SC-07(21) Isolation of System Components
• SC-08 Transmission Confidentiality and Integrity
• SC-12 Cryptographic Key Establishment and Management
• SC-13 Cryptographic Protection
• SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
• SC-28 Protection of Information at Rest
• SC-45(01) Synchronization with Authoritative Time Source
• SI-03 Malicious Code Protection
• SI-04(01) System-wide Intrusion Detection System
• SI-04(02) Automated Tools and Mechanisms for Real-time Analysis
• SI-04(10) Visibility of Encrypted Communications
• SI-04(16) Correlate Monitoring Information
• SI-04(19) Risk for Individuals
• SI-04(20) Privileged Users
• SI-04(23) Host-based Devices
• SI-06 Security and Privacy Function Verification
• SI-07 Software, Firmware, and Information Integrity
• SI-07(01) Integrity Checks
• SI-10 Information Input Validation

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.