+AC Control Guidance
---+AC-6(1) FedRAMP Control Guidance
---+AC-20 FedRAMP Control Guidance
---+AC-6(2) FedRAMP Control Guidance
---+AC-6(8) FedRAMP Control Guidance

AC Control Guidance

1. Overview

AC-6(1) FedRAMP Control Guidance

Parameters

  • ac-06.01_odp.02: all functions not publicly accessible
  • ac-06.01_odp.05: all security-relevant information not publicly available
AC-20 FedRAMP Control Guidance

Guidance

The interrelated controls of AC-20, CA-3, and SA-9 should be differentiated as follows:

AC-20 describes system access to and from external systems.

CA-3 describes documentation of an agreement between the respective system owners when data is exchanged between the CSO and an external system.

SA-9 describes the responsibilities of external system owners. These responsibilities would typically be captured in the agreement required by CA-3.
AC-6(2) FedRAMP Control Guidance

Parameters

  • ac-06.02_odp: all security functions
AC-6(8) FedRAMP Control Guidance

Parameters

  • ac-06.08_odp: any software except software explicitly documented

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.