+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
|
FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
Providers seeking FedRAMP Rev5 Class D Certification MUST include at least the following NIST SP 800-53 Rev. 5 controls in their Security Decision Record: NIST SP 800-53 Rev. 5 controls (409)- AC: AC-01, AC-02, AC-02 (01), AC-02 (02), AC-02 (03), AC-02 (04), AC-02 (05), AC-02 (07), AC-02 (09), AC-02 (11), AC-02 (12), AC-02 (13), AC-03, AC-04, AC-04 (04), AC-04 (21), AC-05, AC-06, AC-06 (01), AC-06 (02), AC-06 (03), AC-06 (05), AC-06 (07), AC-06 (08), AC-06 (09), AC-06 (10), AC-07, AC-08, AC-10, AC-11, AC-11 (01), AC-12, AC-14, AC-17, AC-17 (01), AC-17 (02), AC-17 (03), AC-17 (04), AC-18, AC-18 (01), AC-18 (03), AC-18 (04), AC-18 (05), AC-19, AC-19 (05), AC-20, AC-20 (01), AC-20 (02), AC-21, AC-22
- AT: AT-01, AT-02, AT-02 (02), AT-02 (03), AT-03, AT-04
- AU: AU-01, AU-02, AU-03, AU-03 (01), AU-04, AU-05, AU-05 (01), AU-05 (02), AU-06, AU-06 (01), AU-06 (03), AU-06 (04), AU-06 (05), AU-06 (06), AU-06 (07), AU-07, AU-07 (01), AU-08, AU-09, AU-09 (02), AU-09 (03), AU-09 (04), AU-10, AU-11, AU-12, AU-12 (01), AU-12 (03)
- CA: CA-01, CA-02, CA-02 (01), CA-02 (02), CA-02 (03), CA-03, CA-03 (06), CA-06, CA-07, CA-07 (01), CA-07 (04), CA-08, CA-08 (01), CA-08 (02), CA-09
- CM: CM-01, CM-02, CM-02 (02), CM-02 (03), CM-02 (07), CM-03, CM-03 (01), CM-03 (02), CM-03 (04), CM-03 (06), CM-04, CM-04 (01), CM-04 (02), CM-05, CM-05 (01), CM-05 (05), CM-06, CM-06 (01), CM-06 (02), CM-07, CM-07 (01), CM-07 (02), CM-07 (05), CM-08, CM-08 (01), CM-08 (02), CM-08 (03), CM-08 (04), CM-09, CM-10, CM-11, CM-12, CM-12 (01), CM-14
- CP: CP-01, CP-02, CP-02 (01), CP-02 (02), CP-02 (03), CP-02 (05), CP-02 (08), CP-03, CP-03 (01), CP-04, CP-04 (01), CP-04 (02), CP-06, CP-06 (01), CP-06 (02), CP-06 (03), CP-07, CP-07 (01), CP-07 (02), CP-07 (03), CP-07 (04), CP-08, CP-08 (01), CP-08 (02), CP-08 (03), CP-08 (04), CP-09, CP-09 (01), CP-09 (02), CP-09 (03), CP-09 (05), CP-09 (08), CP-10, CP-10 (02), CP-10 (04)
- IA: IA-01, IA-02, IA-02 (01), IA-02 (02), IA-02 (05), IA-02 (06), IA-02 (08), IA-02 (12), IA-03, IA-04, IA-04 (04), IA-05, IA-05 (01), IA-05 (02), IA-05 (06), IA-05 (07), IA-05 (08), IA-05 (13), IA-06, IA-07, IA-08, IA-08 (01), IA-08 (02), IA-08 (04), IA-11, IA-12, IA-12 (02), IA-12 (03), IA-12 (04), IA-12 (05)
- IR: IR-01, IR-02, IR-02 (01), IR-02 (02), IR-03, IR-03 (02), IR-04, IR-04 (01), IR-04 (02), IR-04 (04), IR-04 (06), IR-04 (11), IR-05, IR-05 (01), IR-06, IR-06 (01), IR-06 (03), IR-07, IR-07 (01), IR-08, IR-09, IR-09 (02), IR-09 (03), IR-09 (04)
- MA: MA-01, MA-02, MA-02 (02), MA-03, MA-03 (01), MA-03 (02), MA-03 (03), MA-04, MA-04 (03), MA-05, MA-05 (01), MA-06
- MP: MP-01, MP-02, MP-03, MP-04, MP-05, MP-06, MP-06 (01), MP-06 (02), MP-06 (03), MP-07
- PE: PE-01, PE-02, PE-03, PE-03 (01), PE-04, PE-05, PE-06, PE-06 (01), PE-06 (04), PE-08, PE-08 (01), PE-09, PE-10, PE-11, PE-11 (01), PE-12, PE-13, PE-13 (01), PE-13 (02), PE-14, PE-14 (02), PE-15, PE-15 (01), PE-16, PE-17, PE-18
- PL: PL-01, PL-02, PL-04, PL-04 (01), PL-08, PL-10, PL-11
- PS: PS-01, PS-02, PS-03, PS-03 (03), PS-04, PS-04 (02), PS-05, PS-06, PS-07, PS-08, PS-09
- RA: RA-01, RA-02, RA-03, RA-03 (01), RA-05, RA-05 (02), RA-05 (03), RA-05 (04), RA-05 (05), RA-05 (08), RA-05 (11), RA-07, RA-09
- SA: SA-01, SA-02, SA-03, SA-04, SA-04 (01), SA-04 (02), SA-04 (05), SA-04 (09), SA-04 (10), SA-05, SA-08, SA-09, SA-09 (01), SA-09 (02), SA-09 (05), SA-10, SA-11, SA-11 (01), SA-11 (02), SA-15, SA-15 (03), SA-16, SA-17, SA-21, SA-22
- SC: SC-01, SC-02, SC-03, SC-04, SC-05, SC-07, SC-07 (03), SC-07 (04), SC-07 (05), SC-07 (07), SC-07 (08), SC-07 (10), SC-07 (12), SC-07 (18), SC-07 (20), SC-07 (21), SC-08, SC-08 (01), SC-10, SC-12, SC-12 (01), SC-13, SC-15, SC-17, SC-18, SC-20, SC-21, SC-22, SC-23, SC-24, SC-28, SC-28 (01), SC-39, SC-45, SC-45 (01)
- SI: SI-01, SI-02, SI-02 (02), SI-02 (03), SI-03, SI-04, SI-04 (01), SI-04 (02), SI-04 (04), SI-04 (05), SI-04 (10), SI-04 (11), SI-04 (12), SI-04 (14), SI-04 (16), SI-04 (18), SI-04 (19), SI-04 (20), SI-04 (22), SI-04 (23), SI-05, SI-05 (01), SI-06, SI-07, SI-07 (01), SI-07 (02), SI-07 (05), SI-07 (07), SI-07 (15), SI-08, SI-08 (02), SI-10, SI-11, SI-12, SI-16
- SR: SR-01, SR-02, SR-02 (01), SR-03, SR-05, SR-06, SR-08, SR-09, SR-09 (01), SR-10, SR-11, SR-11 (01), SR-11 (02), SR-12
1. Resumen
1.1 Referencias
- AC-01 Policy and Procedures
- AC-02 Account Management
- AC-02(01) Automated System Account Management
- AC-02(02) Automated Temporary and Emergency Account Management
- AC-02(03) Disable Accounts
- AC-02(04) Automated Audit Actions
- AC-02(05) Inactivity Logout
- AC-02(07) Privileged User Accounts
- AC-02(09) Restrictions on Use of Shared and Group Accounts
- AC-02(11) Usage Conditions
- AC-02(12) Account Monitoring for Atypical Usage
- AC-02(13) Disable Accounts for High-risk Individuals
- AC-03 Access Enforcement
- AC-04 Information Flow Enforcement
- AC-04(04) Flow Control of Encrypted Information
- AC-04(21) Physical or Logical Separation of Information Flows
- AC-05 Separation of Duties
- AC-06 Least Privilege
- AC-06(01) Authorize Access to Security Functions
- AC-06(02) Non-privileged Access for Nonsecurity Functions
- AC-06(03) Network Access to Privileged Commands
- AC-06(05) Privileged Accounts
- AC-06(07) Review of User Privileges
- AC-06(08) Privilege Levels for Code Execution
- AC-06(09) Log Use of Privileged Functions
- AC-06(10) Prohibit Non-privileged Users from Executing Privileged Functions
- AC-07 Unsuccessful Logon Attempts
- AC-08 System Use Notification
- AC-10 Concurrent Session Control
- AC-11 Device Lock
- AC-11(01) Pattern-hiding Displays
- AC-12 Session Termination
- AC-14 Permitted Actions Without Identification or Authentication
- AC-17 Remote Access
- AC-17(01) Monitoring and Control
- AC-17(02) Protection of Confidentiality and Integrity Using Encryption
- AC-17(03) Managed Access Control Points
- AC-17(04) Privileged Commands and Access
- AC-18 Wireless Access
- AC-18(01) Authentication and Encryption
- AC-18(03) Disable Wireless Networking
- AC-18(04) Restrict Configurations by Users
- AC-18(05) Antennas and Transmission Power Levels
- AC-19 Access Control for Mobile Devices
- AC-19(05) Full Device or Container-based Encryption
- AC-20 Use of External Systems
- AC-20(01) Limits on Authorized Use
- AC-20(02) Portable Storage Devices — Restricted Use
- AC-21 Information Sharing
- AC-22 Publicly Accessible Content
- AT-01 Policy and Procedures
- AT-02 Literacy Training and Awareness
- AT-02(02) Insider Threat
- AT-02(03) Social Engineering and Mining
- AT-03 Role-based Training
- AT-04 Training Records
- AU-01 Policy and Procedures
- AU-02 Event Logging
- AU-03 Content of Audit Records
- AU-03(01) Additional Audit Information
- AU-04 Audit Log Storage Capacity
- AU-05 Response to Audit Logging Process Failures
- AU-05(01) Storage Capacity Warning
- AU-05(02) Real-time Alerts
- AU-06 Audit Record Review, Analysis, and Reporting
- AU-06(01) Automated Process Integration
- AU-06(03) Correlate Audit Record Repositories
- AU-06(04) Central Review and Analysis
- AU-06(05) Integrated Analysis of Audit Records
- AU-06(06) Correlation with Physical Monitoring
- AU-06(07) Permitted Actions
- AU-07 Audit Record Reduction and Report Generation
- AU-07(01) Automatic Processing
- AU-08 Time Stamps
- AU-09 Protection of Audit Information
- AU-09(02) Store on Separate Physical Systems or Components
- AU-09(03) Cryptographic Protection
- AU-09(04) Access by Subset of Privileged Users
- AU-10 Non-repudiation
- AU-11 Audit Record Retention
- AU-12 Audit Record Generation
- AU-12(01) System-wide and Time-correlated Audit Trail
- AU-12(03) Changes by Authorized Individuals
- CA-01 Policy and Procedures
- CA-02 Control Assessments
- CA-02(01) Independent Assessors
- CA-02(02) Specialized Assessments
- CA-02(03) Leveraging Results from External Organizations
- CA-03 Information Exchange
- CA-03(06) Transfer Authorizations
- CA-06 Authorization
- CA-07 Continuous Monitoring
- CA-07(01) Independent Assessment
- CA-07(04) Risk Monitoring
- CA-08 Penetration Testing
- CA-08(01) Independent Penetration Testing Agent or Team
- CA-08(02) Red Team Exercises
- CA-09 Internal System Connections
- CM-01 Policy and Procedures
- CM-02 Baseline Configuration
- CM-02(02) Automation Support for Accuracy and Currency
- CM-02(03) Retention of Previous Configurations
- CM-02(07) Configure Systems and Components for High-risk Areas
- CM-03 Configuration Change Control
- CM-03(01) Automated Documentation, Notification, and Prohibition of Changes
- CM-03(02) Testing, Validation, and Documentation of Changes
- CM-03(04) Security and Privacy Representatives
- CM-03(06) Cryptography Management
- CM-04 Impact Analyses
- CM-04(01) Separate Test Environments
- CM-04(02) Verification of Controls
- CM-05 Access Restrictions for Change
- CM-05(01) Automated Access Enforcement and Audit Records
- CM-05(05) Privilege Limitation for Production and Operation
- CM-06 Configuration Settings
- CM-06(01) Automated Management, Application, and Verification
- CM-06(02) Respond to Unauthorized Changes
- CM-07 Least Functionality
- CM-07(01) Periodic Review
- CM-07(02) Prevent Program Execution
- CM-07(05) Authorized Software — Allow-by-exception
- CM-08 System Component Inventory
- CM-08(01) Updates During Installation and Removal
- CM-08(02) Automated Maintenance
- CM-08(03) Automated Unauthorized Component Detection
- CM-08(04) Accountability Information
- CM-09 Configuration Management Plan
- CM-10 Software Usage Restrictions
- CM-11 User-installed Software
- CM-12 Information Location
- CM-12(01) Automated Tools to Support Information Location
- CM-14 Signed Components
- CP-01 Policy and Procedures
- CP-02 Contingency Plan
- CP-02(01) Coordinate with Related Plans
- CP-02(02) Capacity Planning
- CP-02(03) Resume Mission and Business Functions
- CP-02(05) Continue Mission and Business Functions
- CP-02(08) Identify Critical Assets
- CP-03 Contingency Training
- CP-03(01) Simulated Events
- CP-04 Contingency Plan Testing
- CP-04(01) Coordinate with Related Plans
- CP-04(02) Alternate Processing Site
- CP-06 Alternate Storage Site
- CP-06(01) Separation from Primary Site
- CP-06(02) Recovery Time and Recovery Point Objectives
- CP-06(03) Accessibility
- CP-07 Alternate Processing Site
- CP-07(01) Separation from Primary Site
- CP-07(02) Accessibility
- CP-07(03) Priority of Service
- CP-07(04) Preparation for Use
- CP-08 Telecommunications Services
- CP-08(01) Priority of Service Provisions
- CP-08(02) Single Points of Failure
- CP-08(03) Separation of Primary and Alternate Providers
- CP-08(04) Provider Contingency Plan
- CP-09 System Backup
- CP-09(01) Testing for Reliability and Integrity
- CP-09(02) Test Restoration Using Sampling
- CP-09(03) Separate Storage for Critical Information
- CP-09(05) Transfer to Alternate Storage Site
- CP-09(08) Cryptographic Protection
- CP-10 System Recovery and Reconstitution
- CP-10(02) Transaction Recovery
- CP-10(04) Restore Within Time Period
- IA-01 Policy and Procedures
- IA-02 Identification and Authentication (Organizational Users)
- IA-02(01) Multi-factor Authentication to Privileged Accounts
- IA-02(02) Multi-factor Authentication to Non-privileged Accounts
- IA-02(05) Individual Authentication with Group Authentication
- IA-02(06) Access to Accounts —separate Device
- IA-02(08) Access to Accounts — Replay Resistant
- IA-02(12) Acceptance of PIV Credentials
- IA-03 Device Identification and Authentication
- IA-04 Identifier Management
- IA-04(04) Identify User Status
- IA-05 Authenticator Management
- IA-05(01) Password-based Authentication
- IA-05(02) Public Key-based Authentication
- IA-05(06) Protection of Authenticators
- IA-05(07) No Embedded Unencrypted Static Authenticators
- IA-05(08) Multiple System Accounts
- IA-05(13) Expiration of Cached Authenticators
- IA-06 Authentication Feedback
- IA-07 Cryptographic Module Authentication
- IA-08 Identification and Authentication (Non-organizational Users)
- IA-08(01) Acceptance of PIV Credentials from Other Agencies
- IA-08(02) Acceptance of External Authenticators
- IA-08(04) Use of Defined Profiles
- IA-11 Re-authentication
- IA-12 Identity Proofing
- IA-12(02) Identity Evidence
- IA-12(03) Identity Evidence Validation and Verification
- IA-12(04) In-person Validation and Verification
- IA-12(05) Address Confirmation
- IR-01 Policy and Procedures
- IR-02 Incident Response Training
- IR-02(01) Simulated Events
- IR-02(02) Automated Training Environments
- IR-03 Incident Response Testing
- IR-03(02) Coordination with Related Plans
- IR-04 Incident Handling
- IR-04(01) Automated Incident Handling Processes
- IR-04(02) Dynamic Reconfiguration
- IR-04(04) Information Correlation
- IR-04(06) Insider Threats
- IR-04(11) Integrated Incident Response Team
- IR-05 Incident Monitoring
- IR-05(01) Automated Tracking, Data Collection, and Analysis
- IR-06 Incident Reporting
- IR-06(01) Automated Reporting
- IR-06(03) Supply Chain Coordination
- IR-07 Incident Response Assistance
- IR-07(01) Automation Support for Availability of Information and Support
- IR-08 Incident Response Plan
- IR-09 Information Spillage Response
- IR-09(02) Training
- IR-09(03) Post-spill Operations
- IR-09(04) Exposure to Unauthorized Personnel
- MA-01 Policy and Procedures
- MA-02 Controlled Maintenance
- MA-02(02) Automated Maintenance Activities
- MA-03 Maintenance Tools
- MA-03(01) Inspect Tools
- MA-03(02) Inspect Media
- MA-03(03) Prevent Unauthorized Removal
- MA-04 Nonlocal Maintenance
- MA-04(03) Comparable Security and Sanitization
- MA-05 Maintenance Personnel
- MA-05(01) Individuals Without Appropriate Access
- MA-06 Timely Maintenance
- MP-01 Policy and Procedures
- MP-02 Media Access
- MP-03 Media Marking
- MP-04 Media Storage
- MP-05 Media Transport
- MP-06 Media Sanitization
- MP-06(01) Review, Approve, Track, Document, and Verify
- MP-06(02) Equipment Testing
- MP-06(03) Nondestructive Techniques
- MP-07 Media Use
- PE-01 Policy and Procedures
- PE-02 Physical Access Authorizations
- PE-03 Physical Access Control
- PE-03(01) System Access
- PE-04 Access Control for Transmission
- PE-05 Access Control for Output Devices
- PE-06 Monitoring Physical Access
- PE-06(01) Intrusion Alarms and Surveillance Equipment
- PE-06(04) Monitoring Physical Access to Systems
- PE-08 Visitor Access Records
- PE-08(01) Automated Records Maintenance and Review
- PE-09 Power Equipment and Cabling
- PE-10 Emergency Shutoff
- PE-11 Emergency Power
- PE-11(01) Alternate Power Supply — Minimal Operational Capability
- PE-12 Emergency Lighting
- PE-13 Fire Protection
- PE-13(01) Detection Systems — Automatic Activation and Notification
- PE-13(02) Suppression Systems — Automatic Activation and Notification
- PE-14 Environmental Controls
- PE-14(02) Monitoring with Alarms and Notifications
- PE-15 Water Damage Protection
- PE-15(01) Automation Support
- PE-16 Delivery and Removal
- PE-17 Alternate Work Site
- PE-18 Location of System Components
- PL-01 Policy and Procedures
- PL-02 System Security and Privacy Plans
- PL-04 Rules of Behavior
- PL-04(01) Social Media and External Site/Application Usage Restrictions
- PL-08 Security and Privacy Architectures
- PL-10 Baseline Selection
- PL-11 Baseline Tailoring
- PS-01 Policy and Procedures
- PS-02 Position Risk Designation
- PS-03 Personnel Screening
- PS-03(03) Information Requiring Special Protective Measures
- PS-04 Personnel Termination
- PS-04(02) Automated Actions
- PS-05 Personnel Transfer
- PS-06 Access Agreements
- PS-07 External Personnel Security
- PS-08 Personnel Sanctions
- PS-09 Position Descriptions
- RA-01 Policy and Procedures
- RA-02 Security Categorization
- RA-03 Risk Assessment
- RA-03(01) Supply Chain Risk Assessment
- RA-05 Vulnerability Monitoring and Scanning
- RA-05(02) Update Vulnerabilities to Be Scanned
- RA-05(03) Breadth and Depth of Coverage
- RA-05(04) Discoverable Information
- RA-05(05) Privileged Access
- RA-05(08) Review Historic Audit Logs
- RA-05(11) Public Disclosure Program
- RA-07 Risk Response
- RA-09 Criticality Analysis
- SA-01 Policy and Procedures
- SA-02 Allocation of Resources
- SA-03 System Development Life Cycle
- SA-04 Acquisition Process
- SA-04(01) Functional Properties of Controls
- SA-04(02) Design and Implementation Information for Controls
- SA-04(05) System, Component, and Service Configurations
- SA-04(09) Functions, Ports, Protocols, and Services in Use
- SA-04(10) Use of Approved PIV Products
- SA-05 System Documentation
- SA-08 Security and Privacy Engineering Principles
- SA-09 External System Services
- SA-09(01) Risk Assessments and Organizational Approvals
- SA-09(02) Identification of Functions, Ports, Protocols, and Services
- SA-09(05) Processing, Storage, and Service Location
- SA-10 Developer Configuration Management
- SA-11 Developer Testing and Evaluation
- SA-11(01) Static Code Analysis
- SA-11(02) Threat Modeling and Vulnerability Analyses
- SA-15 Development Process, Standards, and Tools
- SA-15(03) Criticality Analysis
- SA-16 Developer-provided Training
- SA-17 Developer Security and Privacy Architecture and Design
- SA-21 Developer Screening
- SA-22 Unsupported System Components
- SC-01 Policy and Procedures
- SC-02 Separation of System and User Functionality
- SC-03 Security Function Isolation
- SC-04 Information in Shared System Resources
- SC-05 Denial-of-service Protection
- SC-07 Boundary Protection
- SC-07(03) Access Points
- SC-07(04) External Telecommunications Services
- SC-07(05) Deny by Default — Allow by Exception
- SC-07(07) Split Tunneling for Remote Devices
- SC-07(08) Route Traffic to Authenticated Proxy Servers
- SC-07(10) Prevent Exfiltration
- SC-07(12) Host-based Protection
- SC-07(18) Fail Secure
- SC-07(20) Dynamic Isolation and Segregation
- SC-07(21) Isolation of System Components
- SC-08 Transmission Confidentiality and Integrity
- SC-08(01) Cryptographic Protection
- SC-10 Network Disconnect
- SC-12 Cryptographic Key Establishment and Management
- SC-12(01) Availability
- SC-13 Cryptographic Protection
- SC-15 Collaborative Computing Devices and Applications
- SC-17 Public Key Infrastructure Certificates
- SC-18 Mobile Code
- SC-20 Secure Name/Address Resolution Service (Authoritative Source)
- SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
- SC-22 Architecture and Provisioning for Name/Address Resolution Service
- SC-23 Session Authenticity
- SC-24 Fail in Known State
- SC-28 Protection of Information at Rest
- SC-28(01) Cryptographic Protection
- SC-39 Process Isolation
- SC-45 System Time Synchronization
- SC-45(01) Synchronization with Authoritative Time Source
- SI-01 Policy and Procedures
- SI-02 Flaw Remediation
- SI-02(02) Automated Flaw Remediation Status
- SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions
- SI-03 Malicious Code Protection
- SI-04 System Monitoring
- SI-04(01) System-wide Intrusion Detection System
- SI-04(02) Automated Tools and Mechanisms for Real-time Analysis
- SI-04(04) Inbound and Outbound Communications Traffic
- SI-04(05) System-generated Alerts
- SI-04(10) Visibility of Encrypted Communications
- SI-04(11) Analyze Communications Traffic Anomalies
- SI-04(12) Automated Organization-generated Alerts
- SI-04(14) Wireless Intrusion Detection
- SI-04(16) Correlate Monitoring Information
- SI-04(18) Analyze Traffic and Covert Exfiltration
- SI-04(19) Risk for Individuals
- SI-04(20) Privileged Users
- SI-04(22) Unauthorized Network Services
- SI-04(23) Host-based Devices
- SI-05 Security Alerts, Advisories, and Directives
- SI-05(01) Automated Alerts and Advisories
- SI-06 Security and Privacy Function Verification
- SI-07 Software, Firmware, and Information Integrity
- SI-07(01) Integrity Checks
- SI-07(02) Automated Notifications of Integrity Violations
- SI-07(05) Automated Response to Integrity Violations
- SI-07(07) Integration of Detection and Response
- SI-07(15) Code Authentication
- SI-08 Spam Protection
- SI-08(02) Automatic Updates
- SI-10 Information Input Validation
- SI-11 Error Handling
- SI-12 Information Management and Retention
- SI-16 Memory Protection
- SR-01 Policy and Procedures
- SR-02 Supply Chain Risk Management Plan
- SR-02(01) Establish SCRM Team
- SR-03 Supply Chain Controls and Processes
- SR-05 Acquisition Strategies, Tools, and Methods
- SR-06 Supplier Assessments and Reviews
- SR-08 Notification Agreements
- SR-09 Tamper Resistance and Detection
- SR-09(01) Multiple Stages of System Development Life Cycle
- SR-10 Inspection of Systems or Components
- SR-11 Component Authenticity
- SR-11(01) Anti-counterfeit Training
- SR-11(02) Configuration Control for Component Service and Repair
- SR-12 Component Disposal
1.2 Requisitos identificados
1.3 Regulaciones relacionadas
2. Requisitos identificados
Requisitos
| Fuente |
Requisito |
3. Regulaciones relacionadas
Regulaciones
| Fuente |
Regulación |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|