IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B

Providers with Rev5 Class B Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:

NIST SP 800-53 Rev. 5 controls (35)

• AC: AC-02, AC-03
• AU: AU-02, AU-03, AU-04, AU-05, AU-06, AU-08, AU-11, AU-12
• CA: CA-08
• CM: CM-05, CM-06, CM-07, CM-08
• CP: CP-04
• IA: IA-02, IA-02 (01), IA-02 (02), IA-02 (08), IA-02 (12), IA-04, IA-05
• IR: IR-04
• PE: PE-03
• RA: RA-05, RA-05 (02)
• SA: SA-09
• SC: SC-07, SC-08, SC-12, SC-13, SC-21, SC-28
• SI: SI-03

1. Yleiskatsaus

1.1 Viittaukset

• AC-02 Account Management
• AC-03 Access Enforcement
• AU-02 Event Logging
• AU-03 Content of Audit Records
• AU-04 Audit Log Storage Capacity
• AU-05 Response to Audit Logging Process Failures
• AU-06 Audit Record Review, Analysis, and Reporting
• AU-08 Time Stamps
• AU-11 Audit Record Retention
• AU-12 Audit Record Generation
• CA-08 Penetration Testing
• CM-05 Access Restrictions for Change
• CM-06 Configuration Settings
• CM-07 Least Functionality
• CM-08 System Component Inventory
• CP-04 Contingency Plan Testing
• IA-02 Identification and Authentication (Organizational Users)
• IA-02(01) Multi-factor Authentication to Privileged Accounts
• IA-02(02) Multi-factor Authentication to Non-privileged Accounts
• IA-02(08) Access to Accounts — Replay Resistant
• IA-02(12) Acceptance of PIV Credentials
• IA-04 Identifier Management
• IA-05 Authenticator Management
• IR-04 Incident Handling
• PE-03 Physical Access Control
• RA-05 Vulnerability Monitoring and Scanning
• RA-05(02) Update Vulnerabilities to Be Scanned
• SA-09 External System Services
• SC-07 Boundary Protection
• SC-08 Transmission Confidentiality and Integrity
• SC-12 Cryptographic Key Establishment and Management
• SC-13 Cryptographic Protection
• SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver)
• SC-28 Protection of Information at Rest
• SI-03 Malicious Code Protection

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.