VDR-TFR-PDD Persistent Drift Detection

Class A

Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months.

Timeframe: 3 months

Class B

Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month.

Timeframe: 1 month

Class C

Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.

Timeframe: 14 days

Class D

Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days.

Timeframe: 7 days

NIST SP 800-53 Rev. 5 controls: SI-4(22), SI-7, SI-7(1)

Defined terms: Drift, Information Resource, Likely, Persistently, Vulnerability, Vulnerability Detection

1. Prehľad

1.1 Odkazy

• FRC-CLA-RFR Recommended FedRAMP Rules for Class A
• SI-04(22) Unauthorized Network Services
• SI-07 Software, Firmware, and Information Integrity
• SI-07(01) Integrity Checks
• FRD-DFT Drift
• FRD-IRS Information Resource
• FRD-LKY Likely
• FRD-PER Persistently
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

3. Súvisiace predpisy

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.