{ "certificationPackageOverviewUri": "https://placeholder.invalid/certification-package-overview-pending-cpo", "metadata": { "version": "1.0.0", "lastUpdated": "2026-10-09T17:11:56.137Z", "updateSource": null }, "portsAndProtocols": [], "securityControls": [], "fedRampRequirements": [ { "frrID": "AFC-CSO-CRA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "When FedRAMP Security Emails are received, the @GRC Admin reviews the required actions in the body of messages that require an elevated response (Emergency, Emergency Test, and Important) routes Emergency messages to a senior security official ensures the required actions are completed within the timeframe specified in the email from @FedRAMP Project Management Office.\n\nIf the addressing for #THIS ORGANIZATION's FedRAMP Security Inbox changes, the @GRC Admin will immediately notify the @FedRAMP Project Management Office by emailing info@fedramp.gov with the name and FedRAMP ID of the cloud service offering and the updated email address. Action on FedRAMP Security Emails : Action on FedRAMP Security Emails has an attestation that ensures that the @GRC Admin monitors the FedRAMP Security Inbox, routes \"Emergency\" messages to senior officials, ensures actions are completed within PMO-mandated timeframes, and updates info@fedramp.gov immediately if the contact email changes.", "#THIS ORGANIZATION assesses internal controls through [Continuous Monitoring Process: @Continuous Monitoring Process], using [GRC Tool: @Paramify SaaS] to establish the frequency of occurrence (e.g. monthly, quarterly, annually) or triggers (e.g. a security event), as well as the internal control owner.", "Identified issues resulting from [Continuous Monitoring Process: @Continuous Monitoring Process] are given owners and tracked to remediation via [GRC Tool: @Paramify SaaS]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "AFC-CSO-INB", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE is notified of deployed changes via [Event Notifications: @SNS].", "Securin inherits #CAPABILITY TITLE controls from #MAIN COMPONENT.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "AFC-CSO-NOC", "frrImplementationStatus": "Implemented", "frrImplementation": [ "When FedRAMP Security Emails are received, the @GRC Admin reviews the required actions in the body of messages that require an elevated response (Emergency, Emergency Test, and Important) routes Emergency messages to a senior security official ensures the required actions are completed within the timeframe specified in the email from @FedRAMP Project Management Office.\n\nIf the addressing for #THIS ORGANIZATION's FedRAMP Security Inbox changes, the @GRC Admin will immediately notify the @FedRAMP Project Management Office by emailing info@fedramp.gov with the name and FedRAMP ID of the cloud service offering and the updated email address. Action on FedRAMP Security Emails : Action on FedRAMP Security Emails has an attestation that ensures that the @GRC Admin monitors the FedRAMP Security Inbox, routes \"Emergency\" messages to senior officials, ensures actions are completed within PMO-mandated timeframes, and updates info@fedramp.gov immediately if the contact email changes.", "The #MAIN COMPONENT ROLE is notified of deployed changes via [Event Notifications: @SNS].", "#THIS ORGANIZATION maintains a dedicated notification portal (https://status.paramify.com) to update customers on planned maintenance and current Securin availability." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "AFC-CSO-RCV", "frrImplementationStatus": "Implemented", "frrImplementation": [ "When FedRAMP Security Emails are received, the @GRC Admin reviews the required actions in the body of messages that require an elevated response (Emergency, Emergency Test, and Important) routes Emergency messages to a senior security official ensures the required actions are completed within the timeframe specified in the email from @FedRAMP Project Management Office.\n\nIf the addressing for #THIS ORGANIZATION's FedRAMP Security Inbox changes, the @GRC Admin will immediately notify the @FedRAMP Project Management Office by emailing info@fedramp.gov with the name and FedRAMP ID of the cloud service offering and the updated email address. Action on FedRAMP Security Emails : Action on FedRAMP Security Emails has an attestation that ensures that the @GRC Admin monitors the FedRAMP Security Inbox, routes \"Emergency\" messages to senior officials, ensures actions are completed within PMO-mandated timeframes, and updates info@fedramp.gov immediately if the contact email changes.", "The #MAIN COMPONENT ROLE is notified of deployed changes via [Event Notifications: @SNS].", "Securin inherits #CAPABILITY TITLE controls from #MAIN COMPONENT.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CCM-OCR-AVL", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years.", "#THIS ORGANIZATION publishes an Ongoing Certification Report (OCR) to all necessary parties every 3 months on a regular cycle spread out from a consistent point in each quarter. The OCR covers the entire period since the previous report and includes, at minimum:\n\n- Changes to FedRAMP Certification Data since the last OCR\n- Planned changes to FedRAMP Certification Data for at least the next 3 months\n- Accepted vulnerabilities\n- Transformative changes\n- Updated recommendations or best practices for security, configuration, or usage\n- A list of all agencies directly using the product\n- FedRAMP Reportable Incidents, or an attestation that no such incidents occurred\n- Lessons learned and changes made as a result of any FedRAMP Reportable Incidents\n\nThe target date for the next OCR is published alongside other public FedRAMP Certification Data. Sensitive information that would likely have an adverse effect on Securin is not disclosed in the OCR." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CCM-OCR-NRD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION publishes an Ongoing Certification Report (OCR) to all necessary parties every 3 months on a regular cycle spread out from a consistent point in each quarter. The OCR covers the entire period since the previous report and includes, at minimum:\n\n- Changes to FedRAMP Certification Data since the last OCR\n- Planned changes to FedRAMP Certification Data for at least the next 3 months\n- Accepted vulnerabilities\n- Transformative changes\n- Updated recommendations or best practices for security, configuration, or usage\n- A list of all agencies directly using the product\n- FedRAMP Reportable Incidents, or an attestation that no such incidents occurred\n- Lessons learned and changes made as a result of any FedRAMP Reportable Incidents\n\nThe target date for the next OCR is published alongside other public FedRAMP Certification Data. Sensitive information that would likely have an adverse effect on Securin is not disclosed in the OCR." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CCM-QTR-MTG", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION hosts a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Report most relevant to agencies. Quarterly Reviews are scheduled within 10 business days of publishing an OCR and at least 3 business days after its release. A registration link or downloadable calendar invitation with meeting details is distributed to all necessary parties in advance.\n\nThe @GRC Admin presents information determined to be of interest, use, or otherwise relevant to agencies, and may include additional content beyond the OCR. Quarterly Reviews are recorded or transcribed, and the recording or transcript is made available to all necessary parties. Sensitive information that would likely have an adverse effect on Securin is not irresponsibly disclosed. Third parties are not invited unless they have specific relevance to the content being reviewed.", "The @Auditor conducts annual security assessments for Securin, documenting results in a Security Assessment Report (SAR). Confirmed findings are addressed in the [Risk Remediation Process: @Risk Remediation Process] by the #MAIN COMPONENT ROLE.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-AVR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION includes the following data in the Paramify Trust Center ([https://trust.paramify.com/](https://trust.paramify.com/)) and ensures that data is current, accurate, and not sensitive:\n\n1. Direct link to the FedRAMP Marketplace offering\n2. Service Model\n3. Deployment Model\n4. Business Category\n5. UEI Number\n6. Contact Information\n7. Overall Service Description\n8. Detailed list of specific services and their impact levels (see CDS-CSO-SVC)\n9. Summary of customer responsibilities and secure configuration guidance\n10. Ongoing Certification Documentation", "#THIS ORGANIZATION maintains a dedicated notification portal (https://status.paramify.com) to update customers on planned maintenance and current Securin availability.", "#THIS ORGANIZATION considers Securin product portions highly available with a 1-hour recovery-time objective (RTO). Administrative portions managed by Cloud Service Providers with SLAs for service availability.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION uses its trust center as the controlled channel through which necessary parties get what they need about Securin. Federal agencies are supplied access to the FedRAMP Certification Data upon request; if a request is denied, the @GRC Admin notifies FedRAMP within 5 business days by emailing [info@fedramp.gov](mailto:info@fedramp.gov), including the name, FedRAMP ID, and reason for denial." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-IRP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE is responsible for managing the development, documentation and dissemination of both [Data Protection Procedures: @Data Protection Procedures] and [Data Protection Policies: @Data Protection Policies].", "The #MAIN COMPONENT ROLE reviews [Data Protection Policies: @Data Protection Policies] annually and updates the version history table with the most recent review date and version number.", "The #MAIN COMPONENT ROLE reviews [Data Protection Procedures: @Data Protection Procedures] annually and updates the version history table with the most recent review date and version number.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-PSM", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "#THIS ORGANIZATION identifies a set of information resources to assess for FedRAMP authorization that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering. This includes configurations and use of third-party information resources. #THIS ORGANIZATION clearly identifies and documents the justification, mitigation measures, compensating controls, and potential impact to federal customer data from the configuration and usage of non-FedRAMP authorized third-party information resources, including metadata (and metadata about federal customer data).\n\n#THIS ORGANIZATION clearly identifies, documents, and explains information flows and impact levels for ALL information resources. Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. #THIS ORGANIZATION reviews best practices and technical assistance provided separately by FedRAMP for help with applying the Minimum Assessment Scope as needed.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\nMinimum Assessment Scope Validators for [Data Wiping Tool: @AWS] and [Anti-Malware: @GuardDuty] ensure all resources are in scope when continuous evidence validations run.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-PUB", "frrImplementationStatus": "Implemented", "frrImplementation": [ "@Customer Success Engineer maintains publicly accessible guidance that includes:\n\n- Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts\n\n- Explanation of security-related settings operable by top-level administrative accounts and their security implications\n\n- Explanation of security-related settings operable by privileged accounts and their security implications\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\n\\[Administrative & Privileged Account Documentation : Administrative & Privileged Account Documentation\\] has an attestation that ensures that the @Customer Success Engineer maintains publicly accessible documentation detailing the lifecycle (access, configure, operate, decommission) and security implications of settings for both top-level administrative and privileged accounts.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION provides relevant documentation explaining how to use the trust center and obtain authorization data to all necessary parties.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION includes the following data in the Paramify Trust Center ([https://trust.paramify.com/](https://trust.paramify.com/)) and ensures that data is current, accurate, and not sensitive:\n\n1. Direct link to the FedRAMP Marketplace offering\n2. Service Model\n3. Deployment Model\n4. Business Category\n5. UEI Number\n6. Contact Information\n7. Overall Service Description\n8. Detailed list of specific services and their impact levels (see CDS-CSO-SVC)\n9. Summary of customer responsibilities and secure configuration guidance\n10. Ongoing Certification Documentation", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-SVC", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION includes the following data in the Paramify Trust Center ([https://trust.paramify.com/](https://trust.paramify.com/)) and ensures that data is current, accurate, and not sensitive:\n\n1. Direct link to the FedRAMP Marketplace offering\n2. Service Model\n3. Deployment Model\n4. Business Category\n5. UEI Number\n6. Contact Information\n7. Overall Service Description\n8. Detailed list of specific services and their impact levels (see CDS-CSO-SVC)\n9. Summary of customer responsibilities and secure configuration guidance\n10. Ongoing Certification Documentation", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "#THIS ORGANIZATION identifies a set of information resources to assess for FedRAMP authorization that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering. This includes configurations and use of third-party information resources. #THIS ORGANIZATION clearly identifies and documents the justification, mitigation measures, compensating controls, and potential impact to federal customer data from the configuration and usage of non-FedRAMP authorized third-party information resources, including metadata (and metadata about federal customer data).\n\n#THIS ORGANIZATION clearly identifies, documents, and explains information flows and impact levels for ALL information resources. Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. #THIS ORGANIZATION reviews best practices and technical assistance provided separately by FedRAMP for help with applying the Minimum Assessment Scope as needed.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\nMinimum Assessment Scope Validators for [Data Wiping Tool: @AWS] and [Anti-Malware: @GuardDuty] ensure all resources are in scope when continuous evidence validations run.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-CSO-UTC", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION reviews access requests from the [Trust Center: @Paramify SaaS] Trust Center and approves all necessary parties including at least FedRAMP, CISA, and agency customers by provisioning accounts with role-based access in Securin's [GRC Tool: @Paramify SaaS] workspace. If prospective agency customers are denied, FedRAMP is notified within 5 days.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION provides relevant documentation explaining how to use the trust center and obtain authorization data to all necessary parties.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION includes the following data in the Paramify Trust Center ([https://trust.paramify.com/](https://trust.paramify.com/)) and ensures that data is current, accurate, and not sensitive:\n\n1. Direct link to the FedRAMP Marketplace offering\n2. Service Model\n3. Deployment Model\n4. Business Category\n5. UEI Number\n6. Contact Information\n7. Overall Service Description\n8. Detailed list of specific services and their impact levels (see CDS-CSO-SVC)\n9. Summary of customer responsibilities and secure configuration guidance\n10. Ongoing Certification Documentation", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "[Trust Center: @Paramify SaaS] Trust Center stores historical versions of authorization packages for three years and access summaries for at least six months.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CDS-UTC-AAD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE is responsible for managing account access to their own Securin environment and network.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION uses its trust center as the controlled channel through which necessary parties get what they need about Securin. Federal agencies are supplied access to the FedRAMP Certification Data upon request; if a request is denied, the @GRC Admin notifies FedRAMP within 5 business days by emailing [info@fedramp.gov](mailto:info@fedramp.gov), including the name, FedRAMP ID, and reason for denial." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CMU-CSO-CMD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "All services/products within Securin use FIPS-validated encryption for customer information in transit and at rest. Authorized validation component details can be found in the Cryptographic Modules Table.", "All authentication mechanisms to cryptographic modules, including those in Securin, [Identity Management: @Google Directory], and [Privileged Access Management: @Identity Center], use FIPS 140-2 validated AES-256 encryption algorithms. [Operating System: @Amazon Linux 2] crypto modules also use AES-256 and are FIPS validated and listed in the NIST Cryptographic Module Validation Program (CMVP).", "#THIS ORGANIZATION deployed FIPS 140-2 validated modules in all Securin components from authorized listing. #MAIN COMPONENT ROLE approval is required for authorized module changes.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION documents the cryptographic modules used in each service (or groups of services that use the same modules) where cryptographic services are used to protect federal customer data, including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.\n\n#THIS ORGANIZATION configures agency tenants to utilize cryptographic services backed by modules or update streams of modules that hold active validations under the NIST Cryptographic Module Validation Program, whenever such modules are available." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CMU-CSO-UVM", "frrImplementationStatus": "Implemented", "frrImplementation": [ "All services/products within Securin use FIPS-validated encryption for customer information in transit and at rest. Authorized validation component details can be found in the Cryptographic Modules Table.", "All authentication mechanisms to cryptographic modules, including those in Securin, [Identity Management: @Google Directory], and [Privileged Access Management: @Identity Center], use FIPS 140-2 validated AES-256 encryption algorithms. [Operating System: @Amazon Linux 2] crypto modules also use AES-256 and are FIPS validated and listed in the NIST Cryptographic Module Validation Program (CMVP).", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "The @DevOps Admin configures data that is stored at rest by Securin to be encrypted with FIPS validated modules.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\n\\[S3 Encryption Status : Minimum Assessment Scope AWS\\]\n\nensures all [Cloud Storage (1): @EFS] buckets are validated\n\n\\[RDS Encryption Status : Minimum Assessment Scope AWS\\]\n\nensures all [Database (2): @Amazon OpenSearch] databases are validated\n\n\\[Block Storage Encryption Status : Minimum Assessment Scope AWS\\]\n\nensures all [Cloud Storage (1): @EFS] systems are validated\n\n\\[S3 Encryption Status : All S3 Buckets Encrypted\\]\n\nensures 100% are encrypted at rest.\n\n\\[RDS Encryption Status : All RDS DBs Encrypted\\]\n\nensures 100% are encrypted at rest.\n\n\\[Block Storage Encryption Status : Block Storage Encryption Status\\]\n\nensures 100% are encrypted at rest.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Inbound internet traffic to Securin is restricted to TLS and SSH encrypted ports, which use FIPS validated modules. Non-secure protocols are not permitted. Firewall rules defined in [Firewall Management: @AWS] enforce the restriction." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CPO-CSO-MTD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM.", "#THIS ORGANIZATION will notify the @Authorizing Official of significant changes to Securin and re-engage the @Auditor to analyze the change. The #MAIN COMPONENT ROLE will update the security authorization as necessary every three years or for significant changes.\n\nSignificant changes include:\n\n- FIPS 199 category changes,\n\n- hardware/software changes,\n\n- architecture/design changes,\n\n- database architecture changes,\n\n- interconnection changes,\n\n- privileged role changes,\n\n- laws/policies changes,\n\n- authentication/crypto changes, and\n\n- Cloud provider changes\n\nThe #MAIN COMPONENT ROLE must also communicate changes and testing results to customers as mandated by the @Authorizing Official." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CPO-CSO-OSA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION will have their goals and validation processes by an independent assessor or FedRAMP directly. This includes assessment of underlying code, pipelines, configurations, automation tools, etc. This assessment includes providing technical explanations, demonstrations, and other relevant supporting information to all necessary assessors. Providers can ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\n\\[Independent Assessment : Independent Assessment\\] has an attestation that ensures that the organization grants independent assessors access to [GRC Tool: @Paramify SaaS] for evidence review and actively participates in the assessment by demonstrating underlying code, pipelines, and automation tools." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CPO-CSO-OVR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "CPO-CSX-CPM", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM.", "#THIS ORGANIZATION will notify the @Authorizing Official of significant changes to Securin and re-engage the @Auditor to analyze the change. The #MAIN COMPONENT ROLE will update the security authorization as necessary every three years or for significant changes.\n\nSignificant changes include:\n\n- FIPS 199 category changes,\n\n- hardware/software changes,\n\n- architecture/design changes,\n\n- database architecture changes,\n\n- interconnection changes,\n\n- privileged role changes,\n\n- laws/policies changes,\n\n- authentication/crypto changes, and\n\n- Cloud provider changes\n\nThe #MAIN COMPONENT ROLE must also communicate changes and testing results to customers as mandated by the @Authorizing Official." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-AFC", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-FCP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-FIA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION contracts with @Red Team for annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for the annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-MLF", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-NTP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-APP-USA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The @Auditor conducts annual security assessments for Securin, documenting results in a Security Assessment Report (SAR). Confirmed findings are addressed in the [Risk Remediation Process: @Risk Remediation Process] by the #MAIN COMPONENT ROLE.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-ASF", "frrImplementationStatus": "Implemented", "frrImplementation": [ "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-EAM", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The @Auditor conducts annual security assessments for Securin, documenting results in a Security Assessment Report (SAR). Confirmed findings are addressed in the [Risk Remediation Process: @Risk Remediation Process] by the #MAIN COMPONENT ROLE.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-IVV", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION contracts with @Red Team for annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for the annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-MFR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE is responsible for managing the development, documentation and dissemination of both [Data Protection Procedures: @Data Protection Procedures] and [Data Protection Policies: @Data Protection Policies].", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-OFR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION publishes an Ongoing Certification Report (OCR) to all necessary parties every 3 months on a regular cycle spread out from a consistent point in each quarter. The OCR covers the entire period since the previous report and includes, at minimum:\n\n- Changes to FedRAMP Certification Data since the last OCR\n- Planned changes to FedRAMP Certification Data for at least the next 3 months\n- Accepted vulnerabilities\n- Transformative changes\n- Updated recommendations or best practices for security, configuration, or usage\n- A list of all agencies directly using the product\n- FedRAMP Reportable Incidents, or an attestation that no such incidents occurred\n- Lessons learned and changes made as a result of any FedRAMP Reportable Incidents\n\nThe target date for the next OCR is published alongside other public FedRAMP Certification Data. Sensitive information that would likely have an adverse effect on Securin is not disclosed in the OCR.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CLA-RFR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Machine-based information resources in Securin are defined and provisoned through version-controlled infrastrucures-as-code managed in [Code Version Control: @Amazon CodeCommit]. Configuration changes are applied by redeploying version-controlled resources rather than by direct manual modification. Changes are automatically tested and validated through deployment before promotion. The running configuration of deployed resources is persistently compared against the version-controlled definitions to detect drift", "The @DevOps Admin maintains a current baseline configuration of Securin in [Code Version Control: @Amazon CodeCommit], as outlined in the [Configuration Management Plan: @Configuration Management Plan]. This includes:\n\n- Hardening Securin for security while maintaining functionality.\n\n- Enabling only essential ports, protocols, and services.\n\n- Ensuring associated accounts are secure and compliant.\n\n- Disabling non-essential functions, ports, protocols, and services.\n\n- Adhering to the principle of least privilege for device operations and access.\n\nAuthorized personnel approve, test, and deploy any changes to these baselines through the [Change Management Process: @Change Management Process], with updates documented in [System Development Management: @Jira].", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSO-FCP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION identifies a set of information resources to assess for FedRAMP authorization that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering. This includes configurations and use of third-party information resources. #THIS ORGANIZATION clearly identifies and documents the justification, mitigation measures, compensating controls, and potential impact to federal customer data from the configuration and usage of non-FedRAMP authorized third-party information resources, including metadata (and metadata about federal customer data).\n\n#THIS ORGANIZATION clearly identifies, documents, and explains information flows and impact levels for ALL information resources. Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. #THIS ORGANIZATION reviews best practices and technical assistance provided separately by FedRAMP for help with applying the Minimum Assessment Scope as needed.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\nMinimum Assessment Scope Validators for [Data Wiping Tool: @AWS] and [Anti-Malware: @GuardDuty] ensure all resources are in scope when continuous evidence validations run.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSO-JSN", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSO-MRA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "#THIS ORGANIZATION publishes an Ongoing Certification Report (OCR) to all necessary parties every 3 months on a regular cycle spread out from a consistent point in each quarter. The OCR covers the entire period since the previous report and includes, at minimum:\n\n- Changes to FedRAMP Certification Data since the last OCR\n- Planned changes to FedRAMP Certification Data for at least the next 3 months\n- Accepted vulnerabilities\n- Transformative changes\n- Updated recommendations or best practices for security, configuration, or usage\n- A list of all agencies directly using the product\n- FedRAMP Reportable Incidents, or an attestation that no such incidents occurred\n- Lessons learned and changes made as a result of any FedRAMP Reportable Incidents\n\nThe target date for the next OCR is published alongside other public FedRAMP Certification Data. Sensitive information that would likely have an adverse effect on Securin is not disclosed in the OCR.", "The #MAIN COMPONENT ROLE is responsible for managing the development, documentation and dissemination of both [Data Protection Procedures: @Data Protection Procedures] and [Data Protection Policies: @Data Protection Policies].", "The #MAIN COMPONENT ROLE plans and coordinates security activities with applicable component owners. Activities include:\n\n- vulnerability scanning,\n\n- penetration testing,\n\n- security documentation reviews,\n\n- disaster recovery testing and execution,\n\n- physical and logical access reviews, and\n\n- capacity planning\n\n#THIS ORGANIZATION uses an email distribution list to notify team members involved in these activities.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM.", "The @Customer Admin implements #CAPABILITY TITLE on Securin" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSO-PKG", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "#THIS ORGANIZATION publishes an Ongoing Certification Report (OCR) to all necessary parties every 3 months on a regular cycle spread out from a consistent point in each quarter. The OCR covers the entire period since the previous report and includes, at minimum:\n\n- Changes to FedRAMP Certification Data since the last OCR\n- Planned changes to FedRAMP Certification Data for at least the next 3 months\n- Accepted vulnerabilities\n- Transformative changes\n- Updated recommendations or best practices for security, configuration, or usage\n- A list of all agencies directly using the product\n- FedRAMP Reportable Incidents, or an attestation that no such incidents occurred\n- Lessons learned and changes made as a result of any FedRAMP Reportable Incidents\n\nThe target date for the next OCR is published alongside other public FedRAMP Certification Data. Sensitive information that would likely have an adverse effect on Securin is not disclosed in the OCR.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSO-POP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSX-MOT", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSX-VVK", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "FRC-CSX-VVR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-DPR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "#THIS ORGANIZATION implements an [Incident Response Process: @Incident Response Process] that includes:\n\n- Preparation: Deploying monitoring technology, SIEM, Intrusion Detection, audit logging, automated alerting, and security training\n\n- Identification: Comprehensive logging, monitoring, and automated alerting for anomalies; manual monitoring by trained staff; and creating incident tickets to determine the anomaly's severity rating and best course of action\n\n- Containment: Discovering and defining steps to contain the issue, notifying affected parties via email, and conducting network and endpoint forensics\n\n- Eradication: Assessing actions required for long-term and/or permanent changes to prevent the issue from occurring again\n\n- Recovery: Restoring impacted systems, services, or functions to a full and secure operational status, with formal approval from the @Operations Admin and the @ISSO\n\n- Lessons Learned: Collecting all notes and documents to identify opportunities to improve the [Incident Response Process: @Incident Response Process].", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-EFI", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "#THIS ORGANIZATION implements an [Incident Response Process: @Incident Response Process] that includes:\n\n- Preparation: Deploying monitoring technology, SIEM, Intrusion Detection, audit logging, automated alerting, and security training\n\n- Identification: Comprehensive logging, monitoring, and automated alerting for anomalies; manual monitoring by trained staff; and creating incident tickets to determine the anomaly's severity rating and best course of action\n\n- Containment: Discovering and defining steps to contain the issue, notifying affected parties via email, and conducting network and endpoint forensics\n\n- Eradication: Assessing actions required for long-term and/or permanent changes to prevent the issue from occurring again\n\n- Recovery: Restoring impacted systems, services, or functions to a full and secure operational status, with formal approval from the @Operations Admin and the @ISSO\n\n- Lessons Learned: Collecting all notes and documents to identify opportunities to improve the [Incident Response Process: @Incident Response Process].", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-EFR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "#THIS ORGANIZATION implements an [Incident Response Process: @Incident Response Process] that includes:\n\n- Preparation: Deploying monitoring technology, SIEM, Intrusion Detection, audit logging, automated alerting, and security training\n\n- Identification: Comprehensive logging, monitoring, and automated alerting for anomalies; manual monitoring by trained staff; and creating incident tickets to determine the anomaly's severity rating and best course of action\n\n- Containment: Discovering and defining steps to contain the issue, notifying affected parties via email, and conducting network and endpoint forensics\n\n- Eradication: Assessing actions required for long-term and/or permanent changes to prevent the issue from occurring again\n\n- Recovery: Restoring impacted systems, services, or functions to a full and secure operational status, with formal approval from the @Operations Admin and the @ISSO\n\n- Lessons Learned: Collecting all notes and documents to identify opportunities to improve the [Incident Response Process: @Incident Response Process].", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "If an information spill occurs within Securin, the #MAIN COMPONENT ROLE follows the [Incident Response Plan: @Incident Response Plan] to contain the incident.\n\nThe #MAIN COMPONENT ROLE coordinates with relevant business units to determine who will investigate and remediate the incident. They triage affected components, assess eradication steps, and investigate possible replication of data in other areas. #THIS ORGANIZATION provides annual information spillage training and conducts tabletop exercises.\n\nThe #MAIN COMPONENT ROLE is the point of contact for reporting security incidents, including information spills, via phone, email, or via [Digital Forensics and Incident Response (DFIR): @Crowdstrike]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-FIR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION reports incidents to Federal stakeholders in the following ways:\n\n| To | Within | By |\n| --- | --- | --- |\n| FedRAMP | 1 hour of identification | Sending an email to fedramp\\_security@fedramp.gov |\n| All agency customers | 1 hour of identification | The incident communications points of contact provided by each agency customer |\n| CISA | 1 hour of identificationIf the incident is confirmed or suspected to be result of an attack vector listed at [https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy](https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy) | Using the CISA Incident Reporting System at: [https://myservices.cisa.gov/irf](https://myservices.cisa.gov/irf) |\n\nOnce initially notified, the #MAIN COMPONENT ROLE updates all necessary parties once per calendar day until the incident is resolved and recovery is complete.\n\nThe #MAIN COMPONENT ROLE makes incident report information available in #THIS ORGANIZATION's [Trust Center: @Paramify SaaS] without irresponsibly disclosing specific information about the incident that would increase the impact of the incident.\n\nOnce the incident is resolved, the #MAIN COMPONENT ROLE provides a final report which describes details about what occurred and why, as well as what the incident response methods were and how those could be improved upon for the future. The final incident report is provided in a human-readable and machine-readable format.\n\n\\[Incident Communications Procedures : Incident Communications Procedures\\] has an attestation that ensures that the #MAIN COMPONENT ROLE ensures all personnel receive incident response training (covering roles and responsibilities) within 90 days of hire and annually thereafter.", "The #MAIN COMPONENT ROLE manages [Incident Response Plan: @Incident Response Plan] and updates the plan at least annually to ensure the [Incident Response Process: @Incident Response Process] is consistently applied across the #THIS ORGANIZATION. Changes to Securin affecting the [Incident Response Plan: @Incident Response Plan] are included in updates, which also address concerns or difficulties during implementation, execution, or testing.\n\nTo better ensure the [Incident Response Plan: @Incident Response Plan] is helping meet #THIS ORGANIZATION incident response objectives, the #MAIN COMPONENT ROLE reviews these key metrics:\n\n- Number of alerts fired over x days\n\n- Number of requests received over x days\n\n- Number of investigations conducted over x days\n\n- Number of alerts closed over x days\n\n- Number of requests closed over x days\n\n- Number of investigations closed over x days\n\n- Number of hours spent on alerts, requests, and investigations\n\n- Number of tickets assigned by type and source\n\n- Number of discovery tickets created, closed\n\n- Number of false positive alerts over time, by type\n\n- Tickets closed per Affected User Department\n\n- Mean Time to Respond\n\n- Mean Time to Resolve\n\n- Mean Time to Close", "The #MAIN COMPONENT ROLE documents incident handling lessons learned in [File Storage: @EFS] to update response procedures, training and testing/exercises. Notes and documents are compiled to review incident timeline and actions, identify weaknesses, gaps, and inefficiencies. Improvement techniques are implemented, and recommendations are made with action items assigned to key stakeholders.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Once a security incident is identified, the #MAIN COMPONENT ROLE creates a ticket in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] to document and track the incident. After the ticket is created, the #MAIN COMPONENT ROLE collaborates with the @DevOps Admin to analyze the incident and determine the necessary remediation actions. The #MAIN COMPONENT ROLE works with applicable teams to fix the issue. Each step taken during the analysis and [Risk Remediation Process: @Risk Remediation Process] is documented in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] ticket until the incident has been resolved." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-IIR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION reports incidents to Federal stakeholders in the following ways:\n\n| To | Within | By |\n| --- | --- | --- |\n| FedRAMP | 1 hour of identification | Sending an email to fedramp\\_security@fedramp.gov |\n| All agency customers | 1 hour of identification | The incident communications points of contact provided by each agency customer |\n| CISA | 1 hour of identificationIf the incident is confirmed or suspected to be result of an attack vector listed at [https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy](https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy) | Using the CISA Incident Reporting System at: [https://myservices.cisa.gov/irf](https://myservices.cisa.gov/irf) |\n\nOnce initially notified, the #MAIN COMPONENT ROLE updates all necessary parties once per calendar day until the incident is resolved and recovery is complete.\n\nThe #MAIN COMPONENT ROLE makes incident report information available in #THIS ORGANIZATION's [Trust Center: @Paramify SaaS] without irresponsibly disclosing specific information about the incident that would increase the impact of the incident.\n\nOnce the incident is resolved, the #MAIN COMPONENT ROLE provides a final report which describes details about what occurred and why, as well as what the incident response methods were and how those could be improved upon for the future. The final incident report is provided in a human-readable and machine-readable format.\n\n\\[Incident Communications Procedures : Incident Communications Procedures\\] has an attestation that ensures that the #MAIN COMPONENT ROLE ensures all personnel receive incident response training (covering roles and responsibilities) within 90 days of hire and annually thereafter.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Once a security incident is identified, the #MAIN COMPONENT ROLE creates a ticket in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] to document and track the incident. After the ticket is created, the #MAIN COMPONENT ROLE collaborates with the @DevOps Admin to analyze the incident and determine the necessary remediation actions. The #MAIN COMPONENT ROLE works with applicable teams to fix the issue. Each step taken during the analysis and [Risk Remediation Process: @Risk Remediation Process] is documented in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] ticket until the incident has been resolved." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IEC-CSO-OIR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION reports incidents to Federal stakeholders in the following ways:\n\n| To | Within | By |\n| --- | --- | --- |\n| FedRAMP | 1 hour of identification | Sending an email to fedramp\\_security@fedramp.gov |\n| All agency customers | 1 hour of identification | The incident communications points of contact provided by each agency customer |\n| CISA | 1 hour of identificationIf the incident is confirmed or suspected to be result of an attack vector listed at [https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy](https://www.cisa.gov/federal-incident-notification-guidelines#attack-vectors-taxonomy) | Using the CISA Incident Reporting System at: [https://myservices.cisa.gov/irf](https://myservices.cisa.gov/irf) |\n\nOnce initially notified, the #MAIN COMPONENT ROLE updates all necessary parties once per calendar day until the incident is resolved and recovery is complete.\n\nThe #MAIN COMPONENT ROLE makes incident report information available in #THIS ORGANIZATION's [Trust Center: @Paramify SaaS] without irresponsibly disclosing specific information about the incident that would increase the impact of the incident.\n\nOnce the incident is resolved, the #MAIN COMPONENT ROLE provides a final report which describes details about what occurred and why, as well as what the incident response methods were and how those could be improved upon for the future. The final incident report is provided in a human-readable and machine-readable format.\n\n\\[Incident Communications Procedures : Incident Communications Procedures\\] has an attestation that ensures that the #MAIN COMPONENT ROLE ensures all personnel receive incident response training (covering roles and responsibilities) within 90 days of hire and annually thereafter.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Once a security incident is identified, the #MAIN COMPONENT ROLE creates a ticket in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] to document and track the incident. After the ticket is created, the #MAIN COMPONENT ROLE collaborates with the @DevOps Admin to analyze the incident and determine the necessary remediation actions. The #MAIN COMPONENT ROLE works with applicable teams to fix the issue. Each step taken during the analysis and [Risk Remediation Process: @Risk Remediation Process] is documented in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] ticket until the incident has been resolved." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IVV-CSO-FIA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION contracts with @Red Team for annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for the annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment.", "The @Customer Admin implements #CAPABILITY TITLE on Securin" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IVV-CSO-ICP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM.", "The @Customer Admin implements #CAPABILITY TITLE on Securin" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "IVV-CSX-AIA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION will have their goals and validation processes by an independent assessor or FedRAMP directly. This includes assessment of underlying code, pipelines, configurations, automation tools, etc. This assessment includes providing technical explanations, demonstrations, and other relevant supporting information to all necessary assessors. Providers can ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\n\\[Independent Assessment : Independent Assessment\\] has an attestation that ensures that the organization grants independent assessors access to [GRC Tool: @Paramify SaaS] for evidence review and actively participates in the assessment by demonstrating underlying code, pipelines, and automation tools.", "#THIS ORGANIZATION contracts with @Red Team for annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for the annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MAS-CSO-FLO", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE reviews and approves the data inventory at least annually or whenever significant changes to Securin occur. This process identifies which data types are stored and processed within Securin, their respective components, the protection measures in place for each data type, and the roles authorized to access them. The data inventory is maintained in [Compliance Deliverables Management: @Paramify SaaS].", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MAS-CSO-IIR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE reviews and approves the data inventory at least annually or whenever significant changes to Securin occur. This process identifies which data types are stored and processed within Securin, their respective components, the protection measures in place for each data type, and the roles authorized to access them. The data inventory is maintained in [Compliance Deliverables Management: @Paramify SaaS].", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MAS-CSO-TPR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The @Operations Admin oversees acquisition of external services. The @DevOps Admin defines functional requirements and engages @Operations Admin for product acquisition. The @GRC Admin conducts risk assessment prior to acquisition to ensure compliance with Securin security controls.", "The #MAIN COMPONENT ROLE ensures #THIS ORGANIZATION has SLAs with each Cloud Service Provider (CSP) as part of [Vendor Risk Management Process: @Vendor Risk Management Process], consistent with data protection requirements and processing agreements.", "The #MAIN COMPONENT ROLE annually reviews third-party assurance reports of vendors hosting customer data to ensure compliance with #THIS ORGANIZATION security requirements, including contingency requirements in [Vendor Management]. If gaps are found, management takes action to address their impact." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MKT-CSO-MLR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION provides relevant documentation explaining how to use the trust center and obtain authorization data to all necessary parties.", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MKT-CSO-PML", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "#THIS ORGANIZATION manages a single, owned process for completing and submitting the official FedRAMP forms and packages required to onboard Securin to the FedRAMP Marketplace and FedRAMP Certification. The @GRC Admin completes each required FedRAMP form before submission, including the FedRAMP Marketplace Provider Listing Request Form used to request a Marketplace listing (or updates to an existing listing) and the FedRAMP Certification Application Form used to request an initial assessment. Before requesting a listing or an update, #THIS ORGANIZATION addresses the FedRAMP Marketplace listing requirements, including making the required public information available, so each request is complete and accurate. Marketplace listing is completed first, so #THIS ORGANIZATION is listed in the FedRAMP Marketplace before it applies for FedRAMP Certification. #THIS ORGANIZATION submits its own application directly and does not use a third party to apply on its behalf, though third parties may help prepare application and assessment materials.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MKT-IIP-AGU", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE assesses remaining system vulnerabilities and determines risk acceptability for Customer/Agency operations. Based on the accreditation package and consultation, they may issue a provisional accreditation decision with/without restrictions, or not authorize for operation. If restrictions are placed, a detailed POA&M with corrective actions is required for a future updated accreditation package.", "#THIS ORGANIZATION establishes that the offering belongs in FedRAMP and is on a credible, time-bound path to certification. The @GRC Admin demonstrates a qualifying federal agency use case for the offering and commits it to a concrete assessment timeline, so its place in the Initial Implementation Phase is justified and clearly headed toward a full certification rather than lingering indefinitely.", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MKT-IIP-DCP", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "#THIS ORGANIZATION includes the following data in the Paramify Trust Center ([https://trust.paramify.com/](https://trust.paramify.com/)) and ensures that data is current, accurate, and not sensitive:\n\n1. Direct link to the FedRAMP Marketplace offering\n2. Service Model\n3. Deployment Model\n4. Business Category\n5. UEI Number\n6. Contact Information\n7. Overall Service Description\n8. Detailed list of specific services and their impact levels (see CDS-CSO-SVC)\n9. Summary of customer responsibilities and secure configuration guidance\n10. Ongoing Certification Documentation" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "MKT-IIP-DLA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION establishes that the offering belongs in FedRAMP and is on a credible, time-bound path to certification. The @GRC Admin demonstrates a qualifying federal agency use case for the offering and commits it to a concrete assessment timeline, so its place in the Initial Implementation Phase is justified and clearly headed toward a full certification rather than lingering indefinitely.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for the annual [Penetration Testing Process: @Penetration Testing Process] of Securin.", "The #MAIN COMPONENT ROLE updates the Security Assessment Plan of Securin annually, including security controls and enhancements, assessment procedures, and team roles and responsibilities. The assessment plan is approved by the @Authorizing Official prior to the commencement of the assessment." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "SDR-CSO-FRR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required.", "The #MAIN COMPONENT ROLE is responsible for managing the development, documentation and dissemination of both [Data Protection Procedures: @Data Protection Procedures] and [Data Protection Policies: @Data Protection Policies].", "For security authorization, the @Authorizing Official reviews the security authorization package to determine if identified vulnerabilities pose an acceptable risk. Authority to Operate (ATO) is granted after balancing security considerations with mission needs. Authorization package provides essential information for a credible risk-based decision.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "SDR-CSX-KMT", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "#THIS ORGANIZATION adheres to CR26 FedRAMP 20x Continuous Monitoring frequencies:\n\n- Ongoing monitoring of information system and auditable events, with incident reporting as necessary\n\n- Weekly audit review, analysis and reporting\n\n- Monthly vulnerability scanning, internal reporting of security status, flaw remediation, update of POA&M, and verification of security functions\n\n- Change/refresh authenticators every 60 days\n\n- Quarterly disablement of inactive user accounts\n\n- Annual activities including review and update of security policies and procedures, verification of continued access for account holders, security awareness and training, security assessment by a 3PAO, penetration testing, contingency plan training and testing, incident response training and testing, and review and update of access agreements and rules of behavior\n\n- Prevent reuse of identifiers every two years\n\n- Reauthorize Securin every three years, and review and update position categorizations and risk assessments as necessary\n\n- Rescreen personnel every five years.", "#THIS ORGANIZATION developed a [System Security Plan: @System Security Plan] for Securin consistent with the enterprise architecture. It defines:\n\n- authorization boundary and operational context,\n\n- security categorization of the system,\n\n- outline of the technical environment, control requirements, and rationale tailoring decisions.\n\nThe [System Security Plan: @System Security Plan] requires review and approval by @ISSO and @ISSM." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-CSO-DET", "frrImplementationStatus": "Implemented", "frrImplementation": [ "During development and testing, the #MAIN COMPONENT ROLE and @Developer analyze builds for vulnerabilities using [Code Scanning: @SonarQube]. Security flaws trigger a ticket in [System Development Management: @Jira] for the @Developer to fix. Only approved builds move to production. Remediation progress is monitored by the #MAIN COMPONENT ROLE.", "The #MAIN COMPONENT ROLE establishes a channel for receiving public vulnerability reports for relevant components within Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-TFR-MVX", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "Securin uses [GRC Tool: @Paramify SaaS] as the single authoritative source of record for all FedRAMP Certification Data. [GRC Tool: @Paramify SaaS] automatically generates both human-readable and machine-readable (JSON) representations of the Certification Data, the public offering profile, and the Certification Package Overview from this single source, so the formats remain consistent by construction. **When a FedRAMP rule provides a corresponding JSON schema, the generated JSON documents are validated against that schema prior to publication, unless the rule specifies otherwise.**\n\nEvery generated artifact includes the FedRAMP ID of the cloud service offering, or an assigned placeholder until FedRAMP issues one. The Certification Package Overview includes the official responsible and accountable for the FedRAMP Certification Package (name, title, and contact), version, date and time of last update, and source of update.\n\n#THIS ORGANIZATION can also generate Certification materials scoped to individual services within Securin, supplying per-service FedRAMP Certification materials where elected or required." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-TFR-PCD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "During development and testing, the #MAIN COMPONENT ROLE and @Developer analyze builds for vulnerabilities using [Code Scanning: @SonarQube]. Security flaws trigger a ticket in [System Development Management: @Jira] for the @Developer to fix. Only approved builds move to production. Remediation progress is monitored by the #MAIN COMPONENT ROLE.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-TFR-PDD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The @Customer Admin implements #CAPABILITY TITLE on Securin", "During development and testing, the #MAIN COMPONENT ROLE and @Developer analyze builds for vulnerabilities using [Code Scanning: @SonarQube]. Security flaws trigger a ticket in [System Development Management: @Jira] for the @Developer to fix. Only approved builds move to production. Remediation progress is monitored by the #MAIN COMPONENT ROLE.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-TFR-PSD", "frrImplementationStatus": "Implemented", "frrImplementation": [ "During development and testing, the #MAIN COMPONENT ROLE and @Developer analyze builds for vulnerabilities using [Code Scanning: @SonarQube]. Security flaws trigger a ticket in [System Development Management: @Jira] for the @Developer to fix. Only approved builds move to production. Remediation progress is monitored by the #MAIN COMPONENT ROLE.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VDR-TFR-PVR", "frrImplementationStatus": "Implemented", "frrImplementation": [ "Identified issues resulting from [Continuous Monitoring Process: @Continuous Monitoring Process] are given owners and tracked to remediation via [GRC Tool: @Paramify SaaS].", "Automated patching of Securin infrastructure is configured by the #MAIN COMPONENT ROLE using [Inventory Management: @Amazon Systems Manager]. Approved patches are deployed during the next scheduled maintenance window.", "[Compliance Deliverables Management: @Paramify SaaS] acts as the central automation engine and system of record for compliance activities. They provide the technical infrastructure, workflow templates, and data integration capabilities to facilitate Automated Detection and risk-based analysis based on Internet-Reachability, Likely Exploitability, and Potential Adverse Impact. It serves as the primary interface for the documentation and oversight of controls.\n\nThe platform specifically enables:\n\n- Machine-Readable History: Automates the availability of recent historical vulnerability detection and response activity in a machine-readable format for retrieval, updated at least every 14 days.\n\n- Detection Infrastructure: Provides the dedicated modules and scheduling capabilities required to track recurring machine-based and resource-specific detection cycles.\n\n- Standardized Scoring: Automates the correlation of technical telemetry against mission-critical evaluation factors to ensure consistent prioritization based on actual risk.\n\nThe #MAIN COMPONENT ROLE is responsible for the active configuration and management of [Compliance Deliverables Management: @Paramify SaaS] to ensure all FedRAMP 20x Class A compliance timelines and control requirements are met. The #MAIN COMPONENT ROLE manages the operational triage of vulnerabilities by importing data from security tools, performing manual validation to identify False Positives, and consolidating identical machine resources into Logical Groupings.\n\nNOTE: Pick the VDR Operational Requirements and the 20x timeframes table that are relevant to your FedRAMP impact level.\n\n20x Low - VDR operational requirements\n\nTo satisfy Low-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection cadences: Perform Weekly Sampling for similar machine-based resources, Monthly Drift Detection for high-drift resources, and Six-Month Detection for stable resources.\n\n- Rapid evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 7 days of detection.\n\n- Incident management: No baseline-specific incident treatment requirement at Low. Standard incident communications procedures (ICP) still apply.\n\n- Mitigation timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Low maximum timeframes (e.g., 4 days for LEV+IRV N5) based on their risk profile.\n\n20x Moderate - VDR operational requirements\n\nTo satisfy Moderate-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection Cadences: Perform 3-Day Sampling for similar machine-based resources, 14-Day Drift Detection for high-drift resources, and Monthly Detection for stable resources.\n\n- Rapid Evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 5 days of detection.\n\n- Incident Management: Treat internet-reachable, likely exploitable vulnerabilities with a potential adverse impact of N4 or N5 as security incidents until partially mitigated to N3 or below.\n\n- Mitigation Timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Moderate maximum timeframes (e.g., 24 hours for LEV+IRV N5) based on their risk profile.\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 4 | 8 | 32 |\n| N4 | 8 | 32 | 64 |\n| N3 | 32 | 64 | 192 |\n| N2 | 96 | 160 | 192 |\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 2 | 4 | 16 |\n| N4 | 4 | 8 | 64 |\n| N3 | 16 | 32 | 128 |\n| N2 | 48 | 128 | 192 |", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk].", "The @GRC Admin is responsible for managing all interactions with external oversight bodies, ensuring that the organization does not reject requests for information from Law Enforcement, Congress, Inspectors General, or the FedRAMP PMO. The @GRC Admin ensures that human-readable reports are distributed to all necessary parties at least monthly, summarizing all detection and response activity since the previous report. When triggered by a CAP or a specific investigation, [GRC Tool: @Paramify SaaS] is used to generate alternative reports or provide the sensitive details necessary for an informed risk-based decision by government investigators." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VER-EVA-EPA", "frrImplementationStatus": "Implemented", "frrImplementation": [ "The #MAIN COMPONENT ROLE establishes a channel for receiving public vulnerability reports for relevant components within Securin.", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VER-TFR-EVU", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION conducts [Penetration Testing Process: @Penetration Testing Process] on Securin to detect any non-public information that is publicly accessible. If any such information is found, it is investigated and remediated following the [Incident Response Process: @Incident Response Process].", "The #MAIN COMPONENT ROLE establishes a channel for receiving public vulnerability reports for relevant components within Securin.", "[Compliance Deliverables Management: @Paramify SaaS] acts as the central automation engine and system of record for compliance activities. They provide the technical infrastructure, workflow templates, and data integration capabilities to facilitate Automated Detection and risk-based analysis based on Internet-Reachability, Likely Exploitability, and Potential Adverse Impact. It serves as the primary interface for the documentation and oversight of controls.\n\nThe platform specifically enables:\n\n- Machine-Readable History: Automates the availability of recent historical vulnerability detection and response activity in a machine-readable format for retrieval, updated at least every 14 days.\n\n- Detection Infrastructure: Provides the dedicated modules and scheduling capabilities required to track recurring machine-based and resource-specific detection cycles.\n\n- Standardized Scoring: Automates the correlation of technical telemetry against mission-critical evaluation factors to ensure consistent prioritization based on actual risk.\n\nThe #MAIN COMPONENT ROLE is responsible for the active configuration and management of [Compliance Deliverables Management: @Paramify SaaS] to ensure all FedRAMP 20x Class A compliance timelines and control requirements are met. The #MAIN COMPONENT ROLE manages the operational triage of vulnerabilities by importing data from security tools, performing manual validation to identify False Positives, and consolidating identical machine resources into Logical Groupings.\n\nNOTE: Pick the VDR Operational Requirements and the 20x timeframes table that are relevant to your FedRAMP impact level.\n\n20x Low - VDR operational requirements\n\nTo satisfy Low-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection cadences: Perform Weekly Sampling for similar machine-based resources, Monthly Drift Detection for high-drift resources, and Six-Month Detection for stable resources.\n\n- Rapid evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 7 days of detection.\n\n- Incident management: No baseline-specific incident treatment requirement at Low. Standard incident communications procedures (ICP) still apply.\n\n- Mitigation timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Low maximum timeframes (e.g., 4 days for LEV+IRV N5) based on their risk profile.\n\n20x Moderate - VDR operational requirements\n\nTo satisfy Moderate-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection Cadences: Perform 3-Day Sampling for similar machine-based resources, 14-Day Drift Detection for high-drift resources, and Monthly Detection for stable resources.\n\n- Rapid Evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 5 days of detection.\n\n- Incident Management: Treat internet-reachable, likely exploitable vulnerabilities with a potential adverse impact of N4 or N5 as security incidents until partially mitigated to N3 or below.\n\n- Mitigation Timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Moderate maximum timeframes (e.g., 24 hours for LEV+IRV N5) based on their risk profile.\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 4 | 8 | 32 |\n| N4 | 8 | 32 | 64 |\n| N3 | 32 | 64 | 192 |\n| N2 | 96 | 160 | 192 |\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 2 | 4 | 16 |\n| N4 | 4 | 8 | 64 |\n| N3 | 16 | 32 | 128 |\n| N2 | 48 | 128 | 192 |", "#THIS ORGANIZATION contracts with a CR26 FedRAMP 20x-accredited @Red Team for annual vulnerability scanning and penetration testing of the Securin environment.\n\nMonthly vulnerability scanning is performed by #THIS ORGANIZATION for:\n\n- Servers: [Infrastructure Scanning: @Securin ASPM]\n\n- Containers: [Container Scanning: @Securin ASPM]\n\n- Databases: [Infrastructure Scanning: @Securin ASPM]\n\n- Web: [Application Scanning: @SonarQube]\n\nThe POA&M document is updated monthly with remediation activities for any high, moderate, or low-risk vulnerabilities identified in ongoing assessments and scans. Raw scan reports are made available to @Authorizing Official monthly.", "The #MAIN COMPONENT ROLE manages the timely resolution of vulnerabilities, categorized by severity:\n\n- Critical-risk: within 2 days,\n\n- High-risk: within 30 days,\n\n- Moderate-risk: within 90 days,\n\n- Low-risk: within 180 days.\n\nVulnerabilities are logged, assigned to respective component owners, and tracked to resolution in [IT Service Management: @Zoho Desk]." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VER-TFR-IRI", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "[Compliance Deliverables Management: @Paramify SaaS] acts as the central automation engine and system of record for compliance activities. They provide the technical infrastructure, workflow templates, and data integration capabilities to facilitate Automated Detection and risk-based analysis based on Internet-Reachability, Likely Exploitability, and Potential Adverse Impact. It serves as the primary interface for the documentation and oversight of controls.\n\nThe platform specifically enables:\n\n- Machine-Readable History: Automates the availability of recent historical vulnerability detection and response activity in a machine-readable format for retrieval, updated at least every 14 days.\n\n- Detection Infrastructure: Provides the dedicated modules and scheduling capabilities required to track recurring machine-based and resource-specific detection cycles.\n\n- Standardized Scoring: Automates the correlation of technical telemetry against mission-critical evaluation factors to ensure consistent prioritization based on actual risk.\n\nThe #MAIN COMPONENT ROLE is responsible for the active configuration and management of [Compliance Deliverables Management: @Paramify SaaS] to ensure all FedRAMP 20x Class A compliance timelines and control requirements are met. The #MAIN COMPONENT ROLE manages the operational triage of vulnerabilities by importing data from security tools, performing manual validation to identify False Positives, and consolidating identical machine resources into Logical Groupings.\n\nNOTE: Pick the VDR Operational Requirements and the 20x timeframes table that are relevant to your FedRAMP impact level.\n\n20x Low - VDR operational requirements\n\nTo satisfy Low-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection cadences: Perform Weekly Sampling for similar machine-based resources, Monthly Drift Detection for high-drift resources, and Six-Month Detection for stable resources.\n\n- Rapid evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 7 days of detection.\n\n- Incident management: No baseline-specific incident treatment requirement at Low. Standard incident communications procedures (ICP) still apply.\n\n- Mitigation timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Low maximum timeframes (e.g., 4 days for LEV+IRV N5) based on their risk profile.\n\n20x Moderate - VDR operational requirements\n\nTo satisfy Moderate-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection Cadences: Perform 3-Day Sampling for similar machine-based resources, 14-Day Drift Detection for high-drift resources, and Monthly Detection for stable resources.\n\n- Rapid Evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 5 days of detection.\n\n- Incident Management: Treat internet-reachable, likely exploitable vulnerabilities with a potential adverse impact of N4 or N5 as security incidents until partially mitigated to N3 or below.\n\n- Mitigation Timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Moderate maximum timeframes (e.g., 24 hours for LEV+IRV N5) based on their risk profile.\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 4 | 8 | 32 |\n| N4 | 8 | 32 | 64 |\n| N3 | 32 | 64 | 192 |\n| N2 | 96 | 160 | 192 |\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 2 | 4 | 16 |\n| N4 | 4 | 8 | 64 |\n| N3 | 16 | 32 | 128 |\n| N2 | 48 | 128 | 192 |" ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VER-TFR-MRH", "frrImplementationStatus": "Implemented", "frrImplementation": [ "At agreed-upon intervals, #THIS ORGANIZATION provides evidence of continuous monitoring and control assessments to the @Authorizing Official. The following content is provided monthly:\n\n- Vulnerability scanning: #THIS ORGANIZATION system scan reports and scan results are managed and mitigated in POA&Ms.\n\n- POA&M updates\n\nThe following security authorization documentation is provided annually:\n\nPolicies and procedures\n\n- [System Security Plan: @System Security Plan]\n\n- [Contingency Plan: @Contingency Plan],\n\n- [Configuration Management Plan: @Configuration Management Plan],\n\n- [Incident Response Plan: @Incident Response Plan]\n\n- Information Security Awareness and Personnel Training Records\n\n- Annual CR26 FedRAMP 20x Assessment: Delivered by a CR26 FedRAMP 20x-accredited 3PAO.\n\n- Incident Response Plan Test Report\n\n- Contingency Plan Test Report", "The @InfoSec Admin ensures the historical vulnerability detection and response activity made available for automated retrieval is updated persistently, at least once every 14 days.\n\nNote: Replace following text and brackets with appropriate validator mention and context.\n\nProgramatic Access to VDR data \\[Vulnerability Detection and Response : VDP Effectiveness Review\\] has an attestation that ensures that the Vulnerability Disclosure Program is actively monitored for effectiveness by reviewing public documentation, verifying the triage of incoming reports in the issue tracker, and auditing public repositories for secure communication.", "#THIS ORGANIZATION shares [Vulnerability Scanning Process: @Vulnerability Scanning Process] results and the Security Assessment Results (SAR) with the Customer ISSM, Customer ISSO, OMB MAX, and @Authorizing Official through DoD EMASS." ], "frrValidation": [], "frrAssessment": [] }, { "frrID": "VER-TFR-NRI", "frrImplementationStatus": "Implemented", "frrImplementation": [ "#THIS ORGANIZATION evaluates, rates, and reports incidents in accordance with FedRAMP Incident Evaluation and Communications rules. The @Incident Response Admin promptly evaluates each incident to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data; such incidents are treated as FedRAMP Reportable Incidents. For each FedRAMP Reportable Incident, #THIS ORGANIZATION promptly estimates the likely adverse impact on agency customers to assign a Potential Agency Impact N-rating (PAIN); until that rating is estimated, the incident is treated as if it has a PAIN rating of 5.\n\n#THIS ORGANIZATION responsibly notifies all affected parties across the incident lifecycle: an Initial Incident Report after identifying a FedRAMP Reportable Incident, Ongoing Incident Reports as new information becomes available during response, and a Final Incident Report once the incident is resolved and recovery is complete. Automation is used where practical to minimize human intervention in reporting to affected parties. Reports are generated in the FedRAMP-defined formats and validated against the corresponding FedRAMP JSON schema where one is provided.", "#THIS ORGANIZATION personnel report suspected or actual security incidents to the #MAIN COMPONENT ROLE. #THIS ORGANIZATION also detects potential incidents from sources, including:\n\n- [Security Information and Event Management (SIEM): @Amazon Security Hub]\n\n- [Infrastructure Scanning: @Securin ASPM] Vulnerability Scans\n\n- US-CERT\n\n- Vendor bulletins and reports\n\n@Security Operations Center Admin flags events for the #MAIN COMPONENT ROLE to review. The #MAIN COMPONENT ROLE creates an incident in [Digital Forensics and Incident Response (DFIR): @Crowdstrike] after confirming the event is a security incident. The #MAIN COMPONENT ROLE analyzes and remediates the incident, documenting each step in the [Digital Forensics and Incident Response (DFIR): @Crowdstrike] until it is resolved.", "All personnel from #THIS ORGANIZATION must report any suspected or actual security incidents, including insider threats, to the #MAIN COMPONENT ROLE via email, as indicated in the [Incident Response Plan: @Incident Response Plan]. Incidents should be reported within 1 hour of discovery, and the timeframes for different incident categories (see table) should be followed, unless the data owner specifies a more restrictive guidance.\n\nIncident Category Description Impact Notification Time Requirement\n\n1 Root Level Intrusion Moderate 2 Hours\n\n2 User Level Intrusion Moderate 2 Hours\n\n3 Unsuccessful Activity Attempt N/A 4 Hours\n\n4 Denial of Service Mod/High 15 Minutes\n\n5 Non-Compliance Activity N/A 4 Hours\n\n6 Reconnaissance N/A 4 Hours\n\n7 Malicious Logic Moderate 2 Hours\n\nAfter formally documenting and discovering an incident, the responding party communicates updates and remediation actions to all appropriate stakeholders. The type of incident determines which stakeholders are notified, including the affected organizations, the @InfoSec Admin, @Operations Admin, and support organizations.\n\nStakeholders receive an email from the #MAIN COMPONENT ROLE, including the following information:\n\n- Issue name/identifier\n\n- Summary, impact\n\n- Current status\n\n- Stakeholders\n\n- Affected parties\n\n- Facts to date\n\n- Actions\n\n- How to learn more\n\n- Engagement/Update plan", "[Compliance Deliverables Management: @Paramify SaaS] acts as the central automation engine and system of record for compliance activities. They provide the technical infrastructure, workflow templates, and data integration capabilities to facilitate Automated Detection and risk-based analysis based on Internet-Reachability, Likely Exploitability, and Potential Adverse Impact. It serves as the primary interface for the documentation and oversight of controls.\n\nThe platform specifically enables:\n\n- Machine-Readable History: Automates the availability of recent historical vulnerability detection and response activity in a machine-readable format for retrieval, updated at least every 14 days.\n\n- Detection Infrastructure: Provides the dedicated modules and scheduling capabilities required to track recurring machine-based and resource-specific detection cycles.\n\n- Standardized Scoring: Automates the correlation of technical telemetry against mission-critical evaluation factors to ensure consistent prioritization based on actual risk.\n\nThe #MAIN COMPONENT ROLE is responsible for the active configuration and management of [Compliance Deliverables Management: @Paramify SaaS] to ensure all FedRAMP 20x Class A compliance timelines and control requirements are met. The #MAIN COMPONENT ROLE manages the operational triage of vulnerabilities by importing data from security tools, performing manual validation to identify False Positives, and consolidating identical machine resources into Logical Groupings.\n\nNOTE: Pick the VDR Operational Requirements and the 20x timeframes table that are relevant to your FedRAMP impact level.\n\n20x Low - VDR operational requirements\n\nTo satisfy Low-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection cadences: Perform Weekly Sampling for similar machine-based resources, Monthly Drift Detection for high-drift resources, and Six-Month Detection for stable resources.\n\n- Rapid evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 7 days of detection.\n\n- Incident management: No baseline-specific incident treatment requirement at Low. Standard incident communications procedures (ICP) still apply.\n\n- Mitigation timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Low maximum timeframes (e.g., 4 days for LEV+IRV N5) based on their risk profile.\n\n20x Moderate - VDR operational requirements\n\nTo satisfy Moderate-baseline requirements, the Implementer must tune the platform to execute and document the following:\n\n- Detection Cadences: Perform 3-Day Sampling for similar machine-based resources, 14-Day Drift Detection for high-drift resources, and Monthly Detection for stable resources.\n\n- Rapid Evaluation: Evaluate all detected vulnerabilities as required by VDR-07, VDR-08, and VDR-09 within 5 days of detection.\n\n- Incident Management: Treat internet-reachable, likely exploitable vulnerabilities with a potential adverse impact of N4 or N5 as security incidents until partially mitigated to N3 or below.\n\n- Mitigation Timeframes: Ensure vulnerabilities are partially mitigated, fully mitigated, or remediated within the specific Moderate maximum timeframes (e.g., 24 hours for LEV+IRV N5) based on their risk profile.\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 4 | 8 | 32 |\n| N4 | 8 | 32 | 64 |\n| N3 | 32 | 64 | 192 |\n| N2 | 96 | 160 | 192 |\n\n| Potential Adverse Impact | LEV + IRV | LEV + NIRV | NLEV |\n| --- | --- | --- | --- |\n| N5 | 2 | 4 | 16 |\n| N4 | 4 | 8 | 64 |\n| N3 | 16 | 32 | 128 |\n| N2 | 48 | 128 | 192 |" ], "frrValidation": [], "frrAssessment": [] } ], "keySecurityIndicators": [ { "ksiId": "KSI-CED-RAT", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "#THIS ORGANIZATION mandates security training with [Security Learning Management System: @Custom Security Learning Management System] before access to Securin. The training covers basic security principles, social engineering risks, supply chain risks, credential protection and remote access risk. This training is updated and documented annually, or when events dictate a revision of content. Employees' training records are kept in [HR Platform: @Rippling] for at least five years.", "#THIS ORGANIZATION employees receive annual training or training when there is a change to the Securin . The @Change Control Board sends email notifications to the #MAIN COMPONENT ROLE training module staff for training updates. Managers email employees when training is due and follow up on delinquent reports. All training is recorded and retained for five years in [Security Learning Management System: @Custom Security Learning Management System]." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-CMT-LMC", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "The #MAIN COMPONENT ROLE is notified of deployed changes via [Event Notifications: @SNS].", "Change proposals for Securin are assessed in [System Development Management: @Jira] by component owners, encompassing activities and decisions. The @Change Control Board conducts bi-weekly monitoring of the [Change Management Process: @Change Management Process]. Only administrators with [Privileged Access Management: @Identity Center] authorization can execute changes.\n\nThe @DevOps Admin tracks and records all releases for Securin indefinitely using [CI/CD Runners: @Jenkins]." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-CNA-RNT", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "#THIS ORGANIZATION authorizes and documents all internal Securin connections in line with the [Change Management Process: @Change Management Process]. The process, led by the @Change Control Board and documented in [Project Management: @Jira], includes risk, security, and regression testing. This applies to components like admin laptops and productivity tools, which are tested, assessed, and hardened to standards. Internal connections extending outside the system boundary are also documented, outlining their security requirements and interface details.", "Any exceptions to the traffic flow policy require approval via [Change Management Process: @Change Management Process] with a review to evaluate the need and business justification. Once the exception is no longer needed, the associated interface is reconfigured to default policy and the ticket closed. Exceptions are reviewed by the #MAIN COMPONENT ROLE at least annually.", "External systems accessing Securin must meet #THIS ORGANIZATION data protection requirements, verified through [Vendor Risk Management Process: @Vendor Risk Management Process]. The #MAIN COMPONENT ROLE reviews interconnections on a monthly basis to ensure all interconnections are approved." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-IAM-AAM", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "The #MAIN COMPONENT ROLE is responsible for managing account access to their own Securin environment and network.", "#MAIN COMPONENT ROLE conduct the [Logical Access Certification Process: @Logical Access Certification Process] for Securin monthly, using access groups within [Identity Management: @Google Directory]. Users are validated to determine whether they need continued access. If no response is given, the user is automatically removed from the corresponding [Identity Management: @Google Directory] group." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-IAM-APM", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "Securin accepts authorized O-Auth/SAML/OIDC authentication from the customer's Identity Management Service Provider.", "Securin uses #MAIN COMPONENT, a component of #LEVERAGED SYSTEM, to implement #CAPABILITY TITLE controls.", "The #MAIN COMPONENT ROLE configures Securin to require Multi-factor Authentication (MFA) using both [Identity Management: @Google Directory] and [Multi-Factor Authentication: @Google Directory] as the second factor for authentication. This applies to all logical access to Securin, including privileged sessions and remote access.", "#THIS ORGANIZATION personnel do not use PIV credentials to access the environment, as they are not government employees. The federal customer is responsible for this control." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-INR-RIR", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "The #MAIN COMPONENT ROLE manages [Incident Response Plan: @Incident Response Plan] and updates the plan at least annually to ensure the [Incident Response Process: @Incident Response Process] is consistently applied across the #THIS ORGANIZATION. Changes to Securin affecting the [Incident Response Plan: @Incident Response Plan] are included in updates, which also address concerns or difficulties during implementation, execution, or testing.\n\nTo better ensure the [Incident Response Plan: @Incident Response Plan] is helping meet #THIS ORGANIZATION incident response objectives, the #MAIN COMPONENT ROLE reviews these key metrics:\n\n- Number of alerts fired over x days\n\n- Number of requests received over x days\n\n- Number of investigations conducted over x days\n\n- Number of alerts closed over x days\n\n- Number of requests closed over x days\n\n- Number of investigations closed over x days\n\n- Number of hours spent on alerts, requests, and investigations\n\n- Number of tickets assigned by type and source\n\n- Number of discovery tickets created, closed\n\n- Number of false positive alerts over time, by type\n\n- Tickets closed per Affected User Department\n\n- Mean Time to Respond\n\n- Mean Time to Resolve\n\n- Mean Time to Close", "[Incident Response Plan: @Incident Response Plan] provides a detailed roadmap for implementing incident response in #THIS ORGANIZATION, with assigned roles and responsibilities. The [Incident Response Plan: @Incident Response Plan] defines reportable incidents and assigns a severity level based on the incident characteristics." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] }, { "ksiId": "KSI-SVC-SIN", "ksiImplementationStatus": "Implemented", "ksiImplementation": [ "All services/products within Securin use FIPS-validated encryption for customer information in transit and at rest. Authorized validation component details can be found in the Cryptographic Modules Table.", "All authentication mechanisms to cryptographic modules, including those in Securin, [Identity Management: @Google Directory], and [Privileged Access Management: @Identity Center], use FIPS 140-2 validated AES-256 encryption algorithms. [Operating System: @Amazon Linux 2] crypto modules also use AES-256 and are FIPS validated and listed in the NIST Cryptographic Module Validation Program (CMVP)." ], "ksiValidation": [], "ksiAssessment": [], "ksiTests": [], "ksiEvidence": [] } ] }