For controls that do not have a check in either the Responsibility” or Note: “CSP “Independent Assessor Responsibility” columns in Table A-1, FedRAMP LI-SaaS CSPs is required to Tailored provide evidence of compliance, minimally during annual assessment and upon request. Table A-1 Summary of FedRAMP Tailored LI-SaaS ConMon Activities and Deliverables – Independent Row Control CSP Continuous Monitoring Activity Assessor Notes # ID Name Responsibility Responsibility Ongoing 1 CP-9 Information CSP determines what elements of X System the cloud environment require Backup information system backup control (e.g., user-level information, system-level information). The service provider shall determine how information system backup is going to be verified and periodically checked (e.g., daily incremental; weekly full). CSP determines how backups are maintained (e.g., online, offline). 2 SI-2 Flaw Installs security-relevant software X Remediation and firmware updates within thirty (30) days of the release of the updates. Weekly 3 AU-6 Audit CSPs must review and analyze X Review, information system audit records Analysis, for indications of inappropriate or and unusual activity. Reports findings Reporting of inappropriate or unusual activity to incident response team. Monthly 4 CA-7 Continuous CSPs must report the security state X Monitoring of the system to the AOs on a monthly basis. 5 CM-8 Information CSPs must review and update the X System information system component Component inventory and deliver to AO at Inventory least monthly.
Note: For controls that do not have a check in either the “CSP Responsibility” or “Independent Assessor Responsibility” columns in Table A-1, FedRAMP Tailored LI-SaaS CSPs is required to provide evidence of compliance, minimally during annual assessment and upon request. Table A-1 – Summary of FedRAMP Tailored LI-SaaS ConMon Activities and Deliverables Row # ID Control Name Continuous Monitoring Activity CSP Responsibility Independent Assessor Responsibility Notes Ongoing 1 CP-9 Information System Backup CSP determines what elements of the cloud environment require information system backup control (e.g., user-level information, system-level information). The service provider shall determine how information system backup is going to be verified and periodically checked (e.g., daily incremental; weekly full). CSP determines how backups are maintained (e.g., online, offline). X 2 SI-2 Flaw Remediation Installs security-relevant software and firmware updates within thirty (30) days of the release of the updates. X Weekly 3 AU-6 Audit Review, Analysis, and Reporting CSPs must review and analyze information system audit records for indications of inappropriate or unusual activity. Reports findings of inappropriate or unusual activity to incident response team. X Monthly 4 CA-7 Continuous Monitoring CSPs must report the security state of the system to the AOs on a monthly basis. X 5 CM-8 Information System Component Inventory CSPs must review and update the information system component inventory and deliver to AO at least monthly. X