2.4.2.1 SECURITY ASSESSMENT The 3PAO prepares and submits the as part of the FedRAMP Security Assessment Test Cases SAR. The test cases contain all the FedRAMP NIST SP 800-53, revision 4, control requirements with associated required test methods. The 3PAO completes the observations and evidence, implementation status, findings, and risk exposure information. 2.4.2.1.1 1: This System worksheet provides system and CSP general information. Table 2- 6 Security Assessment Test Cases System Content Description –FedRAMP – Column A Column B This is the name of the system. System This is the name of the CSP. CSP Name This is the security impact level of the system (Moderate/Low). Sensitivity Level 2.4.2.1.1 2: The CtrlSummary worksheet provides the test results summary of all the test cases. Table 2- 7 FedRAMP Security Assessment Test Cases Control Summary Column Content Description – – Column Header Content Description This is the NIST SP 800-53 revision 4 unique control identifier. Column A - ID This is the NIST SP 800-53 revision 4 control title. Column B – TITLE (NIST SP 800-53 Rev 4) This lists the FedRAMP NIST SP 800-53 revision 4 baseline Column C –Control controls at the low impact level. Baseline – Low This lists the FedRAMP NIST SP 800-53 revision 4 baseline Column D –Control controls at the moderate impact level. Baseline – Moderate Specify the implementation status of the control at the Column E – completion of testing [implemented/partially implemented/ Implementation Status planned/ alternative implementation/not applicable].
2.4.2.1 SECURITY ASSESSMENT The 3PAO prepares and submits the FedRAMP Security Assessment Test Cases as part of the SAR. The test cases contain all the FedRAMP NIST SP 800-53, revision 4, control requirements with associated required test methods. The 3PAO completes the observations and evidence, implementation status, findings, and risk exposure information. 2.4.2.1.1 1: This System worksheet provides system and CSP general information. Table 2- 6 –FedRAMP Security Assessment Test Cases – System Content Description Column A Column B System This is the name of the system. CSP Name This is the name of the CSP. Sensitivity Level This is the security impact level of the system (Moderate/Low). 2.4.2.1.1 2: The CtrlSummary worksheet provides the test results summary of all the test cases. Table 2- 7 – FedRAMP Security Assessment Test Cases – Control Summary Column Content Description Column Header Content Description Column A - ID This is the NIST SP 800-53 revision 4 unique control identifier. Column B – TITLE (NIST SP 800-53 Rev 4) This is the NIST SP 800-53 revision 4 control title. Column C –Control Baseline – Low This lists the FedRAMP NIST SP 800-53 revision 4 baseline controls at the low impact level. Column D –Control Baseline – Moderate This lists the FedRAMP NIST SP 800-53 revision 4 baseline controls at the moderate impact level. Column E – Implementation Status Specify the implementation status of the control at the completion of testing [implemented/partially implemented/ planned/ alternative implementation/not applicable].