[NIST SP 800-128] Information Security Continuous Monitoring for Federal Information Systems and Organizations [NIST SP 800-137] Managing Information Security Risk [NIST SP 800-39] Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication 200] Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-1] Recommended Security Controls for Federal Information Systems [NIST SP Revision 3] Risk Management Guide for Information Technology Systems [NIST SP 800-30] Security Considerations in the System Development Life [NIST SP 800-64, Revision 2] Security Requirements for Cryptographic Modules [FIPS Publication 140-2] Standards for Security Categorization of Federal Information and Information Systems [FIPS Publication 199] Technical Guide to Information Security Testing and Assessment [NIST SP Purpose The purpose of this document is to provide the system owner, <CSP>, and the FedRAMP Joint Authorization Board (JAB) with a (SAR) for the Security Assessment Report <Information System Name>. A security assessment has been performed on the <Information System Name> to evaluate the system’s implementation of, and compliance with, the FedRAMP baseline security controls. The implementation of security controls is described in the System Security Plan, and required by FedRAMP to meet (FISMA) compliance mandate. Federal Information Security Management Act The FedRAMP program requires Cloud Service Providers (CSPs) to use FedRAMP Accepted Third Party Assessment Organizations (3PAO) to perform independent security assessment testing and development of the SAR. Security testing for <Information System Name> was performed by <3PAO> in accordance with the <Information System Name> Security Assessment Plan, dated <date>. Scope This SAR applies to the <Information System Name> which is managed and operated by <CSP>. The <Information System Name> that is being reported on in this document has a unique identifier which is noted in Table 1-1. Table 1-1. Information System Unique Identifer, Name, and Abbreviation Unique Identifier Information System Abbreviation Information System Name
[NIST SP 800-128] Information Security Continuous Monitoring for Federal Information Systems and Organizations [NIST SP 800-137] Managing Information Security Risk [NIST SP 800-39] Minimum Security Requirements for Federal Information and Information Systems [FIPS Publication 200] Personal Identity Verification (PIV) of Federal Employees and Contractors [FIPS Publication 201-1] Recommended Security Controls for Federal Information Systems [NIST SP Revision 3] Risk Management Guide for Information Technology Systems [NIST SP 800-30] Security Considerations in the System Development Life [NIST SP 800-64, Revision 2] Security Requirements for Cryptographic Modules [FIPS Publication 140-2] Standards for Security Categorization of Federal Information and Information Systems [FIPS Publication 199] Technical Guide to Information Security Testing and Assessment [NIST SP Purpose The purpose of this document is to provide the system owner, <CSP>, and the FedRAMP Joint Authorization Board (JAB) with a Security Assessment Report (SAR) for the <Information System Name>. A security assessment has been performed on the <Information System Name> to evaluate the system’s implementation of, and compliance with, the FedRAMP baseline security controls. The implementation of security controls is described in the System Security Plan, and required by FedRAMP to meet Federal Information Security Management Act (FISMA) compliance mandate. The FedRAMP program requires Cloud Service Providers (CSPs) to use FedRAMP Accepted Third Party Assessment Organizations (3PAO) to perform independent security assessment testing and development of the SAR. Security testing for <Information System Name> was performed by <3PAO> in accordance with the <Information System Name> Security Assessment Plan, dated <date>. Scope This SAR applies to the <Information System Name> which is managed and operated by <CSP>. The <Information System Name> that is being reported on in this document has a unique identifier which is noted in Table 1-1. Table 1-1. Information System Unique Identifer, Name, and Abbreviation Unique Identifier Information System Name Information System Abbreviation