planned/ alternative implementation/not applicable]. Specify the status of the control at the completion of testing Column I – Findings [satisfied/other than satisfied]. Specify the likelihood a threat will exploit the vulnerability Column J – Likelihood identified [high/moderate/low]. Specify the impact to the system if the threat successfully Column K – Impact exploits the vulnerability [high/moderate/low]. Specify the risk exposure to the system if the vulnerability Column L – Risk Exposure associated with this control is exploited [high/moderate/low]. Fully describe the details of the risks to this specific system if the Column M – Risk vulnerability is exploited. Description Fully describe the recommendation for remediation of the risk Column N - associated with this control. Recommendation for Mitigation Specify the assessor name and contact information [e.g., email, Column O – Assessor POC phone] for each test. Specify the status of a prior finding associated with this control. Column P – Prior Findings [satisfied/other than satisfied]. Specify the risk exposure to the system if the vulnerability Column Q – Prior Risk associated with this control is exploited. [high/moderate/low]. 2.5 (POA&M) The CSP prepares and submits the Plan of Action and Milestones (POA&M) utilizing the The CSP FedRAMP Plan of Action and Milestone (POA&M) Template Completion Guide. documents all residual risks identified in the SAR and defines a plan for remediation of those risks in the template provided. The CSP includes known risks identified by the 3PAO that are associated with leveraging PaaS and IaaS systems in the POA&M. The methodology for testing controls inherited from a FedRAMP compliant PaaS or IaaS service (Leveraged CSP) is explicitly based on how the requirement is described in the SSP. The SSP for the CSP leveraging Leveraged CSP clearly defines the roles and responsibilities for each and every control requirement. For example, a Physical and Environmental (PE) control might be fully inherited from the Leveraged CSP. The CSP the PE control describes “how” requirement is implemented by stating it is fully inherited from the Leveraged CSP. There is a
planned/ alternative implementation/not applicable]. Column I – Findings Specify the status of the control at the completion of testing [satisfied/other than satisfied]. Column J – Likelihood Specify the likelihood a threat will exploit the vulnerability identified [high/moderate/low]. Column K – Impact Specify the impact to the system if the threat successfully exploits the vulnerability [high/moderate/low]. Column L – Risk Exposure Specify the risk exposure to the system if the vulnerability associated with this control is exploited [high/moderate/low]. Column M – Risk Description Fully describe the details of the risks to this specific system if the vulnerability is exploited. Column N - Recommendation for Mitigation Fully describe the recommendation for remediation of the risk associated with this control. Column O – Assessor POC Specify the assessor name and contact information [e.g., email, phone] for each test. Column P – Prior Findings Specify the status of a prior finding associated with this control. [satisfied/other than satisfied]. Column Q – Prior Risk Specify the risk exposure to the system if the vulnerability associated with this control is exploited. [high/moderate/low]. 2.5 (POA&M) The CSP prepares and submits the Plan of Action and Milestones (POA&M) utilizing the FedRAMP Plan of Action and Milestone (POA&M) Template Completion Guide. The CSP documents all residual risks identified in the SAR and defines a plan for remediation of those risks in the template provided. The CSP includes known risks identified by the 3PAO that are associated with leveraging PaaS and IaaS systems in the POA&M. The methodology for testing controls inherited from a FedRAMP compliant PaaS or IaaS service (Leveraged CSP) is explicitly based on how the requirement is described in the SSP. The SSP for the CSP leveraging Leveraged CSP clearly defines the roles and responsibilities for each and every control requirement. For example, a Physical and Environmental (PE) control might be fully inherited from the Leveraged CSP. The CSP describes “how” the PE control requirement is implemented by stating it is fully inherited from the Leveraged CSP. There is a