CSPs must establish their own set of Policies and Procedures (P&Ps). They cannot be inherited from a leveraged system, nor can they be provided by the customer. Any exceptions and/or missing policy and procedure elements must be explained in Table 4-10 below. Table 4-9. Policies and Procedures Policy Procedure # Family Title Version and Date Yes No Yes No 1 Access Control [AC-1] Policy: Procedure(s): 2 Awareness & Training Policy: [AT-1] Procedure(s): 3 Audit & Accountability Policy: [AU-1] Procedure(s): 4 Security Assessment & Policy: Authorization [CA-1] Procedure(s): 5 Configuration Policy: Management [CM-1] Procedure(s): 6 Contingency Planning Policy: [CP-1] Procedure(s): 7 Identification & Policy: Authentication [IA-1] Procedure(s): 8 Incident Response [IR-1] Policy: Procedure(s): 9 Maintenance [MA-1] Policy: Procedure(s): 10 Media Protection Policy: Procedure(s):
CSPs must establish their own set of Policies and Procedures (P&Ps). They cannot be inherited from a leveraged system, nor can they be provided by the customer. Any exceptions and/or missing policy and procedure elements must be explained in Table 4-10 below. Table 4-9. Policies and Procedures # Family Policy Procedure Title Version and Date Yes No Yes No 1 Access Control [AC-1] Policy: Procedure(s): 2 Awareness & Training [AT-1] Policy: Procedure(s): 3 Audit & Accountability [AU-1] Policy: Procedure(s): 4 Security Assessment & Authorization [CA-1] Policy: Procedure(s): 5 Configuration Management [CM-1] Policy: Procedure(s): 6 Contingency Planning [CP-1] Policy: Procedure(s): 7 Identification & Authentication [IA-1] Policy: Procedure(s): 8 Incident Response [IR-1] Policy: Procedure(s): 9 Maintenance [MA-1] Policy: Procedure(s): 10 Media Protection Policy: Procedure(s):
FedRAMP-Moderate-RAR-Template-v1.2-3.docx