29 Security Awareness AT-2 CSPs must provide basic security Security awareness training awareness training to all users must include contractors, annually. Record the date that executives, and anyone who security awareness training last took has access to the system. place in the System Security Plan. 30 Auditable Events AU-2(3) CSPs must review and update Guidance: Annually or auditable events annually or whenever changes in the threat whenever there is a change in the environment are threat environment. Changes to the communicated to the service auditable event list must be recorded provider by the Authorizing in the CSPs Official. System Security Plan. must record the date that the auditable event review meeting takes place in the System Security Plan. Meeting notes with information about who attended the meeting must be archived. 31 Security Assessments CA-2b CSPs must have a 3PAO assess a Consult with the ISSO to subset of their security controls obtain information on which annually. Submit the assessment controls to assess during report to the ISSO one year from the annual testing. Provisional Authorization date and each year thereafter. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs.
29 Security Awareness AT-2 CSPs must provide basic security awareness training to all users annually. Record the date that security awareness training last took place in the System Security Plan. Security awareness training must include contractors, executives, and anyone who has access to the system. 30 Auditable Events AU-2(3) CSPs must review and update auditable events annually or whenever there is a change in the threat environment. Changes to the auditable event list must be recorded in the System Security Plan. CSPs must record the date that the auditable event review meeting takes place in the System Security Plan. Meeting notes with information about who attended the meeting must be archived. Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the Authorizing Official. 31 Security Assessments CA-2b CSPs must have a 3PAO assess a subset of their security controls annually. Submit the assessment report to the ISSO one year from the Provisional Authorization date and each year thereafter. Consult with the ISSO to obtain information on which controls to assess during annual testing. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx