Table 132 Control Origination and Definitions Control Origination Definition Example Service Provider A control that originates from the DNS from the corporate network provides Corporate corporate network. address resolution services for the information system and the service offering. Service Provider System A control specific to a particular system at A unique host based intrusion detection Specific the and the control is not part of the system (HIDs) is available on the service standard corporate controls. offering platform but is not available on the corporate network. Service Provider Hybrid A control that makes use of both There are scans of the corporate network corporate controls and additional infrastructure; scans of databases and web controls specific to a particular system at based application are system specific. the . Configured by Customer A control where the customer needs to User profiles, policy/audit configurations, apply a configuration in order to meet enabling/disabling key switches (e.g., the control requirement. enable/disable http* or https, etc.), entering an IP range specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to The customer provides a SAML SSO solution provide additional hardware or software to implement two-factor authentication. in order to meet the control requirement. Shared A control that is managed and Security awareness training must be implemented partially by the and conducted by both the CSPN and the partially by the customer. customer. Inherited from A control that is inherited from another A PaaS or SaaS provider inherits PE controls FedRAMP system that has already received a from an IaaS provider. Authorization FedRAMP Authorization. *Hyper Text Transport Protocol (http) Responsible Role indicates the role of CSP employee who can best respond to questions about the particular control that is described. (AC) AC-1 Access Control Policy and Procedures Requirements (L) (M) The organization: Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]: An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the access control policy and associated access controls; and
Table 132 Control Origination and Definitions Control Origination Definition Example Service Provider Corporate A control that originates from the corporate network. DNS from the corporate network provides address resolution services for the information system and the service offering. Service Provider System Specific A control specific to a particular system at the and the control is not part of the standard corporate controls. A unique host based intrusion detection system (HIDs) is available on the service offering platform but is not available on the corporate network. Service Provider Hybrid A control that makes use of both corporate controls and additional controls specific to a particular system at the . There are scans of the corporate network infrastructure; scans of databases and web based application are system specific. Configured by Customer A control where the customer needs to apply a configuration in order to meet the control requirement. User profiles, policy/audit configurations, enabling/disabling key switches (e.g., enable/disable http* or https, etc.), entering an IP range specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a SAML SSO solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits PE controls from an IaaS provider. *Hyper Text Transport Protocol (http) Responsible Role indicates the role of CSP employee who can best respond to questions about the particular control that is described. (AC) AC-1 Access Control Policy and Procedures Requirements (L) (M) The organization: Develops, documents and disseminates to [Assignment: organization-defined personnel or roles]: An access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and Procedures to facilitate the implementation of the access control policy and associated access controls; and
FedRAMP-SSP-Moderate-2016-10-27-v03-01.docx