Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-8 (1) What is the solution and how is it implemented? IA-8 (2) Control Enhancement (L) (M) (H) The information system accepts only FICAM-approved third-party credentials. IA-8 (2) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-8 (2) What is the solution and how is it implemented? IA-8 (3) Control Enhancement (L) (M) (H) The organization employs only FICAM-approved information system components in [Assignment: organization-defined information systems] to accept third-party credentials. IA-8 (3) Control Summary Information Responsible Role: Parameter IA-8(3):
Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-8 (1) What is the solution and how is it implemented? IA-8 (2) Control Enhancement (L) (M) (H) The information system accepts only FICAM-approved third-party credentials. IA-8 (2) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , IA-8 (2) What is the solution and how is it implemented? IA-8 (3) Control Enhancement (L) (M) (H) The organization employs only FICAM-approved information system components in [Assignment: organization-defined information systems] to accept third-party credentials. IA-8 (3) Control Summary Information Responsible Role: Parameter IA-8(3):
FedRAMP-SSP-Low-Baseline-Template-v1.1.docx