Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> CM-8 (1) What is the solution and how is it implemented? CM-8 (3) The organization: Employs automated mechanisms [FedRAMP Assignment: Continuously, using to detect the automated mechanisms with a maximum five-minute delay in detection] presence of unauthorized hardware, software, and firmware components within the information system; and Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; [Assignment: notifies organization-defined personnel or roles]]. CM-8 (3) Control Enhancement Summary Information Responsible Role: Parameter CM-8(3)(a): Parameter CM-8(3)(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply):
Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Abbreviation>, <Date of PA> CM-8 (1) What is the solution and how is it implemented? CM-8 (3) The organization: Employs automated mechanisms [FedRAMP Assignment: Continuously, using automated mechanisms with a maximum five-minute delay in detection] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and Takes the following actions when unauthorized components are detected: [Selection (one or more): disables network access by such components; isolates the components; notifies [Assignment: organization-defined personnel or roles]]. CM-8 (3) Control Enhancement Summary Information Responsible Role: Parameter CM-8(3)(a): Parameter CM-8(3)(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply):
FedRAMP-System-Security-Plan-Template-v2.1.docx