Security Assessments CA-2 (continued) (continued) c. Produces a security assessment report that documents the results of the assessment; and d. Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles]. 33 Security Assessments CA-2 (2) The organization includes as part of Requirement: To include - Specialized security control assessments, 'announced', 'vulnerability Assessments [FedRAMP Assignment: at least scanning' at least annually annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; Deliverables produced by vulnerability scanning; malicious 3PAOs are always separate user testing; insider threat from deliverables produced by assessment; performance/load CSPs. testing; [Assignment: other forms of security assessment]]. . 34 Penetration Testing CA-8, CA-8 CSPs must conduct penetration Deliverables produced by (1) testing at least annually or when 3PAOs are always separate there is a major significant change to from deliverables produced by ensure compliance with all CSPs. vulnerability mitigation procedures. Penetration testing must be performed by a 3PAO. All penetration testing reports must be sent to the ISSO.
Security Assessments CA-2 (continued) (continued) c. Produces a security assessment report that documents the results of the assessment; and d. Provides the results of the security control assessment to [Assignment: organization-defined individuals or roles]. 33 Security Assessments - Specialized Assessments CA-2 (2) The organization includes as part of security control assessments, [FedRAMP Assignment: at least annually], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; vulnerability scanning; malicious user testing; insider threat assessment; performance/load testing; [Assignment: other forms of security assessment]]. . Requirement: To include 'announced', 'vulnerability scanning' at least annually Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs. 34 Penetration Testing CA-8, CA-8 (1) CSPs must conduct penetration testing at least annually or when there is a major significant change to ensure compliance with all vulnerability mitigation procedures. Penetration testing must be performed by a 3PAO. All penetration testing reports must be sent to the ISSO. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3-9.docx