CA-5 Additional FedRAMP Requirements and Guidance: Requirement: Plan Of Action & Milestones (POA&M)s must be provided at least monthly. CA-5 Control Summary Information Responsible Role: Parameter CA-5(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CA-5 What is the solution and how is it implemented? Part a Part b CA-6 Security Authorization (L) (M) (H) The organization: Assigns a senior-level executive or manager as the authorizing official for the information system; Ensures that the authorizing official authorizes the information system for processing before commencing operations; and Updates the security authorization [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs]. CA-6c Additional FedRAMP Requirements and Guidance: Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F (). The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
CA-5 Additional FedRAMP Requirements and Guidance: Requirement: Plan Of Action & Milestones (POA&M)s must be provided at least monthly. CA-5 Control Summary Information Responsible Role: Parameter CA-5(b): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CA-5 What is the solution and how is it implemented? Part a Part b CA-6 Security Authorization (L) (M) (H) The organization: Assigns a senior-level executive or manager as the authorizing official for the information system; Ensures that the authorizing official authorizes the information system for processing before commencing operations; and Updates the security authorization [FedRAMP Assignment: in accordance with OMB A-130 requirements or when a significant change occurs]. CA-6c Additional FedRAMP Requirements and Guidance: Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F (). The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the JAB/AO.
FedRAMP-SSP-Low-Baseline-Template-v1.1.docx