54 Security CA-6c The security authorization will be This activity must also be Authorization by the Authorizing Official performed whenever there is a at least every three years. CSPs must major significant change to the record the date of the Provisional system. Authorization, and any CA-6c. Guidance: Significant reauthorization, in the System change is defined in NIST Security Plan. Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the Authorizing Official. 55 IT Contingency Plan CP-4a CSPs must test and exercise the Guidance: Plans for this test IT Testing & Exercises (for Low systems) must be submitted at least 30 Contingency Plan (Low Systems) every three years using table top days prior to test to ISSO. written tests. Record the testing date CP-4a. Requirement: The in the System Security Plan. service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by Risk-executive/ Authorizing Official prior to initiating testing. 56 Position PS-2c CSPs must review position Categorization categorizations every three years. Record the date that position categorization was completed in the System Security Plan.
54 Security Authorization CA-6c The security authorization will be by the Authorizing Official at least every three years. CSPs must record the date of the Provisional Authorization, and any reauthorization, in the System Security Plan. This activity must also be performed whenever there is a major significant change to the system. CA-6c. Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 1, Appendix F. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the Authorizing Official. 55 IT Contingency Plan Testing & Exercises (Low Systems) CP-4a CSPs must test and exercise the IT Contingency Plan (for Low systems) every three years using table top written tests. Record the testing date in the System Security Plan. Guidance: Plans for this test must be submitted at least 30 days prior to test to ISSO. CP-4a. Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by Risk-executive/ Authorizing Official prior to initiating testing. 56 Position Categorization PS-2c CSPs must review position categorizations every three years. Record the date that position categorization was completed in the System Security Plan.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx