6 Vulnerability RA-5(2) CSPs must update the list of Before scans are run, Scanning vulnerabilities scanned continuously, signatures must be updated to before each scan. the most current version. 7 Wireless Intrusion SI-4(14) The organization employs a wireless Detection intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system. 10 Days CSPs must train personnel in their 8 Contingency Training CP-3a contingency roles and responsibilities within 10 days of assuming a contingency role or responsibility. Record the date of the training in the System Security Plan. Weekly 9 Audit Review, AU-6a CSPs must review and analyze Report findings of Analysis, & Reporting information system audit records for inappropriate or unusual indications of inappropriate or activity to incident response unusual activity. team. Monthly 10 Vulnerability RA-5d CSPs must mitigate all discovered Scanning high-risk vulnerabilities within 30 days and mitigate moderate vulnerability risks in 90 days. CSPs must send their ISSO updated artifacts every 30 days to show evidence that outstanding high-risk vulnerabilities have been mitigated.
6 Vulnerability Scanning RA-5(2) CSPs must update the list of vulnerabilities scanned continuously, before each scan. Before scans are run, signatures must be updated to the most current version. 7 Wireless Intrusion Detection SI-4(14) The organization employs a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises/breaches to the information system. 10 Days 8 Contingency Training CP-3a CSPs must train personnel in their contingency roles and responsibilities within 10 days of assuming a contingency role or responsibility. Record the date of the training in the System Security Plan. Weekly 9 Audit Review, Analysis, & Reporting AU-6a CSPs must review and analyze information system audit records for indications of inappropriate or unusual activity. Report findings of inappropriate or unusual activity to incident response team. Monthly 10 Vulnerability Scanning RA-5d CSPs must mitigate all discovered high-risk vulnerabilities within 30 days and mitigate moderate vulnerability risks in 90 days. CSPs must send their ISSO updated artifacts every 30 days to show evidence that outstanding high-risk vulnerabilities have been mitigated.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx