Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (5) What is the solution and how is it implemented? AC-2 (7) Control Enhancement (M) The organization: Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles; Monitors privileged role assignments; and Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate. AC-2 (7) Control Summary Information Responsible Role: Parameter AC-2(7)(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (7) What is the solution and how is it implemented? Part a Part b Part c
Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (5) What is the solution and how is it implemented? AC-2 (7) Control Enhancement (M) The organization: Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles; Monitors privileged role assignments; and Takes [Assignment: organization-defined actions] when privileged role assignments are no longer appropriate. AC-2 (7) Control Summary Information Responsible Role: Parameter AC-2(7)(c): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , AC-2 (7) What is the solution and how is it implemented? Part a Part b Part c
FedRAMP-SSP-Moderate-2016-10-27-v03-01.docx