SC-12 (3) Control Enhancement The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user’s private key]. SC-12 (3) Control Summary Information Responsible Role: Parameter SC-12 (3): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , SC-12 (3) What is the solution and how is it implemented? SC-13 Use of Cryptography The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. SC-13 Control Summary Information Responsible Role: Parameter SC-13: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
SC-12 (3) Control Enhancement The organization produces, controls, and distributes asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; approved PKI Class 3 certificates or prepositioned keying material; approved PKI Class 3 or Class 4 certificates and hardware security tokens that protect the user’s private key]. SC-12 (3) Control Summary Information Responsible Role: Parameter SC-12 (3): Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , SC-12 (3) What is the solution and how is it implemented? SC-13 Use of Cryptography The information system implements [FedRAMP Assignment: FIPS-validated or NSA-approved cryptography] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. SC-13 Control Summary Information Responsible Role: Parameter SC-13: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
FedRAMP_System_Security_Plan_(High).docx