49 Vulnerability Scan RA-5a CSPs must have an accredited 3PAO Deliverables produced by scan operating 3PAOs are always separate systems/infrastructure, web from deliverables produced by applications, and databases annually. CSPs. All scan reports must be sent to the ISSO. 50 Boundary Protection SC-7(4)e CSPs must remove traffic flow that is no longer supported by a business/mission need. Changes and updates to traffic flow must be made in accordance with the change control process described in the Configuration Management CSP’s Plan. 51 Role-based security training is Security AT-3b, CSPs must provide role-based typically for privileged users. Training AT-3c security training annually and when required. The date that the training took place, along with whom provided the training, must be recorded In the System Security Plan. 52 Security Training AT-4b CSPs must archive security training records at least annually. In the Records record who System Security Plan, participated in training and when the training took place. Archive the actual training materials. Every Two Years 53 Identifier Prevent reuse of user and device IA-4d Management identifiers every two years. Every Three Years
49 Vulnerability Scan RA-5a CSPs must have an accredited 3PAO scan operating systems/infrastructure, web applications, and databases annually. All scan reports must be sent to the ISSO. Deliverables produced by 3PAOs are always separate from deliverables produced by CSPs. 50 Boundary Protection SC-7(4)e CSPs must remove traffic flow that is no longer supported by a business/mission need. Changes and updates to traffic flow must be made in accordance with the change control process described in the CSP’s Configuration Management Plan. 51 Security Training AT-3b, AT-3c CSPs must provide role-based security training annually and when required. The date that the training took place, along with whom provided the training, must be recorded In the System Security Plan. Role-based security training is typically for privileged users. 52 Security Training Records AT-4b CSPs must archive security training records at least annually. In the System Security Plan, record who participated in training and when the training took place. Archive the actual training materials. Every Two Years 53 Identifier Management IA-4d Prevent reuse of user and device identifiers every two years. Every Three Years
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3-9.docx