35 Baseline CM-2(1)a CSPs must review and update the This activity must also be Configuration baseline configuration annually or performed whenever there is a during installations and updates. major significant change to the Changes and updates to the baseline system. configuration must be made in accordance with the change control process described in the CSP’s Configuration Management Plan. Configuration CSPs must review and update the 36 CM-9 Management Plan Configuration Management Plan annually. Submit the new plan to the ISSO one year from the Provisional Authorization date (and each year thereafter). 37 IT Contingency Plan CP-2d CSPs must review and update the Requirement: For JAB IT annually. Submit authorizations the contingency Contingency Plan the new plan to the one year from the lists include designated Provisional Authorization date (and FedRAMP personnel. each year thereafter). 38 Contingency Training CP-3c CSPs must train personnel in their contingency roles and responsibilities annually. Record the date of the training in the System Security Plan.
35 Baseline Configuration CM-2(1)a CSPs must review and update the baseline configuration annually or during installations and updates. Changes and updates to the baseline configuration must be made in accordance with the change control process described in the CSP’s Configuration Management Plan. This activity must also be performed whenever there is a major significant change to the system. 36 Configuration Management Plan CM-9 CSPs must review and update the Configuration Management Plan annually. Submit the new plan to the ISSO one year from the Provisional Authorization date (and each year thereafter). 37 IT Contingency Plan CP-2d CSPs must review and update the IT Contingency Plan annually. Submit the new plan to the one year from the Provisional Authorization date (and each year thereafter). Requirement: For JAB authorizations the contingency lists include designated FedRAMP personnel. 38 Contingency Training CP-3c CSPs must train personnel in their contingency roles and responsibilities annually. Record the date of the training in the System Security Plan.
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx