Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AC-17 (7) What is the solution and how is it implemented? Control Enhancement AC-17 (8) AC-17 (8) The organization disables [Assignment: organization-defined networking protocols except for explicitly identified within the information system deemed to be non-secure] components in support of specific operational requirements. AC-17 (8) Parameter Requirements: [tftp, (trivial ftp); X-Windows, Sun Open Windows; FTP; TELNET; IPX/SPX; NETBIOS; BlueTooth; RPC-services, like NIS or NFS; rlogin, rsh, rexec; SMTP (Simple Mail Transfer Protocol); RIP (Routing Information Protocol); DNS (Domain Name Services); UUCP (Unix-Unix Copy Protocol); NNTP (Network News Transfer Protocol); NTP (Network Time Protocol); Peer-to-Peer] AC-17 (8) Additional FedRAMP Requirements and Guidance: Requirement: Networking protocols implemented by the service provider are approved and accepted by JAB. Guidance: Exceptions to restricted networking protocols are granted for explicitly identified information system components in support of specific operational requirements. AC-17 (8) Control Enhancement Summary Information Responsible Role: Parameter:
Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AC-17 (7) What is the solution and how is it implemented? Control Enhancement AC-17 (8) AC-17 (8) The organization disables [Assignment: organization-defined networking protocols within the information system deemed to be non-secure] except for explicitly identified components in support of specific operational requirements. AC-17 (8) Parameter Requirements: [tftp, (trivial ftp); X-Windows, Sun Open Windows; FTP; TELNET; IPX/SPX; NETBIOS; BlueTooth; RPC-services, like NIS or NFS; rlogin, rsh, rexec; SMTP (Simple Mail Transfer Protocol); RIP (Routing Information Protocol); DNS (Domain Name Services); UUCP (Unix-Unix Copy Protocol); NNTP (Network News Transfer Protocol); NTP (Network Time Protocol); Peer-to-Peer] AC-17 (8) Additional FedRAMP Requirements and Guidance: Requirement: Networking protocols implemented by the service provider are approved and accepted by JAB. Guidance: Exceptions to restricted networking protocols are granted for explicitly identified information system components in support of specific operational requirements. AC-17 (8) Control Enhancement Summary Information Responsible Role: Parameter:
System_Security_Plan_Template_012313_508.docx