SI-4a Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SI-4a What is the solution and how is it implemented? SI-5a Security Alerts, Advisories, and Directives – The organization: Receives information system security alerts, advisories, and directives from designated external organizations on an ongoing basis; REQUIREMENT: The external organization” is defined as CND Tier II. CSPs must “designated be able to receive and act upon warnings and notifications that are sent by CND Tier II. notifications may be generated by Tier I or II CND and will include guidance for or countermeasures to be taken by CSPs. Guidance: The CSP should describe how they plan to act upon warnings and notification from DoD CND Tier II. SI-5a Control Summary Information Responsible Role:
SI-4a Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation - equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> SI-4a What is the solution and how is it implemented? SI-5a – Security Alerts, Advisories, and Directives The organization: Receives information system security alerts, advisories, and directives from designated external organizations on an ongoing basis; REQUIREMENT: The “designated external organization” is defined as CND Tier II. CSPs must be able to receive and act upon warnings and notifications that are sent by CND Tier II. notifications may be generated by Tier I or II CND and will include guidance for or countermeasures to be taken by CSPs. Guidance: The CSP should describe how they plan to act upon warnings and notification from DoD CND Tier II. SI-5a Control Summary Information Responsible Role:
U_CSM_level_4_saas_template.docx