Partially implemented Planned Alternative implementation - equivalence (explain Configured by customer Not applicable Control Origination all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IA-5 (3) What is the solution and how is it implemented? Incident Response (IR) Incident Response (IR) - additional controls IR-4 (3) - Incident Handling The organization identifies classes of incidents and defines appropriate actions to take in response to ensure continuation of organizational missions and business functions. Requirement: The following are the categories of information requirements relevant to CSP operations. information requirements are fulfilled by the CSP through incident reporting, and further detail (CJCSM 6510.01B) on reporting requirements is dependent on impact level and service type: Malware • Denial of Service attack • Targeted malicious activity • Significant vulnerabilities • System compromise • Service outage with mission impact (e.g., scheduled maintenance, natural disasters) • Requirement: The CSP defines incident categories consistent with CJCSM 6510.01B and includes the following:
Partially implemented Planned Alternative implementation - equivalence (explain Configured by customer Not applicable Control Origination all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> IA-5 (3) What is the solution and how is it implemented? Incident Response (IR) Incident Response (IR) - additional controls IR-4 (3) - Incident Handling The organization identifies classes of incidents and defines appropriate actions to take in response to ensure continuation of organizational missions and business functions. Requirement: The following are the categories of information requirements relevant to CSP operations. information requirements are fulfilled by the CSP through incident reporting, and further detail (CJCSM 6510.01B) on reporting requirements is dependent on impact level and service type: • Malware • Denial of Service attack • Targeted malicious activity • Significant vulnerabilities • System compromise • Service outage with mission impact (e.g., scheduled maintenance, natural disasters) Requirement: The CSP defines incident categories consistent with CJCSM 6510.01B and includes the following:
U_CSM_level_4_saas_template.docx