Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation equivalence (explain below) – Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AU-12 What is the solution and how is it implemented? Assessment and Authorization (CA) Assessment and Authorization (CA) Additional controls – CA-2(2) Security Assessments Enhancement – The organization includes as part of security control assessments, [Assignment: [Selection: [Selection: frequency], announced; unannounced], in-depth monitoring; OR [Assignment: malicious user testing; penetration testing; red team exercises]; organization-defined other forms of security testing]. DoD parameter 1: [Annually or more frequently as required by the security plan] DoD parameter 2: [announced] DoD parameter 3: [in-depth monitoring; malicious user testing; penetration testing; red team exercises; and/or other forms of security testing (e.g. vulnerability scans, integrity checks, security readiness reviews) as necessary.)]
Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> AU-12 What is the solution and how is it implemented? Assessment and Authorization (CA) Assessment and Authorization (CA) – Additional controls CA-2(2) – Security Assessments Enhancement The organization includes as part of security control assessments, [Assignment: frequency], [Selection: announced; unannounced], [Selection: in-depth monitoring; malicious user testing; penetration testing; red team exercises]; OR [Assignment: organization-defined other forms of security testing]. DoD parameter 1: [Annually or more frequently as required by the security plan] DoD parameter 2: [announced] DoD parameter 3: [in-depth monitoring; malicious user testing; penetration testing; red team exercises; and/or other forms of security testing (e.g. vulnerability scans, integrity checks, security readiness reviews) as necessary.)]
U_CSM_level_5_iaas_ssptemplate.docx