AU-9(4) What is the solution and how is it implemented? Part a Part b Audit and Accountability (AU) changed controls – AU-2(3): Audited Events The organization reviews and updates the list of auditable events [Assignment: frequency]. DoD parameter: [annually or whenever is a change in the threat environment] Guidance: Changes in the threat environment may be detected by the CSP and communicated to the ECSB and/or customer’s CNDSP or is communicated to the service provider by the ECSB and/or customer's CNDSP in conjunction with USCYBERCOM. FedRAMP baseline parameter: [annually or whenever there is a change in the threat environment] Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB. AU-2(3) Control Summary Information Responsible Role: Parameter: Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation equivalence (explain below) – Not applicable
AU-9(4) What is the solution and how is it implemented? Part a Part b Audit and Accountability (AU) – changed controls AU-2(3): Audited Events The organization reviews and updates the list of auditable events [Assignment: frequency]. DoD parameter: [annually or whenever is a change in the threat environment] Guidance: Changes in the threat environment may be detected by the CSP and communicated to the ECSB and/or customer’s CNDSP or is communicated to the service provider by the ECSB and/or customer's CNDSP in conjunction with USCYBERCOM. FedRAMP baseline parameter: [annually or whenever there is a change in the threat environment] Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the JAB. AU-2(3) Control Summary Information Responsible Role: Parameter: Implementation Status all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Not applicable
U_CSM_level_4_saas_template.docx