2 Does the CSP employ automated mechanisms to maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8, CM-8(2)] 3 Does the CSP employ automated mechanisms to detect inventory and configuration changes? [CM-6(1), CM-8(3)] 4 Does the CSP have a Configuration Management Plan? [CM-9, CM-11] 5 Does the CSP employ automated mechanisms to implement a formal change control process? [CM-3, CM-3(1)] 6 Does the CSP’s formal change control process include a security impact assessment? [CM-4] 7 Does the CSP prevent unauthorized changes to the system? [CM-5, CM-5(1), CM-5(5), CM-11, CM-11(1)] 8 Does the CSP establish configuration settings If describe if the configuration “yes,” for products employed that reflect the most settings are based on Center for restrictive mode consistent with operational Internet Security (CIS) Benchmarks or requirements? [CM-6] United States Government Configuration Baseline (USGCB), or restrictive consistent with “most operational requirements.” 9 Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6] For the following questions, 3PAOs may use Table 4-18 (Continuous Monitoring Capabilities Additional – Details) to enter the capability descriptions, supporting evidence and missing elements. 10 Does the CSP perform authenticated operating Describe how the 3PAO validated that system/ infrastructure, web, and database vulnerability scans were fully vulnerability scans at least monthly, as authenticated. applicable? [RA-5, RA-5(5), SI-2(2)] 11 Does the CSP demonstrate the capability to Describe how the 3PAO validated that remediate High vulnerabilities within 30 days the CSP remediates High and Moderate vulnerabilities within 90 days? vulnerabilities within 30 days and [RA-5, FedRAMP Continuous Monitoring Guide] Moderate vulnerabilities within 90 days. 12 When a High vulnerability is identified as part of ConMon activities, does the CSP consistently check audit logs for evidence of exploitation? [RA-5(8)]
2 Does the CSP employ automated mechanisms to maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8, CM-8(2)] 3 Does the CSP employ automated mechanisms to detect inventory and configuration changes? [CM-6(1), CM-8(3)] 4 Does the CSP have a Configuration Management Plan? [CM-9, CM-11] 5 Does the CSP employ automated mechanisms to implement a formal change control process? [CM-3, CM-3(1)] 6 Does the CSP’s formal change control process include a security impact assessment? [CM-4] 7 Does the CSP prevent unauthorized changes to the system? [CM-5, CM-5(1), CM-5(5), CM-11, CM-11(1)] 8 Does the CSP establish configuration settings for products employed that reflect the most restrictive mode consistent with operational requirements? [CM-6] If “yes,” describe if the configuration settings are based on Center for Internet Security (CIS) Benchmarks or United States Government Configuration Baseline (USGCB), or “most restrictive consistent with operational requirements.” 9 Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6] For the following questions, 3PAOs may use Table 4-18 (Continuous Monitoring Capabilities – Additional Details) to enter the capability descriptions, supporting evidence and missing elements. 10 Does the CSP perform authenticated operating system/ infrastructure, web, and database vulnerability scans at least monthly, as applicable? [RA-5, RA-5(5), SI-2(2)] Describe how the 3PAO validated that vulnerability scans were fully authenticated. 11 Does the CSP demonstrate the capability to remediate High vulnerabilities within 30 days and Moderate vulnerabilities within 90 days? [RA-5, FedRAMP Continuous Monitoring Guide] Describe how the 3PAO validated that the CSP remediates High vulnerabilities within 30 days and Moderate vulnerabilities within 90 days. 12 When a High vulnerability is identified as part of ConMon activities, does the CSP consistently check audit logs for evidence of exploitation? [RA-5(8)]
Draft%20Attachment%20C%20-%20FedRAMP-Self-Assessment-High-RAR-Template-v1.0-2.docx