Table 4-10. Missing Policy and Procedure Elements Missing Policy and Procedure Elements The 3PAO must answer the questions below. 4-11. Security Awareness Training Describe capability, supporting evidence, and any Question Yes No missing elements Does the CSP train personnel on security awareness and security responsibilities? Additional Capability Information FedRAMP will evaluate the responses in this section on a case-by-case relative to a FedRAMP-Ready designation decision. Staffing Levels In the table below, the 3PAO must describe the CSP’s organizational structure, staffing levels currently dedicated to the security of the system, as well as any planned changes to these staffing levels. This description must clearly indicate role and number of individuals as well as identify which staff is dedicated full-time, and which are performing their role as a collateral duty. 4-12. Staffing Levels Staffing Levels Change Management Maturity the following change management capabilities are not required, they indicate a more mature change management capability and may influence a FedRAMP-Readiness decision, especially for larger systems. The 3PAO must answer the questions below. Table 4-13. Change Management If please describe how “no”, # Question Yes No this is accomplished. 1 Does the CSP’s change management capability include a fully functioning Change Control Board (CCB)? 2 Does the CSP have and use development and/or test environments to verify changes before implementing them in the production environment? Vendor Dependencies and Agreements The 3PAO must answer the questions below. Table 4-14. Vendor Dependencies and Agreements # Question Yes No Instructions
Table 4-10. Missing Policy and Procedure Elements Missing Policy and Procedure Elements The 3PAO must answer the questions below. 4-11. Security Awareness Training Question Yes No Describe capability, supporting evidence, and any missing elements Does the CSP train personnel on security awareness and security responsibilities? Additional Capability Information FedRAMP will evaluate the responses in this section on a case-by-case relative to a FedRAMP-Ready designation decision. Staffing Levels In the table below, the 3PAO must describe the CSP’s organizational structure, staffing levels currently dedicated to the security of the system, as well as any planned changes to these staffing levels. This description must clearly indicate role and number of individuals as well as identify which staff is dedicated full-time, and which are performing their role as a collateral duty. 4-12. Staffing Levels Staffing Levels Change Management Maturity the following change management capabilities are not required, they indicate a more mature change management capability and may influence a FedRAMP-Readiness decision, especially for larger systems. The 3PAO must answer the questions below. Table 4-13. Change Management # Question Yes No If “no”, please describe how this is accomplished. 1 Does the CSP’s change management capability include a fully functioning Change Control Board (CCB)? 2 Does the CSP have and use development and/or test environments to verify changes before implementing them in the production environment? Vendor Dependencies and Agreements The 3PAO must answer the questions below. Table 4-14. Vendor Dependencies and Agreements # Question Yes No Instructions
Draft%20Attachment%20C%20-%20FedRAMP-Self-Assessment-High-RAR-Template-v1.0-2.docx