<Information Type> <NIST Identifier> Low Low Low (FIPS 199) Based on the information provided in Table 2.3, Sensitivity Categorization of Information Types for the default to the high-water mark for the Information <Information System Abbreviation>, Types as identified in Table 2.4, Security Impact Level, below. If the security impact level for confidentiality, integrity, and availability for any of the identified data types is moderate or high, the information system is not a FedRAMP LI-SaaS Tailored system. The Cloud Service Provider (CSP) must meet the standard FedRAMP Low, Moderate, or High impact baseline security requirements, as applicable, and complete the requirement documentation. Table 2.4. Security Impact Level Security Objective Low, Moderate or High Confidentiality Low Integrity Low Availability Low Through careful review and analysis, the baseline security categorization for the <Information system has been determined and is listed in Table 2.5, Baseline Security System Abbreviation> Configuration, which follows. Table 2.5. Baseline Security Configuration <Information System Abbreviation> Security Categorization Low Using this categorization, in conjunction with the risk assessment and any unique security requirements, the security controls for this system have been established as detailed in this FedRAMP LI-SaaS Framework. Tailored The following individual is identified as the system owner or functional proponent/advocate for this system. 3.1. Information System Owner
<Information Type> <NIST Identifier> Low Low Low (FIPS 199) Based on the information provided in Table 2.3, Sensitivity Categorization of Information Types for the <Information System Abbreviation>, default to the high-water mark for the Information Types as identified in Table 2.4, Security Impact Level, below. If the security impact level for confidentiality, integrity, and availability for any of the identified data types is moderate or high, the information system is not a FedRAMP Tailored LI-SaaS system. The Cloud Service Provider (CSP) must meet the standard FedRAMP Low, Moderate, or High impact baseline security requirements, as applicable, and complete the requirement documentation. Table 2.4. Security Impact Level Security Objective Low, Moderate or High Confidentiality Low Integrity Low Availability Low Through careful review and analysis, the baseline security categorization for the <Information System Abbreviation> system has been determined and is listed in Table 2.5, Baseline Security Configuration, which follows. Table 2.5. Baseline Security Configuration <Information System Abbreviation> Security Categorization Low Using this categorization, in conjunction with the risk assessment and any unique security requirements, the security controls for this system have been established as detailed in this FedRAMP Tailored LI-SaaS Framework. The following individual is identified as the system owner or functional proponent/advocate for this system. 3.1. Information System Owner
APPENDIX-B-FedRAMP-Tailored-LI-SaaS-Template-2017-11-14-v4.0.docx