Table 13.2. <Information System Name> Standards and Guidance Identification Title Date Link Number <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> Security controls must meet minimum security control baseline requirements. The following contains the FedRAMP LI-SaaS Security Controls Baseline (by family). Tailored are six (6) categories of FedRAMP LI-SaaS controls: FED, NSO, Required, Tailored Conditional, Inherited, and Attestation. Table 14.1, Control Tailoring Criteria, provides definitions of the tailoring criteria utilized for the determination of the FedRAMP Tailored baseline. Table 14.1. Control Tailoring Criteria Tailoring CSP Response Tailoring Criteria Symbol Requirements The control is typically the responsibility of the Federal No CSP response is FED Government, not the CSP. required. FedRAMP has determined the control does not impact No CSP response is NSO the security of the Cloud SaaS. required. The control must be documented in Appendix B, and CSP must provide independently assessed. documentation for the control This does not mean that a vendor will necessarily have Document and each control implemented or implemented as Assess stated. A vendor must address how they meet (or don't meet) the intent of the control so that it can be independently assessed and detail any risks associated with the implementation. If the condition exists, the control must be documented CSP must provide Document and in Appendix B and independently assessed as above. If documentation for the Assess (D&A) the condition does not exist, the CSP must attest to this control below. Conditional in Appendix E. The control is inherited from the underlying CSP attestation response is infrastructure provider (i.e., FedRAMP authorized required. Inherited IaaS/PaaS).
Table 13.2. <Information System Name> Standards and Guidance Identification Number Title Date Link <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> <Reference ID> <Reference Title> <Ref Date> <Reference Link> Security controls must meet minimum security control baseline requirements. The following contains the FedRAMP Tailored LI-SaaS Security Controls Baseline (by family). are six (6) categories of FedRAMP Tailored LI-SaaS controls: FED, NSO, Required, Conditional, Inherited, and Attestation. Table 14.1, Control Tailoring Criteria, provides definitions of the tailoring criteria utilized for the determination of the FedRAMP Tailored baseline. Table 14.1. Control Tailoring Criteria Tailoring Symbol Tailoring Criteria CSP Response Requirements FED The control is typically the responsibility of the Federal Government, not the CSP. No CSP response is required. NSO FedRAMP has determined the control does not impact the security of the Cloud SaaS. No CSP response is required. Document and Assess The control must be documented in Appendix B, and independently assessed. This does not mean that a vendor will necessarily have each control implemented or implemented as stated. A vendor must address how they meet (or don't meet) the intent of the control so that it can be independently assessed and detail any risks associated with the implementation. CSP must provide documentation for the control Document and Assess (D&A) Conditional If the condition exists, the control must be documented in Appendix B and independently assessed as above. If the condition does not exist, the CSP must attest to this in Appendix E. CSP must provide documentation for the control below. Inherited The control is inherited from the underlying infrastructure provider (i.e., FedRAMP authorized IaaS/PaaS). CSP attestation response is required.
APPENDIX-B-FedRAMP-Tailored-LI-SaaS-Template-2017-11-14-v4.0.docx