specific to their organization are configurable by the customer. Provided by A control where the customer needs to The customer provides a Security Assertions Customer provide additional hardware or software Markup Language (SAML) Single Sign-On (SSO) in order to meet the control requirement. solution to implement two-factor authentication. Shared A control that is managed and Security awareness training must be conducted by implemented partially by the CSP Name both the CSPN and the customer. and partially by the customer. Inherited from A control that is inherited from another A PaaS or SaaS provider inherits Physical and FedRAMP CSP Name system that has already Environmental (PE) controls from an IaaS Authorization received a FedRAMP Authorization. provider. (AC) AC-2 Account Management AC-2 Requirement(s) The organization: Identifies and selects the following of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; Monitors the use of information system accounts; and Notifies account managers: When accounts are no longer required; When users are terminated or transferred; and When individual information system usage or need-to-know changes [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] AC-2 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
specific to their organization are configurable by the customer. Provided by Customer A control where the customer needs to provide additional hardware or software in order to meet the control requirement. The customer provides a Security Assertions Markup Language (SAML) Single Sign-On (SSO) solution to implement two-factor authentication. Shared A control that is managed and implemented partially by the CSP Name and partially by the customer. Security awareness training must be conducted by both the CSPN and the customer. Inherited from FedRAMP Authorization A control that is inherited from another CSP Name system that has already received a FedRAMP Authorization. A PaaS or SaaS provider inherits Physical and Environmental (PE) controls from an IaaS provider. (AC) AC-2 Account Management AC-2 Requirement(s) The organization: Identifies and selects the following of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types]; [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions]; Monitors the use of information system accounts; and Notifies account managers: When accounts are no longer required; When users are terminated or transferred; and When individual information system usage or need-to-know changes [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] [Excluded from FedRAMP Tailored for LI-SaaS] AC-2 Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable
APPENDIX-B-FedRAMP-Tailored-LI-SaaS-Template-2017-11-14-v4.0.docx