extracted_fedramp_high_overlay.json

{
  "AC": {
    "AC-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "AC-01a.[01][02]",
          "objective": "Determine if an access control policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-01a.[03][04]",
          "objective": "Determine if access control procedures to facilitate the implementation of the access control policy and associated access controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-01a.01(a)",
          "objective": "Determine if the [organization-defined level] access control policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-01a.01(b)",
          "objective": "Determine if the access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-01c.01",
          "objective": "Determine if the current access control policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-01c.02",
          "objective": "Determine if the current access control procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AC-2": {
      "name": "Account Management",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02a.[01][02]",
          "objective": "Determine if account types allowed and specifically prohibited for use within the system are defined and documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-02b.",
          "objective": "Determine if account managers are assigned",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-02c.",
          "objective": "Determine if [organization-defined prerequisites and criteria] for group and role membership are required",
          "parameter": "CSP-defined prerequisites and criteria",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-02d.",
          "objective": "Determine if:\n - authorized users of the system are specified;\n - group and role membership are specified;\n - access authorizations (i.e., privileges) are specified for each account;\n - [organization-defined attributes (as required)] are specified for each account",
          "parameter": "CSP-defined attributes",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-02e.",
          "objective": "Determine if approvals are required by [organization-defined personnel or roles] for requests to create accounts",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02f.",
          "objective": "Determine if accounts are created, enabled, modified, disabled, and removed in accordance with [organization-defined policy, procedures, prerequisites, and criteria]",
          "parameter": "CSP-defined policy, procedures, prerequisites, and criteria",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02g.",
          "objective": "Determine if the use of accounts is monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02h.",
          "objective": "Determine if account managers and [organization-defined personnel or roles] are notified within [organization-defined time period] when accounts are no longer required, within [organization-defined time period] when users are terminated/transferred, and within [organization-defined time period] when system usage or the need to know changes for an individual",
          "parameter": "CSP-defined personnel or roles; twenty-four (24) hours; eight (8) hours; eight (8) hours",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02i.01",
          "objective": "Determine if access to the system is authorized based on a valid access authorization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02i.02",
          "objective": "Determine if access to the system is authorized based on intended system usage",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02i.03",
          "objective": "Determine if access to the system is authorized based on [organization-defined attributes]",
          "parameter": "CSP-defined attributes",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02j.",
          "objective": "Determine if accounts are reviewed for compliance with account management requirements [organization-defined frequency]",
          "parameter": "monthly for privileged access; every six (6) months for non-privileged access",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02k.[01][02]",
          "objective": "Determine if a process is established and implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02l.",
          "objective": "Determine if account management processes are aligned with personnel termination and transfer processes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AC-2 (1)": {
      "name": "Automated System Account Management",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(01)",
          "objective": "Determine if the management of system accounts is supported using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (2)": {
      "name": "Automated Temporary and Emergency Account Management",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(02)",
          "objective": "Determine if temporary and emergency accounts are automatically [organization-defined value] after [organization-defined time period]",
          "parameter": "disables after no more than 24 hours from last use",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "AC-2 (3)": {
      "name": "Disable Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(03)(a)(b)(c)(d)",
          "objective": "Determine if accounts are disabled within [organization-defined time period] when the accounts:\na. have expired\nb. are no longer associated with a user or individual\nc. are in violation of organizational policy; or\nd. have been inactive for [organization-defined time period]",
          "parameter": "24 hours for user accounts; thirty-five (35) days",
          "guidance": "Requirement: The service provider defines the time period for non-user accounts (e.g., accounts associated with devices).  The time periods are approved and accepted by the AO. Where user management is a function of the service, reports of activity of consumer users shall be made available.\n\nThe service provider defines the time period of inactivity for device identifiers.\n\nGuidance: For DoD clouds, see DoD cloud website for specific DoD requirements that go above and beyond FedRAMP https://public.cyber.mil/dccs/.\n",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (4)": {
      "name": "Automated Audit Actions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(04)",
          "objective": "Determine if account creation, modification, enabling, disabling, and removal actions are automatically audited",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (5)": {
      "name": "Inactivity Logout",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(05)",
          "objective": "Determine if users are required to log out when [organization-defined time period of expected inactivity or description of when to log out]",
          "parameter": "inactivity is anticipated to exceed fifteen (15) minutes",
          "guidance": "Guidance: Should use a shorter timeframe than AC-12",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (7)": {
      "name": "Privileged User Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(07)(a)",
          "objective": "Determine if privileged user accounts are established and administered in accordance with [Selection: role-based access scheme or attribute-based access scheme]",
          "parameter": "CSP-defined value",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02(07)(b)",
          "objective": "Determine if privileged role or attribute assignments are monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02(07)(c)",
          "objective": "Determine if changes to roles or attributes are monitored;",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02(07)(d)",
          "objective": "Determine if access is revoked when privileged role or attribute assignments are no longer appropriate",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (9)": {
      "name": "Restrictions on Use of Shared and Group Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(09)",
          "objective": "Determine if the use of shared and group accounts is only permitted if [organization-defined conditions] are met",
          "parameter": "CSP-defined need with justification statement that explains why such accounts are necessary",
          "guidance": "Requirement: Required if shared/group accounts are deployed\n",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AC-2 (11)": {
      "name": "Usage Conditions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(11)",
          "objective": "Determine if [organization-defined circumstances and/or usage conditions] for [organization-defined system accounts] are enforced",
          "parameter": "CSP-defined circumstances and/or usage conditions for CSP-defined system accounts",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (12)": {
      "name": "Account Monitoring for Atypical Usage",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(12)(a)",
          "objective": "Determine if system accounts are monitored for [organization-defined atypical usage]",
          "parameter": "CSP-defined atypical usage",
          "guidance": "Requirement: Required for privileged accounts\n",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-02(12)(b)",
          "objective": "Determine if atypical usage of system accounts is reported to [organization-defined personnel or roles]",
          "parameter": "at a minimum, the ISSO and/or similar role within the organization",
          "guidance": "Requirement: Required for privileged accounts\n",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-2 (13)": {
      "name": "Disable Accounts for High-risk Individuals",
      "assessment_procedures": [
        {
          "procedure_id": "AC-02(13)",
          "objective": "Determine if accounts of individuals are disabled within [organization-defined time period] of discovery of [organization-defined significant risks]",
          "parameter": "one (1) hour; CSP-defined significant risks",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-3": {
      "name": "Access Enforcement",
      "assessment_procedures": [
        {
          "procedure_id": "AC-03",
          "objective": "Determine if approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-4": {
      "name": "Information Flow Enforcement",
      "assessment_procedures": [
        {
          "procedure_id": "AC-04",
          "objective": "Determine if approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [organization-defined information flow control policies]",
          "parameter": "CSP-defined information flow control policies",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-4 (4)": {
      "name": "Flow Control of Encrypted Information",
      "assessment_procedures": [
        {
          "procedure_id": "AC-04(04)",
          "objective": "Determine if encrypted information is prevented from bypassing [organization-defined information flow control mechanisms] by [organization-defined values]",
          "parameter": "intrusion detection mechanisms; CSP-defined values",
          "guidance": "Requirement: The service provider must support Agency requirements to comply with M-21-31 (https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf) and M-22-09 (https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf).",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-4 (21)": {
      "name": "Physical or Logical Separation of Information Flows",
      "assessment_procedures": [
        {
          "procedure_id": "AC-04(21)",
          "objective": "Determine if information flows are separated logically or physically using [organization-defined mechanisms and/or techniques] to accomplish [organization-defined required separations]",
          "parameter": "CSP-defined mechanisms and/or techniques; CSP-defined required separations",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-5": {
      "name": "Separation of Duties",
      "assessment_procedures": [
        {
          "procedure_id": "AC-05a.",
          "objective": "Determine if [organization-defined duties of individuals] are identified and documented",
          "parameter": "CSP-defined duties of individuals",
          "guidance": "Guidance: CSPs have the option to provide a separation of duties matrix as an attachment to the SSP\n",
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-05b.",
          "objective": "Determine if system access authorizations to support separation of duties are defined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "AC-6": {
      "name": "Least Privilege",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06",
          "objective": "Determine if the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (1)": {
      "name": "Authorize Access to Security Functions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(01)(a)",
          "objective": "Determine if access is authorized for [organization-defined individuals and roles] to [organization-defined security functions (deployed in hardware, software and firmware)]",
          "parameter": "CSP-defined individuals and roles; all functions not publicly accessible",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-06(01)(b)",
          "objective": "Determine if access is authorized for [organization-defined individuals and roles] to [organization-defined security-relevant information]",
          "parameter": "CSP-defined individuals and roles to all security-relevant information not publicly available",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (2)": {
      "name": "Non-privileged Access for Nonsecurity Functions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(02)",
          "objective": "Determine if users of system accounts (or roles) with access to [organization-defined security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions",
          "parameter": "all security functions",
          "guidance": "Guidance: Examples of security functions include but are not limited to: establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters, system programming, system and security administration, other privileged functions            \n",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (3)": {
      "name": "Network Access to Privileged Commands",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(03)[01]",
          "objective": "Determine if network access to [organization-defined privileged commands] is authorized only for [organization-defined compelling operational needs]",
          "parameter": "all privileged commands",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-06(03)[02]",
          "objective": "Determine if the rationale for authorizing network access to privileged commands is documented in the security plan for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "AC-6 (5)": {
      "name": "Privileged Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(05)",
          "objective": "Determine if privileged accounts on the system are restricted to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AC-6 (7)": {
      "name": "Review of User Privileges",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(07)(a)",
          "objective": "Determine if privileges assigned to [organization-defined roles and classes] are reviewed [organization-defined frequency] to validate the need for such privileges",
          "parameter": "all users with privileges; at a minimum, annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-06(07)(b)",
          "objective": "Determine if privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (8)": {
      "name": "Privilege Levels for Code Execution",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(08)",
          "objective": "Determine if [organization-defined software] is prevented from executing at higher privilege levels than users executing the software",
          "parameter": "any software except software explicitly documented",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (9)": {
      "name": "Log Use of Privileged Functions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(09)",
          "objective": "Determine if the execution of privileged functions is logged",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-6 (10)": {
      "name": "Prohibit Non-privileged Users from Executing Privileged Functions",
      "assessment_procedures": [
        {
          "procedure_id": "AC-06(10)",
          "objective": "Determine if non-privileged users are prevented from executing privileged functions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-7": {
      "name": "Unsuccessful Logon Attempts",
      "assessment_procedures": [
        {
          "procedure_id": "AC-07a.",
          "objective": "Determine if a limit of [organization-defined number] consecutive invalid logon attempts by a user during [organization-defined time period] is enforced",
          "parameter": NaN,
          "guidance": "Requirement: In alignment with NIST SP 800-63B\n\n",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-07b.",
          "objective": "Determine if automatically [organization-defined values] when the maximum number of unsuccessful attempts is exceeded",
          "parameter": "locks the account/node for a minimum of three (3) hours or until unlocked by an administrator",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-8": {
      "name": "System Use Notification",
      "assessment_procedures": [
        {
          "procedure_id": "AC-08a.",
          "objective": "Determine if [organization-defined system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the AO. \n\nRequirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the AO.\n\nRequirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the AO.\n\nGuidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. ",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-08a.01.02.03.04",
          "objective": "Determine if the system use notification states that:\n - users are accessing a U.S. Government system;\n - system usage may be monitored, recorded, and subject to audit;\n - unauthorized use of the system is prohibited and subject to criminal and civil penalties; and\n - use of the system indicates consent to monitoring and recording",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AC-08b.",
          "objective": "Determine if the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-08c.",
          "objective": "Determine if for publicly accessible systems:\n - system use information [organization-defined conditions] is displayed before granting further access to the publicly accessible system;\n - any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed; and\n - a description of the authorized uses of the system is included",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider shall determine elements of the cloud environment that require the System Use Notification control. The elements of the cloud environment that require System Use Notification are approved and accepted by the AO. \n\nRequirement: The service provider shall determine how System Use Notification is going to be verified and provide appropriate periodicity of the check. The System Use Notification verification and periodicity are approved and accepted by the AO.\n\nGuidance: If performed as part of a Configuration Baseline check, then the % of items requiring setting that are checked and that pass (or fail) check can be provided. \n\nRequirement: If not performed as part of a Configuration Baseline check, then there must be documented agreement on how to provide results of verification and the necessary periodicity of the verification by the service provider. The documented agreement on how to provide verification of the results are approved and accepted by the AO.",
          "test_method": "Examine"
        }
      ]
    },
    "AC-10": {
      "name": "Concurrent Session Control",
      "assessment_procedures": [
        {
          "procedure_id": "AC-10",
          "objective": "Determine if the number of concurrent sessions for each [organization-defined account and/or account types] is limited to [organization-defined number]",
          "parameter": "three (3) sessions for privileged access and two (2) sessions for non-privileged access",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-11": {
      "name": "Device Lock",
      "assessment_procedures": [
        {
          "procedure_id": "AC-11a.",
          "objective": "Determine if further access to the system is prevented by [Selection: initiating a device lock after [organization-defined frequency]  of inactivity; requiring the user to initiate a device lock before leaving the system unattended]",
          "parameter": "fifteen (15) minutes; requiring the user to initiate a device lock before leaving the system unattended",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-11b.",
          "objective": "Determine if device lock is retained until the user re-establishes access using established identification and authentication procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-11 (1)": {
      "name": "Pattern-hiding Displays",
      "assessment_procedures": [
        {
          "procedure_id": "AC-11(01)",
          "objective": "Determine if information previously visible on the display is concealed, via device lock, with a publicly viewable image",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-12": {
      "name": "Session Termination",
      "assessment_procedures": [
        {
          "procedure_id": "AC-12",
          "objective": "Determine if a user session is automatically terminated after [organization-defined conditions or trigger events]",
          "parameter": "CSP-defined conditions or trigger events",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-14": {
      "name": "Permitted Actions Without Identification or Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "AC-14a.",
          "objective": "Determine if [organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified",
          "parameter": "CSP-defined user actions",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-14b.",
          "objective": "Determine if:\n - user actions not requiring identification or authentication are documented in the security plan for the system; and\n - a rationale for user actions not requiring identification or authentication is provided in the security plan for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "AC-17": {
      "name": "Remote Access",
      "assessment_procedures": [
        {
          "procedure_id": "AC-17a.",
          "objective": "Determine if:\n - usage restrictions are established and documented for each type of remote access allowed;\n - configuration/connection requirements are established and documented for each type of remote access allowed;\n - implementation guidance is established and documented for each type of remote access allowed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-17b.",
          "objective": "Determine if each type of remote access to the system is authorized prior to allowing such connections",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-17 (1)": {
      "name": "Monitoring and Control",
      "assessment_procedures": [
        {
          "procedure_id": "AC-17(01)",
          "objective": "Determine if automated mechanisms are employed to monitor and control remote access methods",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-17 (2)": {
      "name": "Protection of Confidentiality and Integrity Using Encryption",
      "assessment_procedures": [
        {
          "procedure_id": "AC-17(02)",
          "objective": "Determine if cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-17 (3)": {
      "name": "Managed Access Control Points",
      "assessment_procedures": [
        {
          "procedure_id": "AC-17(03)",
          "objective": "Determine if remote accesses are routed through authorized and managed network access control points",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-17 (4)": {
      "name": "Privileged Commands and Access",
      "assessment_procedures": [
        {
          "procedure_id": "AC-17(04)(a)[01][03]",
          "objective": "Determine if the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence and is authorized only for the following needs: [organization-defined needs requiring remote access]",
          "parameter": "CSP-defined needs requiring remote access",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-17(04)(a)[02][04]",
          "objective": "Determine if access to security-relevant information via remote access is authorized only in a format that provides assessable evidence and is authorized only for the following needs: [organization-defined needs requiring remote access]",
          "parameter": "CSP-defined needs requiring remote access",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-17(04)(b)",
          "objective": "Determine if the rationale for remote access is documented in the security plan for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "AC-18": {
      "name": "Wireless Access",
      "assessment_procedures": [
        {
          "procedure_id": "AC-18a.",
          "objective": "Determine if configuration requirements, connection requirements, and implementation guidance are established for each type of wireless access",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-18b.",
          "objective": "Determine if each type of wireless access to the system is authorized prior to allowing such connections",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-18 (1)": {
      "name": "Authentication and Encryption",
      "assessment_procedures": [
        {
          "procedure_id": "AC-18(01)[01]",
          "objective": "Determine if wireless access to the system is protected using authentication of [Selection: users; devices].",
          "parameter": "CSP-defined values",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-18(01)[02]",
          "objective": "Determine if wireless access to the system is protected using encryption",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-18 (3)": {
      "name": "Disable Wireless Networking",
      "assessment_procedures": [
        {
          "procedure_id": "AC-18(03)",
          "objective": "Determine if when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-18 (4)": {
      "name": "Restrict Configurations by Users",
      "assessment_procedures": [
        {
          "procedure_id": "AC-18(04)",
          "objective": "Determine if users allowed to independently configure wireless networking capabilities are identified and explicitly authorized",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examined, Interview"
        }
      ]
    },
    "AC-18 (5)": {
      "name": "Antennas and Transmission Power Levels",
      "assessment_procedures": [
        {
          "procedure_id": "AC-18(05)[01]",
          "objective": "Determine if radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-18(05)[02]",
          "objective": "Determine if transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-19": {
      "name": "Access Control for Mobile Devices",
      "assessment_procedures": [
        {
          "procedure_id": "AC-19a.",
          "objective": "Determine if configuration requirements, connection requirements, and implementation guidance are established for organization-controlled mobile devices, including when such devices are outside of the controlled area",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-19b.",
          "objective": "Determine if the connection of mobile devices to organizational systems is authorized",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-19 (5)": {
      "name": "Full Device or Container-based Encryption",
      "assessment_procedures": [
        {
          "procedure_id": "AC-19(05)",
          "objective": "Determine if [Selection: full-device encryption; container-based encryption] are employed to protect the confidentiality and integrity of information on [organization-defined mobile devices]",
          "parameter": "CSP-defined encryption type; CSP-defined mobile devices",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-20": {
      "name": "Use of External Systems",
      "assessment_procedures": [
        {
          "procedure_id": "AC-20a.",
          "objective": "Determine if [Selection: Establish [organization-defined terms and conditions]; Identify [organization-defined controls asserted to be implemented on external systems] consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:\n -  access the system from external systems (if applicable); and\n -  process, store, or transmit organization-controlled information using external systems (if applicable)",
          "parameter": "CSP-defined selection",
          "guidance": "Guidance: The interrelated controls of AC-20, CA-3, and SA-9 should be differentiated as follows:\nAC-20 describes system access to and from external systems.\nCA-3 describes documentation of an agreement between the respective system owners when data is exchanged between the CSO and an external system.\nSA-9 describes the responsibilities of external system owners. These responsibilities would typically be captured in the agreement required by CA-3.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-20b.",
          "objective": "Determine if the use of [organization-defined prohibited types of external systems] is prohibited (if applicable)",
          "parameter": "CSP-defined prohibited types of external systems",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-20 (1)": {
      "name": "Limits on Authorized Use",
      "assessment_procedures": [
        {
          "procedure_id": "AC-20(01)(a)",
          "objective": "Determine if authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization's security and privacy policies and security and privacy plans (if applicable)",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-20(01)(b)",
          "objective": "Determine if authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable)",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AC-20 (2)": {
      "name": "Portable Storage Devices - Restricted Use",
      "assessment_procedures": [
        {
          "procedure_id": "AC-20(02)",
          "objective": "Determine if the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [organization-defined restrictions]",
          "parameter": "CSP-defined restrictions",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-21": {
      "name": "Information Sharing",
      "assessment_procedures": [
        {
          "procedure_id": "AC-21a.",
          "objective": "Determine if authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information's access and use restrictions for [organization-defined information-sharing circumstances]",
          "parameter": "CSP-defined information-sharing circumstances where user discretion is required to determine whether access authorizations assigned to a sharing partner match the information's access and use restrictions are defined",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-21b.",
          "objective": "Determine if [organization-defined automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions",
          "parameter": "CSP-defined automated mechanisms or manual processes that assist users in making information-sharing and collaboration decisions are defined",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AC-22": {
      "name": "Publicly Accessible Content",
      "assessment_procedures": [
        {
          "procedure_id": "AC-22a.",
          "objective": "Determine if designated individuals are authorized to make information publicly accessible",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-22b.",
          "objective": "Determine if authorized individuals are trained to ensure that publicly accessible information does not contain non-public information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AC-22c.",
          "objective": "Determine if the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AC-22d.",
          "objective": "Determine if the content on the publicly accessible system is reviewed for non-public information [organization-defined frequency] and removed, if discovered",
          "parameter": "at least quarterly",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "AT": {
    "AT-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "AT-01a.[01][02]",
          "objective": "Determine if an awareness and training policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-01a.[03][04]",
          "objective": "Determine if awareness and training procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AT-01a.01(a)",
          "objective": "Determine if the [organization-defined level] awareness and training policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AT-01a.01(b)",
          "objective": "Determine if the awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AT-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-01c.01",
          "objective": "Determine if the current awareness and training policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-01c.02",
          "objective": "Determine if the current awareness and training procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AT-2": {
      "name": "Literacy Training and Awareness",
      "assessment_procedures": [
        {
          "procedure_id": "AT-02a.01[01][03]",
          "objective": "Determine if security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users and [organization-defined frequency] thereafter",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-02a.01[02][04]",
          "objective": "Determine if privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users and [organization-defined frequency] thereafter",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-02a.02",
          "objective": "Determine if security and privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [organization-defined events]",
          "parameter": "CSP-defined events",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-02b.",
          "objective": "Determine if [organization-defined awareness techniques] are employed to increase the security and privacy awareness of system users",
          "parameter": "CSP-defined awareness techniques",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "AT-02c.",
          "objective": "Determine if literacy training and awareness content is updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually and after significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-02d.",
          "objective": "Determine if lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AT-2 (2)": {
      "name": "Insider Threat",
      "assessment_procedures": [
        {
          "procedure_id": "AT-02(02)",
          "objective": "Determine if literacy training on recognizing and reporting potential indicators of insider threat is provided",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AT-2 (3)": {
      "name": "Social Engineering and Mining",
      "assessment_procedures": [
        {
          "procedure_id": "AT-02(03)",
          "objective": "Determine if literacy training on recognizing and reporting potential and actual instances of social engineering and social mining is provided",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AT-3": {
      "name": "Role-Based Training",
      "assessment_procedures": [
        {
          "procedure_id": "AT-03a.01",
          "objective": "Determine if role-based security and privacy training is provided to [organization-defined roles and responsibilities] before authorizing access to the system, information, or performing assigned duties and [organization-defined frequency] thereafter",
          "parameter": "CSP-defined roles and responsibilities; at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-03a.02",
          "objective": "Determine if role-based security and privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-03b.",
          "objective": "Determine if role-based training content is updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "AT-03c.",
          "objective": "Determine if lessons learned from internal or external security incidents or breaches are incorporated into role-based training",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AT-4": {
      "name": "Training Records",
      "assessment_procedures": [
        {
          "procedure_id": "AT-04a.",
          "objective": "Determine if information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented and monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AT-04b.",
          "objective": "Determine if individual training records are retained for [organization-defined time period]",
          "parameter": "five (5) years or 5 years after completion of a specific training program",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    }
  },
  "AU": {
    "AU-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "AU-01a.[01][02]",
          "objective": "Determine if an audit and accountability policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-01a.[03][04]",
          "objective": "Determine if audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AU-01a.01(a)",
          "objective": "Determine if the [organization-defined level] audit and accountability policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AU-01a.01(b)",
          "objective": "Determine if the audit and accountability policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "AU-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-01c.01",
          "objective": "Determine if the current audit and accountability policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-01c.02",
          "objective": "Determine if the current audit and accountability procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AU-2": {
      "name": "Event Logging",
      "assessment_procedures": [
        {
          "procedure_id": "AU-02a.",
          "objective": "Determine if [organization-defined event types] that the system is capable of logging are identified in support of the audit logging function",
          "parameter": "successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-02b.",
          "objective": "Determine if the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-02c.[01]",
          "objective": "Determine if [organization-defined event types (subset of organization-defined in AU-02.a)] are specified for logging within the system",
          "parameter": "CSP-defined event types",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-02c.[02]",
          "objective": "Determine if the specified event types are logged within the system [organization-defined frequency or situation]",
          "parameter": "continuously",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "AU-02d.",
          "objective": "Determine if a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents",
          "parameter": NaN,
          "guidance": "Requirement: Coordination between service provider and consumer shall be documented and accepted by the AO.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-02e.",
          "objective": "Determine if the event types selected for logging are reviewed and updated [organization-defined frequency]",
          "parameter": "annually and whenever there is a change in the threat environment",
          "guidance": "Guidance: Annually or whenever changes in the threat environment are communicated to the service provider by the AO",
          "test_method": "Test"
        }
      ]
    },
    "AU-3": {
      "name": "Content of Audit Records",
      "assessment_procedures": [
        {
          "procedure_id": "AU-03",
          "objective": "Determine if audit records contain information that establishes:\n - what type of event occurred;\n - when the event occurred;\n - where the event occurred;\n - the source of the event;\n - the outcome of the event;\n - the identity of any individuals, subjects, or objects/entities associated with the event",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-3 (1)": {
      "name": "Additional Audit Information",
      "assessment_procedures": [
        {
          "procedure_id": "AU-03(01)",
          "objective": "Determine if generated audit records contain the following [organization-defined additional information]",
          "parameter": "session, connection, transaction, or activity duration; for client-server transactions, the number of bytes received and bytes sent; additional informational messages to diagnose or identify the event; characteristics that describe or identify the object or resource being acted upon; individual identities of group account users; full-text of privileged commands",
          "guidance": "Guidance: For client-server transactions, the number of bytes sent and received gives bidirectional transfer information that can be helpful during an investigation or inquiry.",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-4": {
      "name": "Audit Log Storage Capacity",
      "assessment_procedures": [
        {
          "procedure_id": "AU-04",
          "objective": "Determine if audit log storage capacity is allocated to accommodate [organization-defined audit log retention requirements]",
          "parameter": "CSP-defined audit log retention requirements",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-5": {
      "name": "Response to Audit Logging Process Failures",
      "assessment_procedures": [
        {
          "procedure_id": "AU-05a.",
          "objective": "Determine if [organization-defined personnel or roles] are alerted in the event of an audit logging process failure within [organization-defined time period]",
          "parameter": "CSP-defined personnel or roles within CSP-defined time period",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AU-05b.",
          "objective": "Determine if [organization-defined additional actions] are taken in the event of an audit logging process failure",
          "parameter": "overwrite oldest record",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-5 (1)": {
      "name": "Storage Capacity Warning",
      "assessment_procedures": [
        {
          "procedure_id": "AU-05(01)",
          "objective": "Determine if a warning is provided to [organization-defined personnel, roles, and/or locations] within [organization-defined time period] when allocated audit log storage volume reaches [organization-defined percentage] of repository maximum audit log storage capacity",
          "parameter": "CSP-defined personnel, roles, and/or locations; CSP-defined time period; CSP-defined percentage",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-5 (2)": {
      "name": "Real-time Alerts",
      "assessment_procedures": [
        {
          "procedure_id": "AU-05(02)",
          "objective": "Determine if an alert is provided within [organization-defined real-time period] to [organization-defined personnel, roles, and/or locations] when [organization-defined audit logging failure events requiring real-time alerts] occur",
          "parameter": "real-time; service provider personnel with authority to address failed audit events; audit failure events requiring real-time alerts, as defined by organization audit policy",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6": {
      "name": "Audit Record Review, Analysis, and Reporting",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06a.",
          "objective": "Determine if system audit records are reviewed and analyzed [organization-defined frequency] for indications of [organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity",
          "parameter": "at least weekly; CSP-defined inappropriate or unusual activity",
          "guidance": "Requirement: Coordination between service provider and consumer shall be documented and accepted by the AO. In multi-tenant environments, capability and means for providing review, analysis, and reporting to consumer for data pertaining to consumer shall be documented.",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AU-06b.",
          "objective": "Determine if findings are reported to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AU-06c.",
          "objective": "Determine if the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (1)": {
      "name": "Automated Process Integration",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(01)",
          "objective": "Determine if audit record review, analysis, and reporting processes are integrated using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (3)": {
      "name": "Correlate Audit Record Repositories",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(03)",
          "objective": "Determine if audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (4)": {
      "name": "Central Review and Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(04)",
          "objective": "Determine if the capability to centrally review and analyze audit records from multiple components within the system is provided and implemented.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (5)": {
      "name": "Integrated Analysis of Audit Records",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(05)",
          "objective": "Determine if analysis of audit records is integrated with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [organization-defined data/information collected from other sources] to further enhance the ability to identify inappropriate or unusual activity.",
          "parameter": "vulnerability scanning information; performance data; information system monitoring information; penetration test data; CSP-defined data/information collected from other sources",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (6)": {
      "name": "Correlation with Physical Monitoring",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(06)",
          "objective": "Determine if information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity",
          "parameter": NaN,
          "guidance": "Requirement: Coordination between service provider and consumer shall be documented and accepted by the AO",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-6 (7)": {
      "name": "Permitted Actions",
      "assessment_procedures": [
        {
          "procedure_id": "AU-06(07)",
          "objective": "Determine if the permitted actions for each [organization-defined values] associated with the review, analysis, and reporting of audit record information are specified",
          "parameter": "information system process, role, user",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "AU-7": {
      "name": "Audit Record Reduction and Report Generation",
      "assessment_procedures": [
        {
          "procedure_id": "AU-07a.",
          "objective": "Determine if an audit record reduction and report generation capability is provided and implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "AU-07b.",
          "objective": "Determine if an audit record reduction and report generation capability is provided and implemented that does not alter the original content or time ordering of audit records",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-7 (1)": {
      "name": "Automatic Processing",
      "assessment_procedures": [
        {
          "procedure_id": "AU-07(01)",
          "objective": "Determine if the capability to process, sort, and search audit records for events of interest based on [organization-defined fields within audit records] are provided and implemented",
          "parameter": "CSP-defined fields within audit records",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-8": {
      "name": "Time Stamps",
      "assessment_procedures": [
        {
          "procedure_id": "AU-08a.",
          "objective": "Determine if internal system clocks are used to generate timestamps for audit records",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AU-08b.",
          "objective": "Determine if timestamps are recorded for audit records that meet [organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp",
          "parameter": "one second of granularity of time measurement",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-9": {
      "name": "Protection of Audit Information",
      "assessment_procedures": [
        {
          "procedure_id": "AU-09a.",
          "objective": "Determine if audit information and audit logging tools are protected from unauthorized access, modification, and deletion",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "AU-09b.",
          "objective": "Determine if [organization-defined personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-9 (2)": {
      "name": "Store on Separate Physical Systems or Components",
      "assessment_procedures": [
        {
          "procedure_id": "AU-09(02)",
          "objective": "Determine if audit records are stored [organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited",
          "parameter": "at least weekly",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-9 (3)": {
      "name": "Cryptographic Protection",
      "assessment_procedures": [
        {
          "procedure_id": "AU-09(03)",
          "objective": "Determine if cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented",
          "parameter": NaN,
          "guidance": "Guidance: Note that this enhancement requires the use of cryptography which must be compliant with Federal requirements and utilize FIPS validated or NSA approved cryptography (see SC-13)",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-9 (4)": {
      "name": "Access by Subset of Privileged Users",
      "assessment_procedures": [
        {
          "procedure_id": "AU-09(04)",
          "objective": "Determine if access to management of audit logging functionality is authorized only to [organization-defined subset of privileged users or roles]",
          "parameter": "CSP-defined subset of privileged users or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-10": {
      "name": "Non-repudiation",
      "assessment_procedures": [
        {
          "procedure_id": "AU-10",
          "objective": "Determine if irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [organization-defined actions]",
          "parameter": "minimum actions including the addition, modification, deletion, approval, sending, or receiving of data",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-11": {
      "name": "Audit Record Retention",
      "assessment_procedures": [
        {
          "procedure_id": "AU-11",
          "objective": "Determine if audit records are retained for [organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements",
          "parameter": "a time period in compliance with M-21-31",
          "guidance": "Requirement: The service provider retains audit records on-line for at least ninety days and further preserves audit records off-line for a period that is in accordance with NARA requirements \n\nRequirement: The service provider must support Agency requirements to comply with M-21-31 (https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)\n\nGuidance: The service provider is encouraged to align with M-21-31 where possible",
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-12": {
      "name": "Audit Record Generation",
      "assessment_procedures": [
        {
          "procedure_id": "AU-12a.",
          "objective": "Determine if audit record generation capability for the event types the system is capable of auditing (events defined in AU-02) is provided by [organization-defined system components]",
          "parameter": "all information system and network components where audit capability is deployed/available",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-12b.",
          "objective": "Determine if [organization-defined personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "AU-12c.",
          "objective": "Determine if audit records for the event types defined in AU-02 that include the audit record content defined in AU-03 are generated",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "AU-12 (1)": {
      "name": "System-wide and Time-correlated Audit Trail",
      "assessment_procedures": [
        {
          "procedure_id": "AU-12(01)",
          "objective": "Determine if audit records from [organization-defined system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [organization-defined level of tolerance for the relationship between timestamps of individual records in the audit trail]",
          "parameter": "all network, data storage, and computing devices; CSP-defined level of tolerance",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "AU-12 (3)": {
      "name": "Changes by Authorized Individuals",
      "assessment_procedures": [
        {
          "procedure_id": "AU-12(03)",
          "objective": "Determine if the capability for [organization-defined individuals or roles] to change the logging to be performed on [organization-defined system components] based on [organization-defined selectable event criteria] within [organization-defined time thresholds] is provided and implemented",
          "parameter": "service provider-defined individuals or roles with audit configuration responsibilities; all network data storage, and computing devices based on CSP-defined selectable event criteria within-CSP-defined time thresholds",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "CA": {
    "CA-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "CA-01a.[01][02]",
          "objective": "Determine if an assessment, authorization, and monitoring policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-01a.[03][04]",
          "objective": "Determine if assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-01a.01(a)",
          "objective": "Determine if the [organization-defined level] assessment, authorization, and monitoring policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-01a.01(b)",
          "objective": "Determine if the assessment, authorization, and monitoring policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-01c.01",
          "objective": "Determine if the current assessment, authorization, and monitoring policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-01c.02",
          "objective": "Determine if the current assessment, authorization, and monitoring procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-2": {
      "name": "Control Assessments",
      "assessment_procedures": [
        {
          "procedure_id": "CA-02a.",
          "objective": "Determine if an appropriate assessor or assessment team is selected for the type of assessment to be conducted",
          "parameter": NaN,
          "guidance": "Guidance: Reference FedRAMP Annual Assessment Guidance",
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-02b.01",
          "objective": "Determine if a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-02b.02",
          "objective": "Determine if a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-02b.03",
          "objective": "Determine if a control assessment plan is developed that describes the scope of the assessment, including the assessment environment, assessment team and assessment roles and responsibilities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-02c.",
          "objective": "Determine if the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-02d.",
          "objective": "Determine if controls are assessed in the system and its environment of operation [organizational-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-02e.",
          "objective": "Determine if a control assessment report is produced that documents the results of the assessment",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-02f.",
          "objective": "Determine if the results of the control assessment are provided to [organization-defined individuals or roles]",
          "parameter": "individuals or roles to include FedRAMP",
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "CA-2 (1)": {
      "name": "Independent Assessors",
      "assessment_procedures": [
        {
          "procedure_id": "CA-02(01)",
          "objective": "Determine if independent assessors or assessment teams are employed to conduct control assessments",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-2 (2)": {
      "name": "Specialized Assessments",
      "assessment_procedures": [
        {
          "procedure_id": "CA-02(02)",
          "objective": "Determine if [organization-defined frequency] [Selection: announced; unannounced] [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]]  are included as part of control assessments",
          "parameter": "at least annually",
          "guidance": "Requirement: to include 'announced', 'vulnerability scanning'",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-2 (3)": {
      "name": "Leveraging Results from External Organizations",
      "assessment_procedures": [
        {
          "procedure_id": "CA-02(03)",
          "objective": "Determine if the results of control assessments performed by [organization-defined external organization] on [organization-defined system] are leveraged when the assessment meets [organization-defined requirements]",
          "parameter": "an Independent Assessor; FedRAMP authorization and is listed on the FedRAMP Marketplace",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-3": {
      "name": "Information Exchange",
      "assessment_procedures": [
        {
          "procedure_id": "CA-03a.",
          "objective": "Determine if the exchange of information between the system and other systems is approved and managed using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; nondisclosure agreements; organization-defined type of agreement]",
          "parameter": "CSP-defined agreements",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-03b.",
          "objective": "Determine if the following are documented as part of each exchange agreement:\n- the interface characteristics\n- security requirements\n- privacy requirements\n- controls\n- responsibilities for each system\n- impact level of the information communicated",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-03c.",
          "objective": "Determine if agreements are reviewed and updated [organization-defined frequency]",
          "parameter": "at least annually and on input from AO",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-3 (6)": {
      "name": "Transfer Authorizations",
      "assessment_procedures": [
        {
          "procedure_id": "CA-03(06)",
          "objective": "Determine if individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-5": {
      "name": "Plan of Action and Milestones",
      "assessment_procedures": [
        {
          "procedure_id": "CA-05a.",
          "objective": "Determine if a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-05b.",
          "objective": "Determine if existing plan of action and milestones are updated [organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities",
          "parameter": "at least monthly",
          "guidance": "Requirement: POA&Ms must be provided at least monthly\n\nGuidance: Reference FedRAMP-POAM-Template",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-6": {
      "name": "Authorization",
      "assessment_procedures": [
        {
          "procedure_id": "CA-06a.",
          "objective": "Determine if a senior official is assigned as the authorizing official for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-06b.",
          "objective": "Determine if a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-06c.01",
          "objective": "Determine if before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-06c.02",
          "objective": "Determine if before commencing operations, the authorizing official for the system authorizes the system to operate",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-06d.",
          "objective": "Determine if the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-06e.",
          "objective": "Determine if the authorizations are updated [organization-defined frequency]",
          "parameter": "in accordance with OMB A-130 requirements or when a significant change occurs",
          "guidance": "Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F and according to FedRAMP Significant Change Policies and Procedures. The service provider describes the types of changes to the information system or the environment of operations that would impact the risk posture. The types of changes are approved and accepted by the AO",
          "test_method": "Examine"
        }
      ]
    },
    "CA-7": {
      "name": "Continuous Monitoring",
      "assessment_procedures": [
        {
          "procedure_id": "CA-07[01][02]",
          "objective": "Determine if a system-level continuous monitoring strategy is developed and implemented in accordance with the organization-level continuous monitoring strategy",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07a.",
          "objective": "Determine if system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [organization-defined system-level metrics]",
          "parameter": "CSP-defined system-level metrics",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07b.",
          "objective": "Determine if system-level continuous monitoring includes established [organization-defined frequencies] for monitoring and assessment of control effectiveness",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: Operating System, Database, Web Application, Container, and Service Configuration Scans: at least monthly. All scans performed by Independent Assessor: at least annually.\n\nRequirement: CSOs with more than one agency ATO must implement a collaborative Continuous Monitoring (ConMon) approach described in the FedRAMP Guide for Multi-Agency Continuous Monitoring. This requirement applies to CSOs authorized via the Agency path as each agency customer is responsible for performing ConMon oversight. \n\nGuidance: FedRAMP does not provide a template for the Continuous Monitoring Plan. CSPs should reference the FedRAMP Continuous Monitoring Strategy Guide when developing the Continuous Monitoring Plan.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07c.",
          "objective": "Determine if system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07d.",
          "objective": "Determine if system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07e.",
          "objective": "Determine if system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07f.",
          "objective": "Determine if system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07g.",
          "objective": "Determine if system-level continuous monitoring includes reporting the security and privacy status of the system to [organization-defined personnel or roles] [organization-defined frequency]",
          "parameter": "to include AO; CSP-defined frequency",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-7 (1)": {
      "name": "Independent Assessment",
      "assessment_procedures": [
        {
          "procedure_id": "CA-07(01)",
          "objective": "Determine if independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-7 (4)": {
      "name": "Risk Monitoring",
      "assessment_procedures": [
        {
          "procedure_id": "CA-07(04)",
          "objective": "Determine if risk monitoring is an integral part of the continuous monitoring strategy",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07(04)(a)",
          "objective": "Determine if effectiveness monitoring is included in risk monitoring",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07(04)(b)",
          "objective": "Determine if compliance monitoring is included in risk monitoring",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-07(04)(c)",
          "objective": "Determine if change monitoring is included in risk monitoring.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-8": {
      "name": "Penetration Testing",
      "assessment_procedures": [
        {
          "procedure_id": "CA-08",
          "objective": "Determine if penetration testing is conducted [organization-defined frequency] on [organization-defined systems or system components]",
          "parameter": "at least annually; CSP-defined systems or system components",
          "guidance": "Guidance: Reference the FedRAMP Penetration Test Guidance",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-8 (1)": {
      "name": "Independent Penetration Testing Agent or Team",
      "assessment_procedures": [
        {
          "procedure_id": "CA-08(01)",
          "objective": "Determine if an independent penetration testing agent or team is employed to perform penetration testing on the system or system components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-8 (2)": {
      "name": "Red Team Exercises",
      "assessment_procedures": [
        {
          "procedure_id": "CA-08(02)",
          "objective": "Determine if [organization-defined red team exercises] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement",
          "parameter": "CSP-defined red team exercises",
          "guidance": "Guidance: See the FedRAMP Documents page> Penetration Test Guidance \nhttps://www.FedRAMP.gov/documents/",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CA-9": {
      "name": "Internal System Connections",
      "assessment_procedures": [
        {
          "procedure_id": "CA-09a.",
          "objective": "Determine if internal connections of [organization-defined system components or classes of components] to the system are authorized",
          "parameter": "CSP-defined system components or classes of components",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-09b.",
          "objective": "Determine if for each internal connection the following elements are documented:\n- interface characteristics\n- security requirements\n- privacy requirements\n- nature of the information communicated",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CA-09c.",
          "objective": "Determine if internal system connections are terminated after [organization-defined conditions]",
          "parameter": "CSP-defined conditions",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CA-09d.",
          "objective": "Determine if the continued need for each internal connection is reviewed [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    }
  },
  "CM": {
    "CM-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "CM-01a.[01][02]",
          "objective": "Determine if a configuration management policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-01a.[03][04]",
          "objective": "Determine if configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-01a.01(a)",
          "objective": "Determine if the [organization-defined level] configuration management policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-01a.01(b)",
          "objective": "Determine if the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-01c.01",
          "objective": "Determine if the current configuration management policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-01c.02",
          "objective": "Determine if the current configuration management procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-2": {
      "name": "Baseline Configuration",
      "assessment_procedures": [
        {
          "procedure_id": "CM-02a.",
          "objective": "Determine if a current baseline configuration of the system is developed, documented and maintained under configuration control",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-02b.01",
          "objective": "Determine if the baseline configuration of the system is reviewed and updated [in accordance with the organization-defined frequency]",
          "parameter": "at least annually and when a significant change occurs",
          "guidance": "Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F\n",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-02b.02",
          "objective": "Determine if the baseline configuration of the system is reviewed and updated when required due to [organization-defined circumstances]",
          "parameter": "to include when directed by the AO ",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-02b.03",
          "objective": "Determine if the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-2 (2)": {
      "name": "Automation Support for Accuracy and Currency",
      "assessment_procedures": [
        {
          "procedure_id": "CM-02(02)",
          "objective": "Determine if the currency, completeness, accuracy, availability of the baseline configuration of the system is maintained using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-2 (3)": {
      "name": "Retention of Previous Configurations",
      "assessment_procedures": [
        {
          "procedure_id": "CM-02(03)",
          "objective": "Determine if [organization-defined number] of previous baseline configuration version(s) of the system is/are retained to support rollback.",
          "parameter": "CSP-defined number of previous versions of baseline configurations of the previously approved baseline configuration of IS components",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-2 (7)": {
      "name": "Configure Systems and Components for High-risk Areas",
      "assessment_procedures": [
        {
          "procedure_id": "CM-02(07)(a)",
          "objective": "Determine if [organization-defined systems or system components] with [organization-defined configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;",
          "parameter": "CSP-defined systems or system components; CSP-defined configurations",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-02(07)(b)",
          "objective": "Determine if [organization-defined controls] are applied to the systems or system components when the individuals return from travel.",
          "parameter": "CSP-defined controls",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-3": {
      "name": "Configuration Change Control",
      "assessment_procedures": [
        {
          "procedure_id": "CM-03a.",
          "objective": "Determine if the types of changes to the system that are configuration-controlled are determined and documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03b.",
          "objective": "Determine if proposed configuration-controlled changes to the system are reviewed, and approved or disapproved with explicit consideration for security and privacy impact analyses",
          "parameter": NaN,
          "guidance": "Requirement: The service provider establishes a central means of communicating major changes to or developments in the information system or environment of operations that may affect its services to the federal government and associated service consumers (e.g., electronic bulletin board, web status page). The means of communication are approved and accepted by the AO\n\nGuidance: In accordance with record retention policies and procedures",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03c.",
          "objective": "Determine if configuration change decisions associated with the system are documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03d.",
          "objective": "Determine if approved configuration-controlled changes to the system are implemented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-03e.",
          "objective": "Determine if records of configuration-controlled changes to the system are retained for [organization-defined time period]",
          "parameter": "CSP-defined time period",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-03f.",
          "objective": "Determine if activities associated with configuration-controlled changes to the system are monitored and reviewed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03g.[01]",
          "objective": "Determine if configuration change control activities are coordinated and overseen by [organization-defined configuration change control element]",
          "parameter": "CSP-defined configuration change control element",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03g.[02]",
          "objective": "Determine if the configuration control element convenes at the [organization-defined frequency]",
          "parameter": "CSP-defined frequency",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-3 (1)": {
      "name": "Automated Documentation, Notification, and Prohibition of Changes",
      "assessment_procedures": [
        {
          "procedure_id": "CM-03(01)(a)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to document proposed changes to the system",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03(01)(b)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to notify [organization-defined approval authorities] of proposed changes to the system and request change approval",
          "parameter": "CSP-defined automated mechanisms are used to notify CSP-defined approval authorities",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03(01)(c)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to highlight proposed changes to the system that have not been approved or disapproved within [organization-defined time period]",
          "parameter": "CSP agreed upon time period",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03(01)(d)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to prohibit changes to the system until designated approvals are received",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03(01)(e)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to document all changes to the system",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-03(01)(f)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to notify [organization-defined personnel] when approved changes to the system are completed",
          "parameter": "CSP-defined automated mechanisms are used to notify configuration management approval authorities",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-3 (2)": {
      "name": "Testing, Validation, and Documentation of Changes",
      "assessment_procedures": [
        {
          "procedure_id": "CM-03(02)",
          "objective": "Determine if changes to the system are tested, validated and documented before finalizing the implementation of the changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-3 (4)": {
      "name": "Security and Privacy Representatives",
      "assessment_procedures": [
        {
          "procedure_id": "CM-03(04)",
          "objective": "Determine if [organization-defined security and privacy representatives] are required to be members of the [organization-defined configuration change control element]",
          "parameter": "CSP-defined security and privacy representatives; configuration control board (CCB) or similar (as defined in CM-3)",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-3 (6)": {
      "name": "Cryptography Management",
      "assessment_procedures": [
        {
          "procedure_id": "CM-03(06)",
          "objective": "Determine if cryptographic mechanisms used to provide [organization-defined controls] are under configuration management",
          "parameter": "all security safeguards that rely on cryptography",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-4": {
      "name": "Impact Analyses",
      "assessment_procedures": [
        {
          "procedure_id": "CM-04",
          "objective": "Determine if changes to the system are analyzed to determine potential security and privacy impacts prior to change implementation.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-4 (1)": {
      "name": "Separate Test Environments",
      "assessment_procedures": [
        {
          "procedure_id": "CM-04(01)[01]",
          "objective": "Determine if changes to the system are analyzed in a separate test environment before implementation in an operational environment.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-04(01)[02][03][04][05][06][07][08][09]",
          "objective": "Determine if changes to the system are analyzed for security and privacy impacts due to flaws, weaknesses, incompatibility or intentional malice",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-4 (2)": {
      "name": "Verification of Controls",
      "assessment_procedures": [
        {
          "procedure_id": "CM-04(02)",
          "objective": "Determine if the impacted controls are implemented correctly, operating as intended and producing the desired outcome with regard to meeting the security and privacy requirements for the system after system changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-5": {
      "name": "Access Restrictions for Change",
      "assessment_procedures": [
        {
          "procedure_id": "CM-05",
          "objective": "Determine if physical and logical access restrictions associated with changes to the system are defined, documented, approved and enforced",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-5 (1)": {
      "name": "Automated Access Enforcement and Audit Records",
      "assessment_procedures": [
        {
          "procedure_id": "CM-05(01)(a)",
          "objective": "Determine if access restrictions for change are enforced using [organization-defined automated mechanisms].",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-05(01)(b)",
          "objective": "Determine if audit records of enforcement actions are automatically generated.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-5 (5)": {
      "name": "Privilege Limitation for Production and Operation",
      "assessment_procedures": [
        {
          "procedure_id": "CM-05(05)(a)",
          "objective": "Determine if privileges to change system components and system-related information within a production or operational environment are limited",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-05(05)(b)",
          "objective": "Determine if privileges are reviewed and reevaluated [organization-defined frequency]",
          "parameter": "at least quarterly",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-6": {
      "name": "Configuration Settings",
      "assessment_procedures": [
        {
          "procedure_id": "CM-06a.",
          "objective": "Determine if configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [organization-defined common secure configurations]",
          "parameter": "DoD STIGs (see Additional FedRAMP Requirements / Guidance)",
          "guidance": "Requirement: The service provider shall use the DoD STIGs to establish configuration settings; Center for Internet Security up to Level 2 (CIS Level 2) guidelines shall be used if STIGs are not available; Custom baselines shall be used if CIS is not available.\n\nRequirement: The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).\n\nGuidance: Compliance checks are used to evaluate configuration settings and provide general insight into the overall effectiveness of configuration management activities. CSPs and 3PAOs typically combine compliance check findings into a single CM-6 finding, which is acceptable. However, for initial assessments, annual assessments, and significant change requests, FedRAMP requires a clear understanding, on a per-control basis, where risks exist. Therefore, 3PAOs must also analyze compliance check findings as part of the controls assessment. Where a direct mapping exists, the 3PAO must document additional findings per control in the corresponding SAR Risk Exposure Table (RET), which are then documented in the CSP\u2019s Plan of Action and Milestones (POA&M). This will likely result in the details of individual control findings overlapping with those in the combined CM-6 finding, which is acceptable. During monthly continuous monitoring, new findings from CSP compliance checks may be combined into a single CM-6 POA&M item. CSPs are not required to map the findings to specific controls because controls are only assessed during initial assessments, annual assessments, and significant change requests.",
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-06b.",
          "objective": "Determine if the configuration settings documented in CM-06a are implemented.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-06c.",
          "objective": "Determine if any deviations from established configuration settings for [organization-defined system components] are identified, documented and approved based on [organization-defined operational requirements]",
          "parameter": "CSP-defined system components; CSP-defined operational requirements",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-06d.",
          "objective": "Determine if changes to the configuration settings are monitored and controlled in accordance with organizational policies and procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-6 (1)": {
      "name": "Automated Management, Application, and Verification",
      "assessment_procedures": [
        {
          "procedure_id": "CM-06(01)",
          "objective": "Determine if configuration settings for [organization-defined system components for which to manage, apply, and verify] are managed, applied and verified using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined system components; CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-6 (2)": {
      "name": "Respond to Unauthorized Changes",
      "assessment_procedures": [
        {
          "procedure_id": "CM-06(02)",
          "objective": "Determine if [organization-defined actions] are taken in response to unauthorized changes to [organization-defined configuration settings].",
          "parameter": "CSP-defined actions; CSP-defined configuration settings",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-7": {
      "name": "Least Functionality",
      "assessment_procedures": [
        {
          "procedure_id": "CM-07a.",
          "objective": "Determine if the system is configured to provide only [organization-defined mission-essential capabilities].",
          "parameter": "CSP-defined mission-essential capabilities",
          "guidance": "Requirement: The service provider shall use Security guidelines (See CM-6) to establish list of prohibited or restricted functions, ports, protocols, and/or services or establishes its own list of prohibited or restricted functions, ports, protocols, and/or services if STIGs or CIS is not available",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-07b.",
          "objective": "Determine if the use of [organization-defined functions, ports, protocols, software and services] is prohibited or restricted",
          "parameter": "CSP-defined functions, ports, protocols, software, and services",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-7 (1)": {
      "name": "Periodic Review",
      "assessment_procedures": [
        {
          "procedure_id": "CM-07(01)(a)",
          "objective": "Determine if the system is reviewed [organization-defined frequency] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services.",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-07(01)(b)",
          "objective": "Determine if [organization-defined functions, ports, protocols, software and services to be disabled or removed when deemed unnecessary or non-secure] are disabled or removed",
          "parameter": "CSP-defined functions, ports, protocols, software, and services to be disabled or removed when deemed unnecessary or non-secure",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-7 (2)": {
      "name": "Prevent Program Execution",
      "assessment_procedures": [
        {
          "procedure_id": "CM-07(02)",
          "objective": "Determine if program execution is prevented in accordance with [Selection: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage].",
          "parameter": "CSP-defined parameters",
          "guidance": "Guidance: This control refers to software deployment by CSP personnel into the production environment. The control requires a policy that states conditions for deploying software. This control shall be implemented in a technical manner on the information system to only allow programs to run that adhere to the policy (i.e. allow-listing). This control is not to be based off of strictly written policy on what is allowed or not allowed to run.",
          "test_method": "Test"
        }
      ]
    },
    "CM-7 (5)": {
      "name": "Authorized Software - Allow-By-Exception",
      "assessment_procedures": [
        {
          "procedure_id": "CM-07(05)(a)",
          "objective": "Determine if [organization-defined software programs authorized to execute on the system] are identified.",
          "parameter": "CSP-defined software programs",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-07(05)(b)",
          "objective": "Determine if a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-07(05)(c)",
          "objective": "Determine if the list of authorized software programs is reviewed and updated [organization-defined frequency].",
          "parameter": "at least quarterly or when there is a change",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-8": {
      "name": "System Component Inventory",
      "assessment_procedures": [
        {
          "procedure_id": "CM-08a.01.02.03.04.05",
          "objective": "Determine if an inventory of system components is developed and documented that:\n- accurately reflects the system\n- includes all components within the system\n- does not include duplicate accounting of components or components assigned to any other system\n- is at the level of granularity deemed necessary for tracking and reporting\n- includes [organization-defined information deemed necessary to achieve effective system component accountability]",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-08b.01",
          "objective": "Determine if the system component inventory is reviewed and updated [organization-defined frequency].",
          "parameter": "at least monthly",
          "guidance": "Requirement: Must be provided at least monthly or when there is a change.",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-8 (1)": {
      "name": "Updates During Installation and Removal",
      "assessment_procedures": [
        {
          "procedure_id": "CM-08(01)",
          "objective": "Determine if the inventory of system components is updated as part of component installations, component removals and system updates",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-8 (2)": {
      "name": "Automated Maintenance",
      "assessment_procedures": [
        {
          "procedure_id": "CM-08(02)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to maintain the currency, completeness, accuracy and availability of the system component inventory",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-8 (3)": {
      "name": "Automated Unauthorized Component Detection",
      "assessment_procedures": [
        {
          "procedure_id": "CM-08(03)(a)",
          "objective": "Determine if the presence of unauthorized hardware, software and firmware within the system is detected using [organization-defined automated mechanisms] on an [organization-defined frequency]",
          "parameter": "continuously using automated mechanisms; maximum five-minute delay in detection",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "CM-08(03)(b)",
          "objective": "Determine if the system [Selection: disables network access by unauthorized users; isolates unauthorized components, or notifies organization-defined personnel or roles] when unauthorized hardware, software or firmware is detected",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-8 (4)": {
      "name": "Accountability Information",
      "assessment_procedures": [
        {
          "procedure_id": "CM-08(04)",
          "objective": "Determine if individuals responsible and accountable for administering system components are identified by [organization-defined name; position; role] in the system component inventory.",
          "parameter": "position and role",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-9": {
      "name": "Configuration Management Plan",
      "assessment_procedures": [
        {
          "procedure_id": "CM-09",
          "objective": "Determine if a configuration management plan for the system is developed, documented and implemented",
          "parameter": NaN,
          "guidance": "Guidance: FedRAMP does not provide a template for the Configuration Management Plan. However, NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems, provides guidelines for the implementation of CM controls as well as a sample CMP outline in Appendix D of the Guide",
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-09a.",
          "objective": "Determine if the configuration management plan addresses roles, responsibilities, and configuration management processes and procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-09b.[01]",
          "objective": "Determine if the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-09b.[02]",
          "objective": "Determine if the configuration management plan establishes a process for managing the configuration of the configuration items.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-09c.[01]",
          "objective": "Determine if the configuration management plan defines the configuration items for the system.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-09c.[02]",
          "objective": "Determine if the configuration management plan places the configuration items under configuration management. ",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CM-09d.",
          "objective": "Determine if the configuration management plan is reviewed and approved by [organization-defined personnel or roles].",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-09e.",
          "objective": "Determine if the configuration management plan is protected from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-10": {
      "name": "Software Usage Restrictions",
      "assessment_procedures": [
        {
          "procedure_id": "CM-10a.",
          "objective": "Determine if software and associated documentation are used in accordance with contract agreements and copyright laws.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-10b.",
          "objective": "Determine if the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-10c.",
          "objective": "Determine if the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-11": {
      "name": "User-installed Software",
      "assessment_procedures": [
        {
          "procedure_id": "CM-11a.",
          "objective": "Determine if [organization-defined policies] governing the installation of software by users are established.",
          "parameter": "CSP-defined policies",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-11b.",
          "objective": "Determine if software installation policies are enforced through [organization-defined methods].",
          "parameter": "CSP-defined methods",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-11c.",
          "objective": "Determine if compliance with [organization-defined policies] is monitored at [organization-defined frequency].",
          "parameter": "CSP-defined policies; continuously (via CM-7(5))",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "CM-12": {
      "name": "Information Location",
      "assessment_procedures": [
        {
          "procedure_id": "CM-12a.[01]",
          "objective": "Determine if the location of [organization-defined information] is identified and documented.",
          "parameter": "CSP-defined information",
          "guidance": "Requirement: According to FedRAMP Authorization Boundary Guidance",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-12a.[02][03]",
          "objective": "Determine if the specific system components on which [organization-defined information] is processed and stored are identified and documented.",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-12b.",
          "objective": "Determine if the users who have access to the system and system components where [organization-defined information] is processed and stored are identified and documented.",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CM-12c.",
          "objective": "Determine if changes to the location (i.e., system or system components) where [organization-defined information] is processed and stored are documented.",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CM-12 (1)": {
      "name": "Automated Tools to Support Information Location",
      "assessment_procedures": [
        {
          "procedure_id": "CM-12(01)",
          "objective": "Determine if automated tools are used to identify [organization-defined information by information type] on [organization-defined system components] to ensure that controls are in place to protect organizational information and individual privacy.",
          "parameter": "federal data and system data that must be protected at the High or Moderate impact levels; CSP-defined system components",
          "guidance": "Requirement: According to FedRAMP Authorization Boundary Guidance",
          "test_method": "Test"
        }
      ]
    },
    "CM-14": {
      "name": "Signed Components",
      "assessment_procedures": [
        {
          "procedure_id": "CM-14",
          "objective": "Determine if the installation of [organization-defined software and firmware components] is prevented unless it is verified that the software and firmware has been digitally signed using a certificate recognized and approved by the organization.",
          "parameter": "CSP-defined software and firmware components",
          "guidance": "Guidance: If digital signatures/ certificates are unavailable, alternative cryptographic integrity checks (hashes, self-signed certs, etc.) can be utilized",
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "CP": {
    "CP-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "CP-01a.[01][02]",
          "objective": "Determine if a contingency planning policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-01a.[03][04]",
          "objective": "Determine if contingency planning procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-01a.01(a)",
          "objective": "Determine if the [organization-defined level] contingency planning policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-01a.01(b)",
          "objective": "Determine if the contingency planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the contingency planning policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-01c.01",
          "objective": "Determine if the current contingency planning policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-01c.02",
          "objective": "Determine if the current contingency planning procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-2": {
      "name": "Contingency Plan",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02a.01",
          "objective": "Determine if a contingency plan for the system is developed that identifies essential mission and business functions and associated contingency requirements",
          "parameter": NaN,
          "guidance": "Requirement: CSPs must use the FedRAMP Information System Contingency Plan (ISCP) Template (available on the fedramp.gov: https://www.fedramp.gov/assets/resources/templates/SSP-A06-FedRAMP-ISCP-Template.docx). ",
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.02",
          "objective": "Determine if a contingency plan for the system is developed that provides recovery objectives, restoration priorities and metrics",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.03",
          "objective": "Determine if a contingency plan for the system is developed that addresses contingency roles, responsibilities and assigned individuals with contact information",
          "parameter": NaN,
          "guidance": "Requirement: For authorizations the contingency lists include designated FedRAMP personnel.",
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.04",
          "objective": "Determine if a contingency plan for the system is developed that addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.05",
          "objective": "Determine if a contingency plan for the system is developed that addresses eventual, full-system restoration without deterioration of the controls originally planned and implemented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.06",
          "objective": "Determine if a contingency plan for the system is developed that addresses the sharing of contingency information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02a.07",
          "objective": "Determine if a contingency plan for the system is developed that is reviewed and approved by [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "CP-02b.[01]",
          "objective": "Determine if copies of the contingency plan are distributed to [organization-defined key contingency personnel (identified by name and/or by role) to whom copies of the contingency plan are distributed]",
          "parameter": "CSP-defined key contingency personnel (identified by name and/or role) to whom copies of the contingency plan are distributed",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02b.[02]",
          "objective": "Determine if copies of the contingency plan are distributed to [organization-defined key contingency organizational elements]",
          "parameter": "CSP-defined key contingency organizational elements",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02c.",
          "objective": "Determine if contingency planning activities are coordinated with incident handling activities;",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02d.",
          "objective": "Determine if the contingency plan for the system is reviewed [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02e.[01]",
          "objective": "Determine if the contingency plan is updated to address changes to the organization, system, or environment of operation;",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02e.[02]",
          "objective": "Determine if the contingency plan is updated to address problems encountered during contingency plan implementation, execution, or testing;",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02f.",
          "objective": "Determine if contingency plan changes are communicated to [organization-defined key contingency personnel (identified by name and/or by role) and key contingency organizational elements]",
          "parameter": "CSP-defined key contingency personnel (identified by name and/or role) and CSP-defined organizational elements",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-02g.",
          "objective": "Determine if lessons learned from contingency plan training, testing, or actual contingency activities are incorporated into contingency testing and training",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-02h.",
          "objective": "Determine if the contingency plan is protected from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-2 (1)": {
      "name": "Coordinate with Related Plans",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02(01)",
          "objective": "Determine if contingency plan development is coordinated with organizational elements responsible for related plans.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-2 (2)": {
      "name": "Capacity Planning",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02(02)",
          "objective": "Determine if capacity planning is conducted so that the necessary capacity exists during contingency operations for information processing, telecommunications and environmental support",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-2 (3)": {
      "name": "Resume Mission and Business Functions",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02(03)",
          "objective": "Determine if the resumption of [organization-defined mission and business functions] are planned for within [organization-defined contingency plan activation time period] of contingency plan activation.",
          "parameter": "all mission and business functions; time period defined in the service provider and organization SLA",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-2 (5)": {
      "name": "Continue Mission and Business Functions",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02(05)[01]",
          "objective": "Determine if the continuance of [Selection: all; essential] mission and business functions is planned for",
          "parameter": "essential",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-02(05)[02]",
          "objective": "Determine if continuity is sustained until full system restoration at primary processing and/or storage sites",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-2 (8)": {
      "name": "Identify Critical Assets",
      "assessment_procedures": [
        {
          "procedure_id": "CP-02(08)",
          "objective": "Determine if critical system assets supporting [Selection: all; essential] mission and business functions are identified",
          "parameter": "CSP-defined selection",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-3": {
      "name": "Contingency Training",
      "assessment_procedures": [
        {
          "procedure_id": "CP-03a.01",
          "objective": "Determine if contingency training is provided to system users consistent with assigned roles and responsibilities within [organization-defined time period] of assuming a contingency role or responsibility",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: Privileged admins and engineers must take the basic contingency training within 10 days. Consideration must be given for those privileged admins and engineers with critical contingency-related roles, to gain enough system context and situational awareness to understand the full impact of contingency training as it applies to their respective level. Newly hired critical contingency personnel must take this more in-depth training within 60 days of hire date when the training will have more impact.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-03a.02",
          "objective": "Determine if contingency training is provided to system users consistent with assigned roles and responsibilities when required by system changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "CP-03a.03",
          "objective": "Determine if contingency training is provided to system users consistent with assigned roles and responsibilities [organization-defined frequency] thereafter",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "CP-03b.[01]",
          "objective": "Determine if the contingency plan training content is reviewed and updated [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "CP-03b.[02]",
          "objective": "Determine if the contingency plan training content is reviewed and updated following [organization-defined events]",
          "parameter": "CSP-defined events",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "CP-3 (1)": {
      "name": "Simulated Events",
      "assessment_procedures": [
        {
          "procedure_id": "CP-03(01)",
          "objective": "Determine if simulated events are incorporated into contingency training to facilitate effective response by personnel in crisis situations.",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-4": {
      "name": "Contingency Plan Testing",
      "assessment_procedures": [
        {
          "procedure_id": "CP-04a.[01]",
          "objective": "Determine if the contingency plan for the system is tested [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": "Requirement: The service provider develops test plans in accordance with NIST Special Publication 800-34 (as amended); plans are approved by the AO prior to initiating testing\n",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-04a.[02][03]",
          "objective": "Determine if [organization-defined tests] are used to determine the effectiveness of and readiness to execute the plan",
          "parameter": "functional exercises",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-04b.",
          "objective": "Determine if the contingency plan test results are reviewed",
          "parameter": NaN,
          "guidance": "Requirement: The service provider must include the Contingency Plan test results with the security package within the Contingency Plan-designated appendix (Appendix G, Contingency Plan Test Report)",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "CP-04c.",
          "objective": "Determine if corrective actions are initiated, if needed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "CP-4 (1)": {
      "name": "Coordinate with Related Plans",
      "assessment_procedures": [
        {
          "procedure_id": "CP-04(01)",
          "objective": "Determine if contingency plan testing is coordinated with organizational elements responsible for related plans",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-4 (2)": {
      "name": "Alternate Processing Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-04(02)(a)",
          "objective": "Determine if the contingency plan is tested at the alternate processing site to familiarize contingency personnel with the facility and available resources",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-04(02)(b)",
          "objective": "Determine if the contingency plan is tested at the alternate processing site to evaluate the capabilities of the alternate processing site to support contingency operations",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-6": {
      "name": "Alternate Storage Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-06a.[01]",
          "objective": "Determine if an alternate storage site is established",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-06a.[02]",
          "objective": "Determine if establishment of the alternate storage site includes necessary agreements to permit the storage and retrieval of system backup information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-06b.",
          "objective": "Determine if the alternate storage site provides controls equivalent to that of the primary site",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-6 (1)": {
      "name": "Separation from Primary Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-06(01)",
          "objective": "Determine if an alternate storage site that is sufficiently separated from the primary storage site is identified to reduce susceptibility to the same threats",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-6 (2)": {
      "name": "Recovery Time and Recovery Point Objectives",
      "assessment_procedures": [
        {
          "procedure_id": "CP-06(02)",
          "objective": "Determine if the alternate storage site is configured to facilitate recovery operations in accordance with recovery time objectives and recovery point objectives",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-6 (3)": {
      "name": "Accessibility",
      "assessment_procedures": [
        {
          "procedure_id": "CP-06(03)[01]",
          "objective": "Determine if potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster are identified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-06(03)[02]",
          "objective": "Determine if explicit mitigation actions to address identified accessibility problems are outlined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-7": {
      "name": "Alternate Processing Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-07a.",
          "objective": "Determine if an alternate processing site, including necessary agreements to permit the transfer and resumption of [organization-defined system operations] for essential mission and business functions, is established within [organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis\n",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-07b.[01]",
          "objective": "Determine if the equipment and supplies required to transfer operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [organization-defined time period] for transfer",
          "parameter": "CSP-defined time period",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-07b.[02]",
          "objective": "Determine if the equipment and supplies required to resume operations are made available at the alternate processing site or if contracts are in place to support delivery to the site within [organization-defined time period] for resumption",
          "parameter": "CSP-defined time period",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-07c.",
          "objective": "Determine if controls provided at the alternate processing site are equivalent to those at the primary site",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-7 (1)": {
      "name": "Separation from Primary Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-07(01)",
          "objective": "Determine if an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats is identified",
          "parameter": NaN,
          "guidance": "Guidance: The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites will be less relevant.",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-7 (2)": {
      "name": "Accessibility",
      "assessment_procedures": [
        {
          "procedure_id": "CP-07(02)[01]",
          "objective": "Determine if potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster are identified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-07(02)[02]",
          "objective": "Determine if explicit mitigation actions to address identified accessibility problems are outlined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-7 (3)": {
      "name": "Priority of Service",
      "assessment_procedures": [
        {
          "procedure_id": "CP-07(03)",
          "objective": "Determine if alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-7 (4)": {
      "name": "Preparation for Use",
      "assessment_procedures": [
        {
          "procedure_id": "CP-07(04)",
          "objective": "Determine if the alternate processing site is prepared so that the site can serve as the operational site supporting essential mission and business functions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-8": {
      "name": "Telecommunications Services",
      "assessment_procedures": [
        {
          "procedure_id": "CP-8",
          "objective": "Determine if alternate telecommunications services, including necessary agreements to permit the resumption of [organization-defined system operations] are established for essential mission and business functions within [organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites",
          "parameter": "CSP-defined system operations; CSP-defined time period",
          "guidance": "Requirement: The service provider defines a time period consistent with the recovery time objectives and business impact analysis.\n",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-8 (1)": {
      "name": "Priority of Service Provisions",
      "assessment_procedures": [
        {
          "procedure_id": "CP-08(01)(a)",
          "objective": "Determine if primary and alternative telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives) are developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-08(01)(b)",
          "objective": "Determine if Telecommunications Service Priority is requested for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-8 (2)": {
      "name": "Single Points of Failure",
      "assessment_procedures": [
        {
          "procedure_id": "CP-08(02)",
          "objective": "Determine if alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services are obtained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-8 (3)": {
      "name": "Separation of Primary and Alternate Providers",
      "assessment_procedures": [
        {
          "procedure_id": "CP-08(03)",
          "objective": "Determine if alternate telecommunications services from providers that are separated from primary service providers are obtained to reduce susceptibility to the same threats",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "CP-8 (4)": {
      "name": "Provider Contingency Plan",
      "assessment_procedures": [
        {
          "procedure_id": "CP-08(04)(a)",
          "objective": "Determine if primary and alternative telecommunications service providers are required to have contingency plans",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-08(04)(b)",
          "objective": "Determine if provider contingency plans are reviewed to ensure that the plans meet organizational contingency requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "CP-08(04)(c)",
          "objective": "Determine if evidence of contingency testing and training by providers is obtained [organization-defined frequency]",
          "parameter": "annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "CP-9": {
      "name": "System Backup",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09a.",
          "objective": "Determine if backups of user-level information contained in [organization-defined system components] are conducted [organization-defined frequency]",
          "parameter": "CSP-defined system components; daily incremental and weekly full",
          "guidance": "Requirement: The service provider shall determine what elements of the cloud environment require the Information System Backup control. The service provider shall determine how Information System Backup is going to be verified and appropriate periodicity of the check.\n\nRequirement: The service provider maintains at least three backup copies of user-level information (at least one of which is available online) or provides an equivalent alternative.",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-09b.",
          "objective": "Determine if backups of system-level information contained in the system are conducted [organization-defined frequency]",
          "parameter": "daily incremental and weekly full",
          "guidance": "Requirement: The service provider maintains at least three backup copies of system-level information (at least one of which is available online) or provides an equivalent alternative.\n",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-09c.",
          "objective": "Determine if backups of system documentation, including security- and privacy-related documentation are conducted [organization-defined frequency]",
          "parameter": "daily incremental and weekly full",
          "guidance": "Requirement: The service provider maintains at least three backup copies of information system documentation including security information (at least one of which is available online) or provides an equivalent alternative.",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-09d.",
          "objective": "Determine if the confidentiality, integrity and availability of backup information is protected",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "CP-9 (1)": {
      "name": "Testing for Reliability and Integrity",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09(01)",
          "objective": "Determine if backup information is tested [organization-defined frequency] to verify media reliability and information integrity",
          "parameter": "at least monthly",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-9 (2)": {
      "name": "Test Restoration Using Sampling",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09(02)",
          "objective": "Determine if a sample of backup information in the restoration of selected system functions is used as part of contingency plan testing",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "CP-9 (3)": {
      "name": "Separate Storage for Critical Information",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09(03)",
          "objective": "Determine if backup copies of [organization-defined critical system software and other security-related information] are stored in a separate facility or in a fire rated container that is not collocated with the operational system",
          "parameter": "CSP-defined critical system software and other security-related information",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-9 (5)": {
      "name": "Transfer to Alternate Storage Site",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09(05)[01]",
          "objective": "Determine if system backup information is transferred to the alternate storage site for [organization-defined time period]",
          "parameter": "time period consistent with the recovery time and recovery point objectives defined in the service provider and organization SLA",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "CP-09(05)[02]",
          "objective": "Determine if system backup information is transferred to the alternate storage site [organization-defined transfer rate]",
          "parameter": "transfer rate consistent with the recovery time and recovery point objectives defined in the service provider and organization SLA",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-9 (8)": {
      "name": "Cryptographic Protection",
      "assessment_procedures": [
        {
          "procedure_id": "CP-09(08)",
          "objective": "Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [organization-defined backup information]",
          "parameter": "all backup files",
          "guidance": "Guidance: Note that this enhancement requires the use of cryptography which must be compliant with Federal requirements and utilize FIPS validated or NSA approved cryptography (see SC-13.)",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-10": {
      "name": "System Recovery and Reconstitution",
      "assessment_procedures": [
        {
          "procedure_id": "CP-10",
          "objective": "Determine if the recovery and reconstitution of the system to a known state is provided within [organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure",
          "parameter": "CSP-defined time period",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-10 (2)": {
      "name": "Transaction Recovery",
      "assessment_procedures": [
        {
          "procedure_id": "CP-10(02)",
          "objective": "Determine if transaction recovery is implemented for systems that are transaction-based",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "CP-10 (4)": {
      "name": "Restore Within Time Period",
      "assessment_procedures": [
        {
          "procedure_id": "CP-10(04)",
          "objective": "Determine if the capability to restore system components within [organization-defined restoration time period] from configuration-controlled and integrity-protected information representing a known, operational state for the components is provided",
          "parameter": "time period consistent with the restoration time-periods defined in the service provider and organization SLA",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    }
  },
  "IA": {
    "IA-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "IA-01a.[01][02]",
          "objective": "Determine if an identification and authentication policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IA-01a.[03][04]",
          "objective": "Determine if identification and authentication procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IA-01a.01(a)",
          "objective": "Determine if the [organization-defined level] identification and authentication policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IA-01a.01(b)",
          "objective": "Determine if the identification and authentication policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IA-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the identification and authentication policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IA-01c.01",
          "objective": "Determine if the current identification and authentication policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IA-01c.02",
          "objective": "Determine if the current identification and authentication procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IA-2": {
      "name": "Identification and Authentication (Organizational Users)",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02[01]",
          "objective": "Determine if organizational users are uniquely identified and authenticated",
          "parameter": NaN,
          "guidance": "Requirement: For all control enhancements that specify multifactor authentication, the implementation must adhere to the Digital Identity Guidelines specified in NIST Special Publication 800-63B.\n\nRequirement: Multi-factor authentication must be phishing-resistant.\n\nRequirement: All uses of encrypted virtual private networks must meet all applicable Federal requirements and architecture, dataflow, and security and privacy controls must be documented, assessed, and authorized to operate.\n\nGuidance: \u201cPhishing-resistant\" authentication refers to authentication processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. ",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "IA-02[02]",
          "objective": "Determine if the unique identification of authenticated organizational users is associated with processes acting on behalf of those users",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IA-2 (1)": {
      "name": "Multi-factor Authentication to Privileged Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(01)",
          "objective": "Determine if multi-factor authentication is implemented for access to privileged accounts",
          "parameter": NaN,
          "guidance": "Requirement: According to SP 800-63-3, SP 800-63A (IAL), SP 800-63B (AAL), and SP 800-63C (FAL).\n\nRequirement: Multi-factor authentication must be phishing-resistant.\n\nGuidance: Multi-factor authentication to subsequent components in the same user domain is not required.",
          "test_method": "Test"
        }
      ]
    },
    "IA-2 (2)": {
      "name": "Multi-factor Authentication to Non-privileged Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(02)",
          "objective": "Determine if multi-factor authentication for access to non-privileged accounts is implemented",
          "parameter": NaN,
          "guidance": "Requirement: According to SP 800-63-3, SP 800-63A (IAL), SP 800-63B (AAL), and SP 800-63C (FAL).\n\nRequirement: Multi-factor authentication must be phishing-resistant.\n\nGuidance: Multi-factor authentication to subsequent components in the same user domain is not required.",
          "test_method": "Test"
        }
      ]
    },
    "IA-2 (5)": {
      "name": "Individual Authentication with Group Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(05)",
          "objective": "Determine if users are required to be individually authenticated before granting access to the shared accounts or resources when shared accounts or authenticators are employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-2 (6)": {
      "name": "Access to Accounts - Separate Device",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(06)(a)",
          "objective": "Determine if multi-factor authentication is implemented for [local, network and/or remote] access to [privileged accounts and/or non-privileged accounts] such that one of the factors is provided by a device separate from the system gaining access",
          "parameter": "local, network, and remote; privileged accounts and non-privileged accounts",
          "guidance": "Guidance: PIV=separate device. Please refer to NIST SP 800-157 Guidelines for Derived Personal Identity Verification (PIV) Credentials\n\nGuidance: See SC-13 Guidance for more information on FIPS-validated or NSA-approved cryptography",
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-02(06)(b)",
          "objective": "Determine if multi-factor authentication is implemented for [local, network and/or remote] access to [privileged accounts and/or non-privileged accounts] such that the device meets [organization-defined strength of mechanism requirements]",
          "parameter": "FIPS-validated or NSA-approved cryptography",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-2 (8)": {
      "name": "Access to Accounts - Replay Resistant",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(08)",
          "objective": "Determine if replay-resistant authentication mechanisms for access to [privileged accounts and/or non-privileged accounts] are implemented",
          "parameter": "privileged accounts and non-privileged accounts",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-2 (12)": {
      "name": "Acceptance of PIV Credentials",
      "assessment_procedures": [
        {
          "procedure_id": "IA-02(12)",
          "objective": "Determine if Personal Identity Verification-compliant credentials are accepted and electronically verified",
          "parameter": NaN,
          "guidance": "Guidance: Include Common Access Card (CAC), i.e., the DoD technical implementation of PIV/FIPS 201/HSPD-12.\n",
          "test_method": "Interview, Test"
        }
      ]
    },
    "IA-3": {
      "name": "Device Identification and Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-03",
          "objective": "Determine if [organization-defined devices and/or types of devices] are uniquely identified and authenticated before establishing a [local, network and/or remote] connection",
          "parameter": "CSP-defined devices and/or types of devices; local, network, and remote",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-4": {
      "name": "Identifier Management",
      "assessment_procedures": [
        {
          "procedure_id": "IA-04a.",
          "objective": "Determine if system identifiers are managed by receiving authorization from [organization-defined personnel or roles] to assign to an individual, group, role, or device identifier",
          "parameter": "at a minimum, the ISSO (or similar role within the organization)",
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-04b.",
          "objective": "Determine if system identifiers are managed by selecting an identifier that identifies an individual, group, role, service, or device",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-04c.",
          "objective": "Determine if system identifiers are managed by assigning the identifier to the intended individual, group, role, service, or device",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-04d.",
          "objective": "Determine if system identifiers are managed by preventing reuse of identifiers for [organization-defined time period]",
          "parameter": "at least two (2) years",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-4 (4)": {
      "name": "Identify User Status",
      "assessment_procedures": [
        {
          "procedure_id": "IA-04(04)",
          "objective": "Determine if individual identifiers are managed by uniquely identifying each individual as [organization-defined characteristics]",
          "parameter": "contractors and foreign nationals",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-5": {
      "name": "Authenticator Management",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05a.",
          "objective": "Determine if system authenticators are managed through the verification of the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution",
          "parameter": NaN,
          "guidance": "Requirement: Authenticators must be compliant with NIST SP 800-63-3 Digital Identity Guidelines IAL, AAL, FAL level 3. Link https://pages.nist.gov/800-63-3\n\nGuidance: SP 800-63C Section 6.2.3 Encrypted Assertion requires that authentication assertions be encrypted when passed through third parties, such as a browser. For example, a SAML assertion can be encrypted using XML-Encryption, or an OpenID Connect ID Token can be encrypted using JSON Web Encryption (JWE). ",
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05b.",
          "objective": "Determine if system authenticators are managed through the establishment of initial authenticator content for any authenticators issued by the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05c.",
          "objective": "Determine if system authenticators are managed to ensure that authenticators have sufficient strength of mechanism for their intended use",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05d.",
          "objective": "Determine if system authenticators are managed through the establishment and implementation of administrative procedures for initial authenticator distribution; lost, compromised, or damaged authenticators; and the revocation of authenticators",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05e.",
          "objective": "Determine if system authenticators are managed through the change of default authenticators prior to first use",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05f.",
          "objective": "Determine if system authenticators are managed through the change or refreshment of authenticators [organization-defined time period by authenticator type] or when [organization-defined events] occur",
          "parameter": "CSP-defined time period by authenticator; CSP-defined events",
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05g.",
          "objective": "Determine if system authenticators are managed through the protection of authenticator content from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05h.[01]",
          "objective": "Determine if system authenticators are managed through the requirement for individuals to take specific controls to protect authenticators",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05h.[02]",
          "objective": "Determine if system authenticators are managed through the requirement for devices to implement specific controls to protect authenticators",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05i.",
          "objective": "Determine if system authenticators are managed through the change of authenticators for group or role accounts when membership to those accounts changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-5 (1)": {
      "name": "Password-based Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(01)(a)",
          "objective": "Determine if for password-based authentication, a list of commonly used, expected, or compromised passwords is maintained and updated [organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: Password policies must be compliant with NIST SP 800-63B for all memorized, lookup, out-of-band, or One-Time-Passwords (OTP). Password policies shall not enforce special character or minimum password rotation requirements for memorized secrets of users.",
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05(01)(b)",
          "objective": "Determine if for password-based authentication when passwords are created or updated by users, the passwords are verified not to be found on the list of commonly used, expected, or compromised passwords in IA-05(01)(a)",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IA-05(01)(c)",
          "objective": "Determine if for password-based authentication, passwords are only transmitted over cryptographically protected channels",
          "parameter": NaN,
          "guidance": "Guidance: Note that (c) and (d) require the use of cryptography which must be compliant with Federal requirements and utilize FIPS validated or NSA approved cryptography (see SC-13.)",
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(01)(d)",
          "objective": "Determine if for password-based authentication, passwords are stored using an approved salted key derivation function, preferably using a keyed hash",
          "parameter": NaN,
          "guidance": "Guidance: Note that (c) and (d) require the use of cryptography which must be compliant with Federal requirements and utilize FIPS validated or NSA approved cryptography (see SC-13.)",
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(01)(e)",
          "objective": "Determine if for password-based authentication, immediate selection of a new password is required upon account recovery",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(01)(f)",
          "objective": "Determine if for password-based authentication, user selection of long passwords and passphrases is allowed, including spaces and all printable characters",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(01)(g)",
          "objective": "Determine if for password-based authentication, automated tools are employed to assist the user in selecting strong password authenticators",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(01)(h)",
          "objective": "Determine if for password-based authentication, [organization-defined composition and complexity rules] are enforced",
          "parameter": "CSP-defined composition and complexity rules",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-5 (2)": {
      "name": "Public Key-based Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(02)(a)(01)",
          "objective": "Determine if authorized access to the corresponding private key is enforced for public key-based authentication",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(02)(a)(02)",
          "objective": "Determine if the authenticated identity is mapped to the account of the individual or group for public key-based authentication",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(02)(b)(01)",
          "objective": "Determine if when public key infrastructure (PKI) is used, certificates are validated by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-05(02)(b)(02)",
          "objective": "Determine if when public key infrastructure (PKI) is used, a local cache of revocation data is implemented to support path discovery and validation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-5 (6)": {
      "name": "Protection of Authenticators",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(06)",
          "objective": "Determine if authenticators are protected commensurate with the security category of the information to which use of the authenticator permits access",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-5 (7)": {
      "name": "No Embedded Unencrypted Static Authenticators",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(07)",
          "objective": "Determine if unencrypted static authenticators are not embedded in applications or other forms of static storage",
          "parameter": NaN,
          "guidance": "Guidance: In this context, prohibited static storage refers to any storage where unencrypted authenticators, such as passwords, persist beyond the time required to complete the access process",
          "test_method": "Test"
        }
      ]
    },
    "IA-5 (8)": {
      "name": "Multiple System Accounts",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(08)",
          "objective": "Determine if [organization-defined security controls] are implemented to manage the risk of compromise due to individuals having accounts on multiple systems",
          "parameter": "different authenticators in different user authentication domains",
          "guidance": "Guidance: If a single user authentication domain is used to access multiple systems, such as in single-sign-on, then only a single authenticator is required",
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-5 (13)": {
      "name": "Expiration of Cached Authenticators",
      "assessment_procedures": [
        {
          "procedure_id": "IA-05(13)",
          "objective": "Determine if the use of cached authenticators is prohibited after [organization-define time period]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance: For components subject to configuration baseline(s) (such as STIG or CIS,) the time period should conform to the baseline standard",
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-6": {
      "name": "Authentication Feedback",
      "assessment_procedures": [
        {
          "procedure_id": "IA-06",
          "objective": "Determine if the feedback of authentication information is obscured during the authentication process to protect the information from possible exploitation and use by unauthorized individuals",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-7": {
      "name": "Cryptographic Module Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-07",
          "objective": "Determine if mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IA-8": {
      "name": "Identification and Authentication (Non-organizational Users)",
      "assessment_procedures": [
        {
          "procedure_id": "IA-08",
          "objective": "Determine if non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-8 (1)": {
      "name": "Acceptance of PIV Credentials from Other Agencies",
      "assessment_procedures": [
        {
          "procedure_id": "IA-08(01)",
          "objective": "Determine if Personal Identity Verification-compliant credentials from other federal agencies are accepted and electronically verified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IA-8 (2)": {
      "name": "Acceptance of External Authenticators",
      "assessment_procedures": [
        {
          "procedure_id": "IA-08(02)(a)",
          "objective": "Determine if only external authenticators that are NIST-compliant are accepted",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "IA-08(02)(b)",
          "objective": "Determine if a list of accepted external authenticators is documented and maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IA-8 (4)": {
      "name": "Use of Defined Profiles",
      "assessment_procedures": [
        {
          "procedure_id": "IA-08(04)",
          "objective": "Determine if there is conformance with [organization-defined identity management profiles] for identity management",
          "parameter": "CSP-defined identity management profiles",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IA-11": {
      "name": "Re-authentication",
      "assessment_procedures": [
        {
          "procedure_id": "IA-11",
          "objective": "Determine if users are required to re-authenticate when [organization-defined circumstances or situations] occur",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance:\nThe fixed time period cannot exceed the limits set in SP 800-63. At this writing they are:\n- AAL3 (high baseline)\n   -- twelve (12) hours or\n   -- fifteen (15) minutes of inactivity ",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IA-12": {
      "name": "Identity Proofing",
      "assessment_procedures": [
        {
          "procedure_id": "IA-12a.",
          "objective": "Determine if users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed",
          "parameter": NaN,
          "guidance": "Guidance: In accordance with NIST SP 800-63A Enrollment and Identity Proofing",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "IA-12b.",
          "objective": "Determine if user identities are resolved to a unique individual",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IA-12c.",
          "objective": "Determine if identity evidence is collected, validated, and verified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IA-12 (2)": {
      "name": "Identity Evidence",
      "assessment_procedures": [
        {
          "procedure_id": "IA-12(02)",
          "objective": "Determine if evidence of individual identification is presented to the registration authority",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IA-12 (3)": {
      "name": "Identity Evidence Validation and Verification",
      "assessment_procedures": [
        {
          "procedure_id": "IA-12(03)",
          "objective": "Determine if the presented identity evidence is validated and verified through [organization-defined methods of validation and verification]",
          "parameter": "CSP-defined methods of validation and verification",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IA-12 (4)": {
      "name": "In-person Validation and Verification",
      "assessment_procedures": [
        {
          "procedure_id": "IA-12(04)",
          "objective": "Determine if the validation and verification of identity evidence is conducted in person before a designated registration authority",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IA-12 (5)": {
      "name": "Address Confirmation",
      "assessment_procedures": [
        {
          "procedure_id": "IA-12(05)",
          "objective": "Determine if an [organization-defined registration code and/or notice of proofing] is delivered through an out-of-band channel to verify the user's address (physical or digital) of record",
          "parameter": "CSP-defined registration code and/or notice of proofing",
          "guidance": "Guidance: In accordance with NIST SP 800-63A Enrollment and Identity Proofing",
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "IR": {
    "IR-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "IR-01a.[01][02]",
          "objective": "Determine if an incident response policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-01a.[03][04]",
          "objective": "Determine if incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IR-01a.01(a)",
          "objective": "Determine if the [organization-defined level] incident response policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IR-01a.01(b)",
          "objective": "Determine if the incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IR-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-01c.01",
          "objective": "Determine if the current incident response policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-01c.02",
          "objective": "Determine if the current incident response procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-2": {
      "name": "Incident Response Training",
      "assessment_procedures": [
        {
          "procedure_id": "IR-02a.01",
          "objective": "Determine if incident response training is provided to system users consistent with assigned roles and responsibilities within [organization-defined time period] of assuming an incident response role or responsibility or acquiring system access",
          "parameter": "ten (10) days for privileged users, thirty (30) days for Incident Response Roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-02a.02",
          "objective": "Determine if incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-02a.03",
          "objective": "Determine if incident response training is provided to system users consistent with assigned roles and responsibilities [organization-defined frequency] thereafter",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-02b.[01]",
          "objective": "Determine if incident response training content is reviewed and updated within the [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-02b.[02]",
          "objective": "Determine if incident response training content is reviewed and updated following [organization-defined events]",
          "parameter": "CSP-defined events",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-2 (1)": {
      "name": "Simulated Events",
      "assessment_procedures": [
        {
          "procedure_id": "IR-02(01)",
          "objective": "Determine if simulated events are incorporated into incident response training to facilitate the required response by personnel in crisis situations",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-2 (2)": {
      "name": "Automated Training Environments",
      "assessment_procedures": [
        {
          "procedure_id": "IR-02(02)",
          "objective": "Determine if an incident response training environment is provided using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IR-3": {
      "name": "Incident Response Testing",
      "assessment_procedures": [
        {
          "procedure_id": "IR-03",
          "objective": "Determine if the effectiveness of the incident response capability for the system is tested [organization-defined frequency] using [organization-defined tests]",
          "parameter": "at least every six (6) months, including functional at least annually; CSP-defined tests",
          "guidance": "Requirement: The service provider defines tests and/or exercises in accordance with NIST Special Publication 800-61 (as amended). Functional testing must occur prior to testing for initial authorization. Annual functional testing may be concurrent with required penetration tests (see CA-8). The service provider provides test plans to the AO annually. Test plans are approved and accepted by the AO prior to test commencing",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-3 (2)": {
      "name": "Coordination with Related Plans",
      "assessment_procedures": [
        {
          "procedure_id": "IR-03(02)",
          "objective": "Determine if incident response testing is coordinated with organizational elements responsible for related plans",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-4": {
      "name": "Incident Handling",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04a.[01]",
          "objective": "Determine if an incident handling capability for incidents is implemented that is consistent with the incident response plan",
          "parameter": NaN,
          "guidance": "Requirement: The FISMA definition of \"incident\" shall be used: \"An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.\"\n\nRequirement: The service provider ensures that individuals conducting incident handling meet personnel security requirements commensurate with the criticality/sensitivity of the information being processed, stored, and transmitted by the information system.\n",
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "IR-04a.[02]",
          "objective": "Determine if the incident handling capability for incidents includes preparation, detection and analysis, containment, eradication, and recovery",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-04b.",
          "objective": "Determine if incident handling activities are coordinated with contingency planning activities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-04c.[01]",
          "objective": "Determine if lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-04c.[02]",
          "objective": "Determine if the changes resulting from the incorporated lessons learned are implemented accordingly",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-04d.",
          "objective": "Determine if the rigor, intensity, scope, and results of incident handling activities is comparable and predictable across the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-4 (1)": {
      "name": "Automated Incident Handling Processes",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04(01)",
          "objective": "Determine if the incident handling process is supported using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-4 (2)": {
      "name": "Dynamic Reconfiguration",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04(02)",
          "objective": "Determine if [organization-defined types of dynamic reconfiguration for system components] for [organization-defined system components that require dynamic reconfiguration] are included as part of the incident response capability",
          "parameter": "CSP-defined types of dynamic reconfiguration; all network, data storage, and computing devices",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-4 (4)": {
      "name": "Information Correlation",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04(04)",
          "objective": "Determine if incident information and individual incident responses are correlated to achieve an organization-wide perspective on incident awareness and response",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "IR-4 (6)": {
      "name": "Insider Threats",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04(06)",
          "objective": "Determine if an incident handling capability is implemented for incidents involving insider threats",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-4 (11)": {
      "name": "Integrated Incident Response Team",
      "assessment_procedures": [
        {
          "procedure_id": "IR-04(11)[01]",
          "objective": "Determine if an integrated incident response team is established and maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-04(11)[02]",
          "objective": "Determine if the integrated incident response team can be deployed to any location identified by the organization in [organization-defined time period]",
          "parameter": "CSP-defined time period",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-5": {
      "name": "Incident Monitoring",
      "assessment_procedures": [
        {
          "procedure_id": "IR-05",
          "objective": "Determine if incidents are tracked and documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-5 (1)": {
      "name": "Automated Tracking, Data Collection, and Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "IR-05(01)",
          "objective": "Determine if incidents are tracked, collected, and analyzed using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IR-6": {
      "name": "Incident Reporting",
      "assessment_procedures": [
        {
          "procedure_id": "IR-06a.",
          "objective": "Determine if personnel is/are required to report suspected incidents to the organizational incident response capability within [organization-defined time period]",
          "parameter": "US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended)",
          "guidance": "Requirement: Reports security incident information according to FedRAMP Incident Communications Procedure",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-06b.",
          "objective": "Determine if incident information is reported to [organization-defined authorities]",
          "parameter": "CSP-defined authorities",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-6 (1)": {
      "name": "Automated Reporting",
      "assessment_procedures": [
        {
          "procedure_id": "IR-06(01)",
          "objective": "Determine if incidents are reported using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IR-6 (3)": {
      "name": "Supply Chain Coordination",
      "assessment_procedures": [
        {
          "procedure_id": "IR-06(03)",
          "objective": "Determine if incident information is provided to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-7": {
      "name": "Incident Response Assistance",
      "assessment_procedures": [
        {
          "procedure_id": "IR-07[01]",
          "objective": "Determine if an incident response support resource, integral to the organizational incident response capability, is provided",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-07[02]",
          "objective": "Determine if the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "IR-7 (1)": {
      "name": "Automation Support for Availability of Information and Support",
      "assessment_procedures": [
        {
          "procedure_id": "IR-07(01)",
          "objective": "Determine if the availability of incident response information and support is increased using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "IR-8": {
      "name": "Incident Response Plan",
      "assessment_procedures": [
        {
          "procedure_id": "IR-08a.01,02,03,04,05,06,07,08,09,10",
          "objective": "Determine if an incident response plan is developed that provides the organization with:\n-a roadmap for implementing its incident response capability\n-describes the structure and organization of the incident response capability\n-provides a high-level approach for how the incident response capability fits into the overall organization\n-meets the unique requirements of the organization with regard to mission, size, structure, and functions\n-defines reportable incidents\n-provides metrics for measuring the incident response capability within the organization\n-defines the resources and management support needed to effectively maintain and mature an incident response capability\n-addresses the sharing of incident information\n-is reviewed and approved by [organization-defined personnel or roles] within the [organization-defined frequency]\n-explicitly designates responsibility for incident response to [organization-defined entities, personnel, and/or roles]",
          "parameter": "CSP-defined personnel or roles; at least annually; CSP-defined entities, personnel, and/or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "IR-08b.",
          "objective": "Determine if copies of the incident response plan are distributed to [organization-defined incident response personnel and organizational elements]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.",
          "test_method": "Test"
        },
        {
          "procedure_id": "IR-08c.",
          "objective": "Determine if the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-08d.",
          "objective": "Determine if incident response plan changes are communicated to [organization-defined incident response personnel and organizational elements]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider defines a list of incident response personnel (identified by name and/or by role) and organizational elements. The incident response list includes designated FedRAMP personnel.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-08e.",
          "objective": "Determine if the incident response plan is protected from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IR-9": {
      "name": "Information Spillage Response",
      "assessment_procedures": [
        {
          "procedure_id": "IR-09a.",
          "objective": "Determine if [organization-defined personnel or roles] is/are assigned the responsibility to respond to information spills",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-09b.",
          "objective": "Determine if the specific information involved in the system contamination is identified in response to information spills",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "IR-09c.",
          "objective": "Determine if [organization-defined personnel or roles] is/are alerted of the information spill using a method of communication not associated with the spill",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-09d.",
          "objective": "Determine if the contaminated system or system component is isolated in response to information spills",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-09e.",
          "objective": "Determine if the information is eradicated from the contaminated system or component in response to information spills",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-09f.",
          "objective": "Determine if other systems or system components that may have been subsequently contaminated are identified in response to information spills",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "IR-09g.",
          "objective": "Determine if [organization-defined actions] are performed in response to information spills",
          "parameter": "CSP-defined actions",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "IR-9 (2)": {
      "name": "Training",
      "assessment_procedures": [
        {
          "procedure_id": "IR-09(02)",
          "objective": "Determine if information spillage response training is provided [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "IR-9 (3)": {
      "name": "Post-spill Operations",
      "assessment_procedures": [
        {
          "procedure_id": "IR-09(03)",
          "objective": "Determine if [organization-defined procedures] are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions",
          "parameter": "CSP-defined procedures",
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    },
    "IR-9 (4)": {
      "name": "Exposure to Unauthorized Personnel",
      "assessment_procedures": [
        {
          "procedure_id": "IR-09(04)",
          "objective": "Determine if [organization-defined controls] are employed for personnel exposed to information not within assigned access authorizations",
          "parameter": "CSP-defined controls",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    }
  },
  "MA": {
    "MA-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "MA-01a.[01][02]",
          "objective": "Determine if a maintenance policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-01a.[03][04]",
          "objective": "Determine if maintenance procedures to facilitate the implementation of the maintenance policy and associated maintenance controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MA-01a.01(a)",
          "objective": "Determine if the [organization-defined level] maintenance policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MA-01a.01(b)",
          "objective": "Determine if the maintenance policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MA-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the maintenance policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-01c.01",
          "objective": "Determine if the current maintenance policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-01c.02",
          "objective": "Determine if the current maintenance procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "MA-2": {
      "name": "Controlled Maintenance",
      "assessment_procedures": [
        {
          "procedure_id": "MA-02a.",
          "objective": "Determine if maintenance, repair, and replacement of system components are scheduled, documented, and reviewed in accordance with manufacturer or vendor specifications and/or organizational requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MA-02b.",
          "objective": "Determine if all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location, are approved and monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-02c.",
          "objective": "Determine if [organization-defined personnel or roles] is/are required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-02d.",
          "objective": "Determine if equipment is sanitized to remove [organization-defined information] from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MA-02e.",
          "objective": "Determine if all potentially impacted controls are checked to verify that the controls are still functioning properly following maintenance, repair, or replacement actions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "MA-02f.",
          "objective": "Determine if [organization-defined information] is included in organizational maintenance records",
          "parameter": "CSP-defined information",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "MA-2 (2)": {
      "name": "Automated Maintenance Activities",
      "assessment_procedures": [
        {
          "procedure_id": "MA-02(02)(a)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to schedule, conduct, and document maintenance, repair, and replacement actions for the system",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "MA-02(02)(b)",
          "objective": "Determine if up-to date, accurate, and complete records of all maintenance, repair or and replacement actions requested, scheduled, in process, and completed are produced",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "MA-3": {
      "name": "Maintenance Tools",
      "assessment_procedures": [
        {
          "procedure_id": "MA-03a.",
          "objective": "Determine if the use of system maintenance tools is approved, controlled, and monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MA-03b.",
          "objective": "Determine if previously approved system maintenance tools are reviewed [in accordance with the organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-3 (1)": {
      "name": "Inspect Tools",
      "assessment_procedures": [
        {
          "procedure_id": "MA-03(01)",
          "objective": "Determine if maintenance tools used by maintenance personnel are inspected for improper or unauthorized modifications",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-3 (2)": {
      "name": "Inspect Media",
      "assessment_procedures": [
        {
          "procedure_id": "MA-03(02)",
          "objective": "Determine if media containing diagnostic and test programs are checked for malicious code before the media are used in the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-3 (3)": {
      "name": "Prevent Unauthorized Removal",
      "assessment_procedures": [
        {
          "procedure_id": "MA-03(03)",
          "objective": "Determine if the removal of maintenance equipment containing organizational information is prevented by\n-verifying that there is no organizational information contained on the equipment\n-sanitizing or destroying the equipment\n-retaining the equipment within the facility\n-obtaining an exemption from [organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility",
          "parameter": "the information owner",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-4": {
      "name": "Nonlocal Maintenance",
      "assessment_procedures": [
        {
          "procedure_id": "MA-04a.",
          "objective": "Determine if nonlocal maintenance and diagnostic activities are approved and monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "MA-04b.[01]",
          "objective": "Determine if the use of nonlocal maintenance and diagnostic tools are allowed only as consistent with organizational policy",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "MA-04b.[02]",
          "objective": "Determine if the use of nonlocal maintenance and diagnostic tools are documented in the security plan for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MA-04c.",
          "objective": "Determine if strong authentication is employed in the establishment of nonlocal maintenance and diagnostic sessions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MA-04d.",
          "objective": "Determine if records for nonlocal maintenance and diagnostic activities are maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "MA-04e.",
          "objective": "Determine if session and network connections are terminated when nonlocal maintenance is completed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "MA-4 (3)": {
      "name": "Comparable Security and Sanitization",
      "assessment_procedures": [
        {
          "procedure_id": "MA-04(03)(a)",
          "objective": "Determine if nonlocal maintenance or diagnostic services are required to be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "MA-04(03)(b)[01]",
          "objective": "Determine if the component to be serviced is removed from the system prior to nonlocal maintenance or diagnostic services",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "MA-04(03)(b)[02]",
          "objective": "Determine if the component to be serviced is sanitized (for organizational information)",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "MA-04(03)(b)[03]",
          "objective": "Determine if the component is inspected and sanitized (for potentially malicious software) after the service is performed and before reconnecting the component to the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "MA-5": {
      "name": "Maintenance Personnel",
      "assessment_procedures": [
        {
          "procedure_id": "MA-05a.",
          "objective": "Determine if a process for maintenance personnel authorization is established and a list of authorized maintenance organizations or personnel is maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MA-05b.",
          "objective": "Determine if non-escorted personnel performing maintenance on the system possess the required access authorizations",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MA-05c.",
          "objective": "Determine if organizational personnel with required access authorizations and technical competence is/are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-5 (1)": {
      "name": "Individuals Without Appropriate Access",
      "assessment_procedures": [
        {
          "procedure_id": "MA-05(01)(a)(01)",
          "objective": "Determine if procedures for the use of maintenance personnel who lack appropriate security clearances or are not US citizens are implemented and include approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified escorting and supervising maintenance personnel without the needed access authorization during the performance of maintenance and diagnostic activities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "MA-05(01)(a)(02)",
          "objective": "Determine if procedures for the use of maintenance personnel who lack appropriate security clearances or are not US citizens are implemented and include all volatile information storage components within the system being sanitized and all non-volatile storage media being removed or physically disconnected from the system and secured prior to initiating maintenance or diagnostic activities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Test"
        },
        {
          "procedure_id": "MA-05(01)(b)",
          "objective": "Determine if [organization-defined alternate controls] are developed and implemented in the event that a system cannot be sanitized, removed, or disconnected from the system",
          "parameter": "CSP-defined alternate controls",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MA-6": {
      "name": "Timely Maintenance",
      "assessment_procedures": [
        {
          "procedure_id": "MA-06",
          "objective": "Determine if maintenance support and/or spare parts are obtained for [organization-defined system components] within [organization-defined time period] of failure",
          "parameter": "CSP-defined system components; CSP-defined time period",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    }
  },
  "MP": {
    "MP-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "MP-01a.[01][02]",
          "objective": "Determine if a media protection policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MP-01a.[03][04]",
          "objective": "Determine if media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MP-01a.01(a)",
          "objective": "Determine if the [organization-defined level] media protection policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MP-01a.01(b)",
          "objective": "Determine if the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MP-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MP-01c.01",
          "objective": "Determine if the current media protection policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MP-01c.02",
          "objective": "Determine if the current media protection procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "MP-2": {
      "name": "Media Access",
      "assessment_procedures": [
        {
          "procedure_id": "MP-02[01]",
          "objective": "Determine if access to [organization-defined types of digital media] is restricted to [organization-defined personnel or roles]",
          "parameter": "all types of digital media containing sensitive information; CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-02[02]",
          "objective": "Determine if access to [organization-defined types of non-digital media] is restricted to [organization-defined personnel or roles]",
          "parameter": "all types of non-digital media containing sensitive information; CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MP-3": {
      "name": "Media Marking",
      "assessment_procedures": [
        {
          "procedure_id": "MP-03a.",
          "objective": "Determine if system media is marked to indicate distribution limitations, handling caveats, and applicable security markings (if any) of the information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "MP-03b.",
          "objective": "Determine if [organization-defined types of media exempted from marking] remain within [organization-defined controlled areas]",
          "parameter": "no removable media types; CSP-defined security safeguards not applicable",
          "guidance": "Guidance: Second parameter not applicable",
          "test_method": "Test"
        }
      ]
    },
    "MP-4": {
      "name": "Media Storage",
      "assessment_procedures": [
        {
          "procedure_id": "MP-04a.[01][03]",
          "objective": "Determine if [organization-defined types of digital media] are physically controlled and securely stored within [organization-defined controlled areas]",
          "parameter": "all types of digital media with sensitive information; see additional FedRAMP requirements and guidance",
          "guidance": "Requirement: The service provider defines controlled areas within facilities where the information and information system reside.",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-04a.[02][04]",
          "objective": "Determine if [organization-defined types of non-digital media] are physically controlled and securely stored within [organization-defined controlled areas]",
          "parameter": "all types of non-digital media with sensitive information; see additional FedRAMP requirements and guidance",
          "guidance": "Requirement: The service provider defines controlled areas within facilities where the information and information system reside.",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-04b.",
          "objective": "Determine if system media types [organization-defined types of digital and non-digital media] are protected until the media are destroyed or sanitized using approved equipment, techniques, and procedures",
          "parameter": "all types of digital and non-digital media with sensitive information",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MP-5": {
      "name": "Media Transport",
      "assessment_procedures": [
        {
          "procedure_id": "MP-05a.",
          "objective": "Determine if [organization-defined types of system media] are protected and controlled during transport outside of controlled areas using [organization-defined controls]",
          "parameter": "all media with sensitive information; prior to leaving secure/controlled environment: for digital media, encryption in compliance with Federal requirements and utilizes FIPS validated or NSA approved cryptography (see SC-13.); for non-digital media, secured in locked container",
          "guidance": "Requirement: The service provider defines security measures to protect digital and non-digital media in transport.  The security measures are approved and accepted by the AO",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-05b.",
          "objective": "Determine if accountability for system media is maintained during transport outside of controlled areas",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-05c.",
          "objective": "Determine if activities associated with the transport of system media are documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "MP-05d.[01]",
          "objective": "Determine if personnel authorized to conduct media transport activities is/are identified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "MP-05d.[02]",
          "objective": "Determine if activities associated with the transport of system media are restricted to identified authorized personnel",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "MP-6": {
      "name": "Media Sanitization",
      "assessment_procedures": [
        {
          "procedure_id": "MP-06a.",
          "objective": "Determine if [organization-defined system media] is sanitized using [organization-defined sanitization techniques and procedures] prior to \n-disposal\n-release from organizational control\n-release for reuse",
          "parameter": "CSP-defined system media; techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-06b.",
          "objective": "Determine if sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "MP-6 (1)": {
      "name": "Review, Approve, Track, Document, and Verify",
      "assessment_procedures": [
        {
          "procedure_id": "MP-06(01)",
          "objective": "Determine if media sanitization and disposal actions are reviewed, approved, tracked, documented, and verified",
          "parameter": NaN,
          "guidance": "Requirement: Must comply with NIST SP 800-88",
          "test_method": "Test"
        }
      ]
    },
    "MP-6 (2)": {
      "name": "Equipment Testing",
      "assessment_procedures": [
        {
          "procedure_id": "MP-06(02)",
          "objective": "Determine if sanitization equipment and procedures are tested within the [organization-defined frequency] to ensure that the intended sanitization is being achieved",
          "parameter": "at least every six (6) months",
          "guidance": "Guidance: Equipment and procedures may be tested or validated for effectiveness",
          "test_method": "Test"
        }
      ]
    },
    "MP-6 (3)": {
      "name": "Nondestructive Techniques",
      "assessment_procedures": [
        {
          "procedure_id": "MP-06(03)",
          "objective": "Determine if non-destructive sanitization techniques are applied to portable storage devices prior to connecting such devices to the system under [organization-defined circumstances]",
          "parameter": "CSP-defined circumstances",
          "guidance": "Requirement: Must comply with NIST SP 800-88",
          "test_method": "Examine, Test"
        }
      ]
    },
    "MP-7": {
      "name": "Media Use",
      "assessment_procedures": [
        {
          "procedure_id": "MP-07a.",
          "objective": "Determine if the use of [organization-defined types of system media] is/are [restricted and/or prohibited] on [organization-defined systems or system components] using [organization-defined controls]",
          "parameter": "CSP-defined types of system media; CSP-defined as restricted and/or prohibited; CSP-defined systems or system components; CSP-defined controls",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "MP-07b.",
          "objective": "Determine if the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    }
  },
  "PE": {
    "PE-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "PE-01a.[01][02]",
          "objective": "Determine if a physical and environmental protection policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-01a.[03][04]",
          "objective": "Determine if physical and environmental protection procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PE-01a.01(a)",
          "objective": "Determine if the [organization-defined level] physical and environmental protection policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PE-01a.01(b)",
          "objective": "Determine if the physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PE-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-01c.01",
          "objective": "Determine if the current physical and environmental protection policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-01c.02",
          "objective": "Determine if the current physical and environmental protection procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PE-2": {
      "name": "Physical Access Authorizations",
      "assessment_procedures": [
        {
          "procedure_id": "PE-02a.",
          "objective": "Determine if a list of individuals with authorized access to the facility where the system resides has been developed, approved, and maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-02b.",
          "objective": "Determine if authorization credentials are issued for facility access",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-02c.",
          "objective": "Determine if the access list detailing authorized facility access by individuals is reviewed in accordance with [organization-defined frequency]",
          "parameter": "at least every ninety (90) days",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-02d.",
          "objective": "Determine if individuals are removed from the facility access list when access is no longer required",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-3": {
      "name": "Physical Access Control",
      "assessment_procedures": [
        {
          "procedure_id": "PE-03a.01",
          "objective": "Determine if physical access authorizations are enforced at [organization-defined entry and exit points to the facility where the system resides] by verifying individual access authorizations before granting access to the facility",
          "parameter": "CSP-defined physical access control systems/devices and guards",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03a.02",
          "objective": "Determine if physical access authorizations are enforced at [organization-defined entry and exit points to the facility where the system resides] by controlling ingress and egress to the facility using [organization-defined physical access control systems or devices; guards]",
          "parameter": "CSP-defined physical access control systems/devices and guards",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-03b.",
          "objective": "Determine if physical access audit logs are maintained for [organization-defined entry or exit points]",
          "parameter": "CSP-defined entry or exit points",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-03c.",
          "objective": "Determine if access to areas within the facility designated as publicly accessible are maintained by implementing [organization-defined physical access controls]",
          "parameter": "CSP-defined physical access controls",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03d.[01]",
          "objective": "Determine if visitors are escorted",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03d.[02]",
          "objective": "Determine if visitor activity is controlled during [organization-defined circumstances requiring visitor escorts and control of visitor activity]",
          "parameter": "in all circumstances within restricted access area where the information system resides",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-03e.",
          "objective": "Determine if keys, combinations, and other physical access devices are secured",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03f.",
          "objective": "Determine if [organization-defined physical access devices] are inventoried [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-03g.[01]",
          "objective": "Determine if combinations are changed [organization-defined frequency], when combinations are compromised, or when individuals possessing the combinations are transferred or terminated",
          "parameter": "at least annually or earlier as required by a security relevant event",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03g.[02]",
          "objective": "Determine if keys are changed [organization-defined frequency], when keys are lost, or when individuals possessing the keys are transferred or terminated",
          "parameter": "at least annually or earlier as required by a security relevant event",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-3 (1)": {
      "name": "System Access",
      "assessment_procedures": [
        {
          "procedure_id": "PE-03(01)[01]",
          "objective": "Determine if physical access authorizations to the system are enforced",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-03(01)[02]",
          "objective": "Determine if physical access controls are enforced for the facility at [organization-defined physical spaces containing one or more components of the system]",
          "parameter": "CSP-defined physical spaces containing one or more components of the system",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-4": {
      "name": "Access Control for Transmission",
      "assessment_procedures": [
        {
          "procedure_id": "PE-04",
          "objective": "Determine if physical access to [organization-defined system distribution and transmission lines] within organizational facilities is controlled using [organization-defined security controls].",
          "parameter": "CSP-defined system distribution and transmission lines; CSP-defined security controls",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-5": {
      "name": "Access Control for Output Devices",
      "assessment_procedures": [
        {
          "procedure_id": "PE-05",
          "objective": "Determine if physical access to output from [organization-defined output devices] is controlled to prevent unauthorized individuals from obtaining the output",
          "parameter": "CSP-defined output devices",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-6": {
      "name": "Monitoring Physical Access",
      "assessment_procedures": [
        {
          "procedure_id": "PE-06a.",
          "objective": "Determine if physical access to the facility where the system resides is monitored to detect and respond to physical security incidents",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-06b.[01]",
          "objective": "Determine if physical access logs are reviewed [organization-defined frequency]",
          "parameter": "at least monthly",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-06b.[02]",
          "objective": "Determine if physical access logs are reviewed upon occurrence of [organization-defined events or potential indications of events]",
          "parameter": "CSP-defined events or potential indications of events",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-06c.[01]",
          "objective": "Determine if results of reviews are coordinated with organizational incident response capabilities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-06c.[02]",
          "objective": "Determine if results of investigations are coordinated with organizational incident response capabilities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PE-6 (1)": {
      "name": "Intrusion Alarms and Surveillance Equipment",
      "assessment_procedures": [
        {
          "procedure_id": "PE-06(01)",
          "objective": "Determine if physical access to the facility where the system resides is monitored using physical intrusion alarms and physical surveillance equipment",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-6 (4)": {
      "name": "Monitoring Physical Access to Systems",
      "assessment_procedures": [
        {
          "procedure_id": "PE-06(04)",
          "objective": "Determine if physical access to the system is monitored in addition to the physical access monitoring of the facility at [organization-defined physical spaces containing one or more components of the system]",
          "parameter": "CSP-defined physical spaces containing one or more components of the system",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-8": {
      "name": "Visitor Access Records",
      "assessment_procedures": [
        {
          "procedure_id": "PE-08a.",
          "objective": "Determine if visitor access records for the facility where the system resides are maintained for [organization-defined time period]",
          "parameter": "for a minimum of one (1) year",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-08b.",
          "objective": "Determine if visitor access records are reviewed [organization-defined frequency]",
          "parameter": "at least monthly",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-08c.",
          "objective": "Determine if visitor access records anomalies are reported to [organization-defined personnel]",
          "parameter": "CSP-defined personnel",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PE-8 (1)": {
      "name": "Automated Records Maintenance and Review",
      "assessment_procedures": [
        {
          "procedure_id": "PE-08(01)[01]",
          "objective": "Determine if visitor access records are maintained using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-08(01)[02]",
          "objective": "Determine if visitor access records are reviewed using [organization-defined automated mechanisms]",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-9": {
      "name": "Power Equipment and Cabling",
      "assessment_procedures": [
        {
          "procedure_id": "PE-09",
          "objective": "Determine if power equipment and power cabling for the system are protected from damage and destruction",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-10": {
      "name": "Emergency Shutoff",
      "assessment_procedures": [
        {
          "procedure_id": "PE-10a.",
          "objective": "Determine if the capability to shut off power to [organization-defined system or individual system components] in emergency situations is provided",
          "parameter": "CSP-defined system or individual system components",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-10b.",
          "objective": "Determine if emergency shutoff switches or devices are placed in [organization-defined location by system or system component] to facilitate access for authorized personnel",
          "parameter": "near more than one egress point of the IT area and ensures it is labeled and protected by a cover to prevent accidental shut-off",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-10c.",
          "objective": "Determine if the emergency power shutoff capability is protected from unauthorized activation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-11": {
      "name": "Emergency Power",
      "assessment_procedures": [
        {
          "procedure_id": "PE-11",
          "objective": "Determine if an uninterruptible power supply is provided to facilitate [organization-defined selection: an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss",
          "parameter": "CSP-defined selection (an orderly shutdown of the system, transition of the system to long-term alternate power)",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-11 (1)": {
      "name": "Alternate Power Supply - Minimal Operational Capability",
      "assessment_procedures": [
        {
          "procedure_id": "PE-11(01)[01]",
          "objective": "Determine if an alternate power supply provided for the system is activated [organization-defined selection: manually; automatically]",
          "parameter": "automatically",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-11(01)[02]",
          "objective": "Determine if the alternate power supply provided for the system can maintain minimally required operational capability in the event of an extended loss of the primary power source",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-12": {
      "name": "Emergency Lighting",
      "assessment_procedures": [
        {
          "procedure_id": "PE-12[01][02]",
          "objective": "Determine if automatic emergency lighting that activates in the event of a power outage or disruption is employed and maintained for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-12[03][04]",
          "objective": "Determine if automatic emergency lighting for the system covers emergency exits and evacuation routes within the facility",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "PE-13": {
      "name": "Fire Protection",
      "assessment_procedures": [
        {
          "procedure_id": "PE-13[01][02][03]",
          "objective": "Determine if fire detection systems are:\n-employed\n-supported by an independent energy source\n-maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-13[04][05][06]",
          "objective": "Determine if fire suppression systems are: \n-employed\n-supported by an independent energy source\n-maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-13 (1)": {
      "name": "Detection Systems - Automatic Activation and Notification",
      "assessment_procedures": [
        {
          "procedure_id": "PE-13(01)[01]",
          "objective": "Determine if fire detection systems that activate automatically are employed in the event of a fire",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-13(01)[02][03]",
          "objective": "Determine if fire detection systems that notify [organization-defined personnel or roles] and [organization-defined emergency responders] automatically are employed in the event of a fire",
          "parameter": "service provider building maintenance/physical security personnel; service provider emergency responders with incident response responsibilities",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-13 (2)": {
      "name": "Suppression Systems - Automatic Activation and Notification",
      "assessment_procedures": [
        {
          "procedure_id": "PE-13(02)(a)[01]",
          "objective": "Determine if fire suppression systems that activate automatically are employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-13(02)(a)[02][03]",
          "objective": "Determine if fire suppression systems that notify [organization-defined personnel or roles] and [organization-defined emergency responders] automatically are employed",
          "parameter": "CSP-defined personnel or roles: CSP-defined emergency responders",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-13(02)(b)",
          "objective": "Determine if an automatic fire suppression capability is employed when the facility is not staffed on a continuous basis",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-14": {
      "name": "Environmental Controls",
      "assessment_procedures": [
        {
          "procedure_id": "PE-14a.",
          "objective": "Determine if [Selection: temperature; humidity; pressure; radiation] levels are maintained at [organization-defined acceptable levels for environmental controls] within the facility where the system resides",
          "parameter": "CSP-selection; consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments",
          "guidance": "Requirement: The service provider measures temperature at server inlets and humidity levels by dew point",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-14b.",
          "objective": "Determine if environmental control levels are monitored [organization-defined frequency]",
          "parameter": "continuously",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-14 (2)": {
      "name": "Monitoring with Alarms and Notifications",
      "assessment_procedures": [
        {
          "procedure_id": "PE-14(02)[01]",
          "objective": "Determine if environmental control monitoring is employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-14(02)[02]",
          "objective": "Determine if the environmental control monitoring capability provides an alarm or notification to [organization-defined personnel or roles] when changes are potentially harmful to personnel or equipment",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-15": {
      "name": "Water Damage Protection",
      "assessment_procedures": [
        {
          "procedure_id": "PE-15[01]",
          "objective": "Determine if the system is protected from damage resulting from water leakage by providing master shutoff or isolation valves",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-15[02][03][04]",
          "objective": "Determine if the master shutoff or isolation valves are accessible, working, and known to key personnel",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-15 (1)": {
      "name": "Automation Support",
      "assessment_procedures": [
        {
          "procedure_id": "PE-15(01)[01]",
          "objective": "Determine if the presence of water near the system can be detected automatically",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PE-15(01)[02]",
          "objective": "Determine if [organization-defined personnel or roles] is/are alerted using [organization-defined automated mechanisms]",
          "parameter": "service provider building maintenance/physical security personnel; CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PE-16": {
      "name": "Delivery and Removal",
      "assessment_procedures": [
        {
          "procedure_id": "PE-16a.[01][02]",
          "objective": "Determine if [organization-defined types of system components] are authorized and controlled when entering the facility",
          "parameter": "all information system components",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-16a.[03][04]",
          "objective": "Determine if [organization-defined types of system components] are authorized and controlled when exiting the facility",
          "parameter": "all information system components",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-16b.",
          "objective": "Determine if records of the system components are maintained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PE-17": {
      "name": "Alternate Work Site",
      "assessment_procedures": [
        {
          "procedure_id": "PE-17a.",
          "objective": "Determine if [organization-defined alternate work sites] are determined and documented",
          "parameter": "CSP-defined alternate work sites",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PE-17b.",
          "objective": "Determine if [organization-defined controls] are employed at alternate work sites",
          "parameter": "CSP-defined controls",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-17c.",
          "objective": "Determine if the effectiveness of controls at alternate work sites is assessed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PE-17d.",
          "objective": "Determine if a means for employees to communicate with information security and privacy personnel in case of incidents is provided",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PE-18": {
      "name": "Location of System Components",
      "assessment_procedures": [
        {
          "procedure_id": "PE-18",
          "objective": "Determine if system components are positioned within the facility to minimize potential damage from [organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access",
          "parameter": "physical and environmental hazards identified during threat assessment",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "PL": {
    "PL-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "PL-01a.[01][02]",
          "objective": "Determine if a planning policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-01a.[03][04]",
          "objective": "Determine if planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-01a.01(a)",
          "objective": "Determine if the [organization-defined level] planning policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-01a.01(b)",
          "objective": "Determine if the planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the planning policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-01c.01",
          "objective": "Determine if the current planning policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-01c.02",
          "objective": "Determine if the current planning procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PL-2": {
      "name": "System Security and Privacy Plans",
      "assessment_procedures": [
        {
          "procedure_id": "PL-02a.01[01]02[01]03[01]",
          "objective": "Determine if a security plan for the system is developed that is:\n-consistent with the organization's enterprise architecture\n-explicitly defines the constituent system components\n-describes the operational context of the system in terms of mission and business processes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.01[02]02[02]03[02]",
          "objective": "Determine if a privacy plan for the system is developed that is:\n-consistent with the organization's enterprise architecture\n-explicitly defines the constituent system components\n-describes the operational context of the system in terms of mission and business processes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.04[01]",
          "objective": "Determine if the security plan for the system identifies the individuals that fulfill system roles and responsibilities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.04[02]",
          "objective": "Determine if the privacy plan for the system identifies the individuals that fulfill system roles and responsibilities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.05",
          "objective": "Determine if the security and privacy plans identify the information types processed, stored, and transmitted by the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.06",
          "objective": "Determine if the security and privacy plans provide the security categorization of the system, including supporting rationale",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.07",
          "objective": "Determine if the security and privacy plans describe any specific threats to the system that are of concern to the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.08",
          "objective": "Determine if the security and privacy plans provide the results of a privacy risk assessment for systems processing personally identifiable information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.09",
          "objective": "Determine if the security and privacy plans describe the operational environment for the system and any dependencies on or connections to other systems or system components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.10[01]",
          "objective": "Determine if the security plan for the system provides an overview of the security requirements for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.10[02]",
          "objective": "Determine if a privacy plan for the system is developed that provides an overview of the privacy requirements for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.11",
          "objective": "Determine if the security and privacy plans identify any relevant control baselines or overlays, if applicable",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.12[01]",
          "objective": "Determine if the security plan for the system describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.12[02]",
          "objective": "Determine if the privacy plan for the system describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-02a.13[01]",
          "objective": "Determine if a security plan for the system is developed that includes risk determinations for security architecture and design decisions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.13[02]",
          "objective": "Determine if a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.14[01]",
          "objective": "Determine if a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [organization-defined individuals or groups]",
          "parameter": "to include chief privacy and ISSO and/or similar role or designees",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-02a.14[02]",
          "objective": "Determine if a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [organization-defined individuals or groups]",
          "parameter": "to include chief privacy and ISSO and/or similar role or designees",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-02a.15[01]",
          "objective": "Determine if a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02a.15[02]",
          "objective": "Determine if a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-02b.",
          "objective": "Determine if copies of the plans, as well as any subsequent changes to the plans, are distributed to [organization-defined personnel or roles]",
          "parameter": "to include chief privacy and ISSO and/or similar role",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-02c.",
          "objective": "Determine if plans are reviewed [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-02d.",
          "objective": "Determine if plans are updated to address:\n-changes to the system and environment of operations\n-problems identified during implementation\n-problems identified during control assessments",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-02e.",
          "objective": "Determine if plans are protected from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PL-4": {
      "name": "Rules of Behavior",
      "assessment_procedures": [
        {
          "procedure_id": "PL-04a.",
          "objective": "Determine if rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for and provided to individuals requiring access to the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-04b.",
          "objective": "Determine if before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-04c.",
          "objective": "Determine if rules of behavior are reviewed and updated [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-04d.",
          "objective": "Determine if individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [organization-defined frequency and/or when the rules are revised or updated]",
          "parameter": "at least annually and when the rules are revised or changed",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PL-4 (1)": {
      "name": "Social Media and External Site/Application Usage Restrictions",
      "assessment_procedures": [
        {
          "procedure_id": "PL-04(01)(a)",
          "objective": "Determine if the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-04(01)(b)",
          "objective": "Determine if the rules of behavior include restrictions on posting organizational information on public websites",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-04(01)(c)",
          "objective": "Determine if the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PL-8": {
      "name": "Security and Privacy Architectures",
      "assessment_procedures": [
        {
          "procedure_id": "PL-08a.01",
          "objective": "Determine if a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-08a.02",
          "objective": "Determine if a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-08a.03",
          "objective": "Determine if the security and privacy architectures for the system describes how the architectures are integrated into and support the enterprise architecture",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-08a.04",
          "objective": "Determine if the security and privacy architectures for the system describe any assumptions about and dependencies on external systems and services",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PL-08b.",
          "objective": "Determine if changes in the enterprise architecture are reviewed and updated [organization-defined frequency] to reflect changes in the enterprise architecture",
          "parameter": "at least annually and when a significant change occurs",
          "guidance": "Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PL-08c.[01][02]",
          "objective": "Determine if planned architecture changes are reflected in the security and privacy plan",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PL-08c.[03][04][05][06]",
          "objective": "Determine if planned architecture changes are reflected in:\n-the Concept of Operations (CONOPS)\n-criticality analysis\n-organizational procedures\n-procurements and acquisitions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PL-10": {
      "name": "Baseline Selection",
      "assessment_procedures": [
        {
          "procedure_id": "PL-10",
          "objective": "Determine if a control baseline for the system is selected",
          "parameter": NaN,
          "guidance": "Requirement: Select the appropriate FedRAMP Baseline",
          "test_method": "Examine"
        }
      ]
    },
    "PL-11": {
      "name": "Baseline Tailoring",
      "assessment_procedures": [
        {
          "procedure_id": "PL-11",
          "objective": "Determine if the selected control baseline is tailored by applying specified tailoring actions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    }
  },
  "PS": {
    "PS-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "PS-01a.[01][02]",
          "objective": "Determine if a personnel security policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-01a.[03][04]",
          "objective": "Determine if personnel security procedures to facilitate the implementation of the personnel security policy and associated personnel security controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PS-01a.01(a)",
          "objective": "Determine if the [organization-defined level] personnel security policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PS-01a.01(b)",
          "objective": "Determine if the personnel security policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PS-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the personnel security policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-01c.01",
          "objective": "Determine if the current personnel security policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-01c.02",
          "objective": "Determine if the current personnel security procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PS-2": {
      "name": "Position Risk Designation",
      "assessment_procedures": [
        {
          "procedure_id": "PS-02a.",
          "objective": "Determine if a risk designation is assigned to all organizational positions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-02b.",
          "objective": "Determine if screening criteria are established for individuals filling organizational positions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-02c.",
          "objective": "Determine if position risk designations are reviewed and updated [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-3": {
      "name": "Personnel Screening",
      "assessment_procedures": [
        {
          "procedure_id": "PS-03a.",
          "objective": "Determine if individuals are screened prior to authorizing access to the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-03b.",
          "objective": "Determine if where rescreening is so indicated, individuals are rescreened in accordance with [organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening]",
          "parameter": "for national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance.\n\nFor moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year.  There is no reinvestigation for other moderate risk positions or any low risk positions",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PS-3 (3)": {
      "name": "Information Requiring Special Protective Measures",
      "assessment_procedures": [
        {
          "procedure_id": "PS-03(03)(a)",
          "objective": "Determine if individuals accessing a system processing, storing, or transmitting information requiring special protection have valid access authorizations that are demonstrated by assigned official government duties",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-03(03)(b)",
          "objective": "Determine if individuals accessing a system processing, storing, or transmitting information requiring special protection satisfy [organization-defined additional personnel screening criteria]",
          "parameter": "personnel screening criteria - as required by specific information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PS-4": {
      "name": "Personnel Termination",
      "assessment_procedures": [
        {
          "procedure_id": "PS-04a.",
          "objective": "Determine if upon termination of individual employment, system access is disabled within [organization-defined time period]",
          "parameter": "one (1) hour",
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PS-04b.",
          "objective": "Determine if upon termination of individual employment, any authenticators and credentials are terminated or revoked",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PS-04c.",
          "objective": "Determine if upon termination of individual employment, exit interviews that include a discussion of [organization-defined information security topics] are conducted",
          "parameter": "CSP-defined information security topics",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PS-04d.",
          "objective": "Determine if upon termination of individual employment, all security-related organizational system-related property is retrieved",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-04e.",
          "objective": "Determine if upon termination of individual employment, access to organizational information and systems formerly controlled by the terminated individual are retained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-4 (2)": {
      "name": "Automated Actions",
      "assessment_procedures": [
        {
          "procedure_id": "PS-04(02)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to [organization-defined selection: notify organization-defined personnel or roles of individual termination actions; disable access to system resources]",
          "parameter": "CSP-defined automated mechanisms; notify access control personnel responsible for disabling access to the system",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-5": {
      "name": "Personnel Transfer",
      "assessment_procedures": [
        {
          "procedure_id": "PS-05a.",
          "objective": "Determine if the ongoing operational need for current logical and physical access authorizations to systems and facilities are reviewed and confirmed when individuals are reassigned or transferred to other positions within the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-05b.",
          "objective": "Determine if [organization-defined transfer or reassignment actions] are initiated within [organization-defined time period following the formal transfer action]",
          "parameter": "CSP-defined transfer or reassignment actions; twenty-four (24) hours",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PS-05c.",
          "objective": "Determine if access authorization is modified as needed to correspond with any changes in operational need due to reassignment or transfer",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "PS-05d.",
          "objective": "Determine if [organization-defined personnel or roles] are notified within [organization-defined time period]",
          "parameter": "including access control personnel responsible for the system; twenty-four (24) hours",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-6": {
      "name": "Access Agreements",
      "assessment_procedures": [
        {
          "procedure_id": "PS-06a.",
          "objective": "Determine if access agreements are developed and documented for organizational systems",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PS-06b.",
          "objective": "Determine if the access agreements are reviewed and updated [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-06c.01",
          "objective": "Determine if individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-06c.02",
          "objective": "Determine if individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [organization-defined frequency]",
          "parameter": "at least annually and any time there is a change to the user's level of access",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "PS-7": {
      "name": "External Personnel Security",
      "assessment_procedures": [
        {
          "procedure_id": "PS-07a.",
          "objective": "Determine if personnel security requirements are established, including security roles and responsibilities for external providers",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-07b.",
          "objective": "Determine if external providers are required to comply with personnel security policies and procedures established by the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-07c.",
          "objective": "Determine if personnel security requirements are documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "PS-07d.",
          "objective": "Determine if external providers are required to notify [organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges or who have system privileges within [organization-defined time period]",
          "parameter": "including access control personnel responsible for the system and/or facilities, as appropriate; terminations: immediately; transfers: within twenty-four (24) hours",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "PS-07e.",
          "objective": "Determine if provider compliance with personnel security requirements is monitored",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-8": {
      "name": "Personnel Sanctions",
      "assessment_procedures": [
        {
          "procedure_id": "PS-08a.",
          "objective": "Determine if a formal sanctions process is employed for individuals failing to comply with established information security and privacy policies and procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "PS-08b.",
          "objective": "Determine if [organization-defined personnel or roles] is/are notified within [organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction",
          "parameter": "to include the ISSO and/or similar role within the organization; twenty-four (24) hours",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "PS-9": {
      "name": "Position Descriptions",
      "assessment_procedures": [
        {
          "procedure_id": "PS-09",
          "objective": "Determine if security and privacy roles and responsibilities are incorporated into organizational position descriptions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        }
      ]
    }
  },
  "RA": {
    "RA-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "RA-01a.[01][02]",
          "objective": "Determine if a risk assessment policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-01a.[03][04]",
          "objective": "Determine if risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-01a.01(a)",
          "objective": "Determine if the [organization-defined level] risk assessment policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-01a.01(b)",
          "objective": "Determine if the risk assessment policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-01c.01",
          "objective": "Determine if the current risk assessment policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-01c.02",
          "objective": "Determine if the current risk assessment procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "RA-2": {
      "name": "Security Categorization",
      "assessment_procedures": [
        {
          "procedure_id": "RA-02a.",
          "objective": "Determine if the system and information it processes, stores, and transmits are categorized",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-02b.",
          "objective": "Determine if the security categorization results, including supporting rationale, are documented in the security plan for the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-02c.",
          "objective": "Determine if the authorizing official or authorizing official designated representative reviews and approves the security categorization decision",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-3": {
      "name": "Risk Assessment",
      "assessment_procedures": [
        {
          "procedure_id": "RA-03a.01-02",
          "objective": "Determine if a risk assessment is conducted to identify threats to and vulnerabilities in the system, including the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-03a.03",
          "objective": "Determine if a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-03b.",
          "objective": "Determine if risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-03c.",
          "objective": "Determine if risk assessment results are documented in [organization-defined selection: security and privacy plans; risk assessment report; organization-defined document]",
          "parameter": "security assessment report",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "RA-03d.",
          "objective": "Determine if risk assessment results are reviewed [organization-defined frequency]",
          "parameter": "at least annually and whenever a significant change occurs",
          "guidance": "Guidance: Significant change is defined in NIST Special Publication 800-37 Revision 2, Appendix F",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-03e.",
          "objective": "Determine if risk assessment results are disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": "Requirement: Include all Authorizing Officials\n",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-03f.",
          "objective": "Determine if the risk assessment is updated [organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system",
          "parameter": "annually",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-3 (1)": {
      "name": "Supply Chain Risk Assessment",
      "assessment_procedures": [
        {
          "procedure_id": "RA-03(01)(a)",
          "objective": "Determine if supply chain risks associated with [organization-defined systems, system components, and system services] are assessed",
          "parameter": "CSP-defined systems, system components, and system services",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-03(01)(b)",
          "objective": "Determine if the supply chain risk assessment is updated [organization-defined frequency], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain",
          "parameter": "CSP-defined frequency",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5": {
      "name": "Vulnerability Monitoring and Scanning",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05a.",
          "objective": "Determine if systems and hosted applications are monitored and scanned for vulnerabilities:\n-at [organization-defined frequency and/or randomly in accordance with organization-defined process];\n-when new vulnerabilities potentially affecting the system are identified and reported",
          "parameter": "monthly operating system/infrastructure; monthly web applications (including APIs) and databases",
          "guidance": "Guidance: See the FedRAMP Documents page> Vulnerability Scanning Requirements \nhttps://www.FedRAMP.gov/documents/\n\nRequirement: an accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually\n",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05b.",
          "objective": "Determine if vulnerability monitoring tools and techniques are employed to facilitate interoperability among tools",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "RA-05b.01.02.03",
          "objective": "Determine if vulnerability monitoring tools and techniques use standards: \n-for enumeration in regards to platforms, software flaws, and improper configurations\n-for formatting checklists and test procedures \n-for measuring vulnerability impact",
          "parameter": NaN,
          "guidance": "Guidance: Informational findings from a scanner are detailed as a returned result that holds no vulnerability risk or severity and for FedRAMP does not require an entry onto the POA&M or entry onto the RET during any assessment phase.\nWarning findings, on the other hand, are given a risk rating (low, moderate, high or critical) by the scanning solution and should be treated like any other finding with a risk or severity rating for tracking purposes onto either the POA&M or RET depending on when the findings originated (during assessments or during monthly continuous monitoring). If a warning is received during scanning, but further validation turns up no actual issue then this item should be categorized as a false positive. If this situation presents itself during an assessment phase (initial assessment, annual assessment or any SCR), follow guidance on how to report false positives in the Security Assessment Report (SAR). If this situation happens during monthly continuous monitoring, a deviation request will need to be submitted per the FedRAMP Vulnerability Deviation Request Form.\nWarnings are commonly associated with scanning solutions that also perform compliance scans, and if the scanner reports a \u201cwarning\u201d as part of the compliance scanning of a CSO, follow guidance surrounding the tracking of compliance findings during either the assessment phases (initial assessment, annual assessment or any SCR) or monthly continuous monitoring as it applies. Guidance on compliance scan findings can be found by searching on \u201cTracking of Compliance Scans\u201d in FAQs.",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05c.",
          "objective": "Determine if vulnerability scan reports and results from vulnerability monitoring are analyzed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05d.",
          "objective": "Determine if legitimate vulnerabilities are remediated [organization-defined response times] in accordance with an organizational assessment of risk",
          "parameter": "high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery",
          "guidance": "Requirement: If a vulnerability is listed among the CISA Known Exploited Vulnerability (KEV) Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) the KEV remediation date supersedes the FedRAMP parameter requirement.",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05e.",
          "objective": "Determine if information obtained from the vulnerability monitoring process and control assessments is shared with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems",
          "parameter": "CSP-defined personnel or roles",
          "guidance": "Requirement: to include all Authorizing Officials\n\n",
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05f.",
          "objective": "Determine if vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned are employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (2)": {
      "name": "Update Vulnerabilities to Be Scanned",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(02)",
          "objective": "Determine if the system vulnerabilities to be scanned are updated [Selection: organization-defined frequency; prior to a new scan; when new vulnerabilities are identified and reported].",
          "parameter": "within twenty-four (24) hours prior to running scans",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (3)": {
      "name": "Breadth and Depth of Coverage",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(03)",
          "objective": "Determine if the breadth and depth of vulnerability scanning coverage are defined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (4)": {
      "name": "Discoverable Information",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(04)[01]",
          "objective": "Determine if information about the system is discoverable",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "RA-05(04)[02]",
          "objective": "Determine if [organization-defined corrective actions] are taken when information about the system is confirmed as discoverable",
          "parameter": "notify appropriate service provider personnel and follow procedures for organization and service provider-defined corrective actions",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (5)": {
      "name": "Privileged Access",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(05)",
          "objective": "Determine if privileged access authorization is implemented to [organization-defined system components] for [organization-defined vulnerability scanning activities]",
          "parameter": "all components that support authentication; all scans",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (8)": {
      "name": "Review Historic Audit Logs",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(08)",
          "objective": "Determine if historic audit logs are reviewed to determine if a vulnerability identified in a [organization-defined system] has been previously exploited within [organization-defined time period",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: This enhancement is required for all high (or critical) vulnerability scan findings",
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-5 (11)": {
      "name": "Public Disclosure Program",
      "assessment_procedures": [
        {
          "procedure_id": "RA-05(11)",
          "objective": "Determine if a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-7": {
      "name": "Risk Response",
      "assessment_procedures": [
        {
          "procedure_id": "RA-07",
          "objective": "Determine if findings from security assessments, privacy assessments, monitoring, and audits are responded to in accordance with organizational risk tolerance",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "RA-9": {
      "name": "Criticality Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "RA-09",
          "objective": "Determine if critical system components and functions are identified by performing a criticality analysis for [organization-defined systems, system components, and system services] at [organization-defined decision points in the system development life cycle]",
          "parameter": "CSP-defined systems, system components, and system services; CSP-defined decision points in the system development lifecycle",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    }
  },
  "SA": {
    "SA-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "SA-01a.[01][02]",
          "objective": "Determine if a system and services acquisition policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-01a.[03][04]",
          "objective": "Determine if system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-01a.01(a)",
          "objective": "Determine if the [organization-defined level] system and services acquisition policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-01a.01(b)",
          "objective": "Determine if the system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-01c.01",
          "objective": "Determine if the current system and services acquisition policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-01c.02",
          "objective": "Determine if the current system and services acquisition procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-2": {
      "name": "Allocation of Resources",
      "assessment_procedures": [
        {
          "procedure_id": "SA-02a.[01]",
          "objective": "Determine if the high-level security requirements for the system or system service are determined in mission and business process planning",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-02a.[02]",
          "objective": "Determine if the high-level privacy requirements for the system or system service are determined in mission and business process planning",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-02b.[01]",
          "objective": "Determine if the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-02b.[02]",
          "objective": "Determine if the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-02c.[01]",
          "objective": "Determine if a discrete line item for information security is established in organizational programming and budgeting documentation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-02c.[02]",
          "objective": "Determine if a discrete line item for privacy is established in organizational programming and budgeting documentation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-3": {
      "name": "System Development Life Cycle",
      "assessment_procedures": [
        {
          "procedure_id": "SA-03a.[01]",
          "objective": "Determine if the system is acquired, developed, and managed using [organization-defined system \ndevelopment life cycle] that incorporates information security considerations",
          "parameter": "CSP-defined system development life cycle",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03a.[02]",
          "objective": "Determine if the system is acquired, developed, and managed using [organization-defined system \ndevelopment life cycle] that incorporates privacy considerations",
          "parameter": "CSP-defined system development life cycle",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03b.[01]",
          "objective": "Determine if information security roles and responsibilities are defined and documented throughout the system development life cycle",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03b.[02]",
          "objective": "Determine if privacy roles and responsibilities are defined and documented throughout the system development life cycle",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03c.[01]",
          "objective": "Determine if individuals with information security roles and responsibilities are identified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03c.[02]",
          "objective": "Determine if individuals with privacy roles and responsibilities are identified",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03d.[01]",
          "objective": "Determine if organizational information security risk management processes are integrated into system development life cycle activities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-03d.[02]",
          "objective": "Determine if organizational privacy risk management processes are integrated into system development life cycle activities",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-4": {
      "name": "Acquisition Process",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04a.[01]c.[01]d.[01]",
          "objective": "Determine if the following are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service:\n-security functional requirements, descriptions, and criteria\n-security assurance requirements, descriptions, and criteria\n-controls needed to satisfy the security requirements, descriptions, and criteria\n",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04a.[02]c.[02]d.[02]",
          "objective": "Determine if the following are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service:\n-privacy functional requirements, descriptions, and criteria\n-privacy assurance requirements, descriptions, and criteria\n-controls needed to satisfy the privacy requirements, descriptions, and criteria",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04b.",
          "objective": "Determine if strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04e.",
          "objective": "Determine if security and privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04f.",
          "objective": "Determine if requirements for protecting security and privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04g.",
          "objective": "Determine if the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04h.",
          "objective": "Determine if the allocation of responsibility or identification of parties responsible for the following are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service:\n-information security requirements, descriptions, and criteria\n-privacy requirements, descriptions, and criteria \n-supply chain risk management requirements, description, and criteria",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-04i.",
          "objective": "Determine if acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection: standardized contract language; organization-defined contract language] in the acquisition contract for the system, system component, or system service",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must comply with Federal Acquisition Regulation (FAR) Subpart 7.103, and Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Pub. L. 115-232), and FAR Subpart 4.21, which implements Section 889 (as well as any added updates related to FISMA to address security concerns in the system acquisitions process)\n\nGuidance: The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-4 (1)": {
      "name": "Functional Properties of Controls",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04(01)",
          "objective": "Determine if the developer of the system, system component, or system service is required to provide a description of the functional properties of the controls to be implemented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-4 (2)": {
      "name": "Design and Implementation Information for Controls",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04(02)",
          "objective": "Determine if the developer of the system, system component, or system service is required to provide design and implementation information for the controls that includes using [Selection: security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; organization-defined design and implementation information] at [organization-defined level of detail]",
          "parameter": "at a minimum to include security-relevant external system interfaces; high-level design; low-level design; source code or network and data flow diagram; CSP-defined design/implementation information; CSP-defined level of detail",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-4 (5)": {
      "name": "System, Component, and Service Configurations",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04(05)(a)",
          "objective": "Determine if the developer of the system, system component, or system service is required to deliver the system, component, or service with [organization-defined \nsecurity configurations] implemented",
          "parameter": "the service provider shall use the DoD STIGs to establish configuration settings; Center for Internet Security up to Level 2 (CIS Level 2) guidelines shall be used if STIGs are not available; Custom baselines shall be used if CIS is not available.",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-04(05)(b)",
          "objective": "Determine if the configurations are used as the default for any subsequent system, component, or service reinstallation or upgrade",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-4 (9)": {
      "name": "Functions, Ports, Protocols, and Services in Use",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04(09)",
          "objective": "Determine if the developer of the system, system component, or system service is required to identify the functions, ports, protocols, and services intended for organizational use",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-4 (10)": {
      "name": "Use of Approved PIV Products",
      "assessment_procedures": [
        {
          "procedure_id": "SA-04(10)",
          "objective": "Determine if only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-5": {
      "name": "System Documentation",
      "assessment_procedures": [
        {
          "procedure_id": "SA-05a.01",
          "objective": "Determine if administrator documentation for the system, system component, or system service that describes the following is obtained or developed:\n-secure configuration\n-secure installation\n-secure operation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05a.02[01][02]",
          "objective": "Determine if administrator documentation for the system, system component, or system service that describes the following is obtained or developed:\n-effective use of security functions and mechanisms \n-effective maintenance of security functions and mechanisms",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05a.02[03][04]",
          "objective": "Determine if administrator documentation for the system, system component, or system service that describes the following is obtained or developed:\n-effective use of privacy functions and mechanisms \n-effective maintenance of privacy functions and mechanisms",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05a.03",
          "objective": "Determine if administrator documentation for the system, system component, or system service that describes known vulnerabilities regarding the configuration and use of administrative or privileged functions is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.01[01][02]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes user-accessible security functions and mechanisms, and how to effectively use them is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.01[03][04]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes user-accessible privacy functions and mechanisms, and how to effectively use them is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.02[01]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes methods for user interaction which enable individuals to use the system, component, or service in a more secure manner is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.02[02]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes methods for user interaction which enable individuals to use the system, component, or service to protect individual privacy is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.03[01]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes user responsibilities for maintaining the security of the system, component, or service is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05b.03[02]",
          "objective": "Determine if user documentation for the system, system component, or system service that describes user responsibilities for maintaining the privacy of individuals is obtained or developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-05c.[01]",
          "objective": "Determine if attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent is documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-05c.[02]",
          "objective": "Determine if after attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent, [organization-defined actions] are taken in response",
          "parameter": "CSP-defined actions",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-05d.",
          "objective": "Determine if documentation is distributed to [organization-defined personnel or roles]",
          "parameter": "at a minimum, the ISSO (or similar role within the organization)",
          "guidance": NaN,
          "test_method": "Examine, Test"
        }
      ]
    },
    "SA-8": {
      "name": "Security and Privacy Engineering Principles",
      "assessment_procedures": [
        {
          "procedure_id": "SA-08[01][02][03][04][05]",
          "objective": "Determine if [organization-defined systems security engineering principles] are applied in the specification, design, development, implementation, and modification of the system and system components",
          "parameter": "CSP-defined systems security engineering principles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-08[06][07][08][09][10]",
          "objective": "Determine if [organization-defined privacy engineering principles] are applied in the specification, design, development, implementation, and modification of the system and system components",
          "parameter": "CSP-defined privacy engineering principles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-9": {
      "name": "External System Services",
      "assessment_procedures": [
        {
          "procedure_id": "SA-09a.[01]",
          "objective": "Determine if providers of external system services comply with organizational security requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-09a.[02]",
          "objective": "Determine if providers of external system services comply with organizational privacy requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-09a.[03]",
          "objective": "Determine if providers of external system services employ [organization-defined controls]",
          "parameter": "Appropriate FedRAMP Security Controls Baseline (s) if Federal information is processed or stored within the external system",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-09b.[01]",
          "objective": "Determine if organizational oversight with regard to external system services are defined and documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-09b.[02]",
          "objective": "Determine if user roles and responsibilities with regard to external system services are defined and documented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SA-09c.",
          "objective": "Determine if [organization-defined processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis",
          "parameter": "Federal/FedRAMP Continuous Monitoring requirements must be met for external systems where Federal information is processed or stored",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-9 (1)": {
      "name": "Risk Assessments and Organizational Approvals",
      "assessment_procedures": [
        {
          "procedure_id": "SA-09(01)(a)(b)",
          "objective": "Determine if an organizational assessment of risk is conducted and approved by [organization-defined personnel or roles] prior to the acquisition or outsourcing of information security services",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-9 (2)": {
      "name": "Identification of Functions, Ports, Protocols, and Services",
      "assessment_procedures": [
        {
          "procedure_id": "SA-09(02)",
          "objective": "Determine if providers of [organization-defined external system services] are required to identify the functions, ports, protocols, and other services required for the use of such services",
          "parameter": "all external systems where Federal information is processed or stored",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-9 (5)": {
      "name": "Processing, Storage, and Service Location",
      "assessment_procedures": [
        {
          "procedure_id": "SA-09(05)",
          "objective": "Determine if based on [organization-defined requirements or conditions for information processing; information or data; system services] is/are restricted to [organization-defined locations]",
          "parameter": "information processing, information data, and system services; US/US territories of geographic locations where there is US jurisdiction for all High impact data, systems, or services",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-10": {
      "name": "Developer Configuration Management",
      "assessment_procedures": [
        {
          "procedure_id": "SA-10a.",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform configuration management during system, component, or service [organization-defined selection: design; development; implementation; operation; disposal]",
          "parameter": "development, implementation, and operation",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-10b.",
          "objective": "Determine if the developer of the system, system component, or system service is required to document, manage, and control the integrity of changes to [organization-defined configuration items under configuration management]",
          "parameter": "CSP-defined configuration items under configuration management",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SA-10c.",
          "objective": "Determine if the developer of the system, system component, or system service is required to implement only organization-approved changes to the system, component, or service",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-10d.",
          "objective": "Determine if the developer of the system, system component, or system service is required to document the following:\n-approved changes\n-potential security impacts of those changes\n-potential privacy impacts of those changes",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-10e.",
          "objective": "Determine if the developer of the system, system component, or system service is required to:\n-track security flaws\n-track security flaw resolutions\n-report findings to [organization-defined personnel]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: Track security flaws and flaw resolution within the system, component, or service and report findings to organization-defined personnel, to include FedRAMP",
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-11": {
      "name": "Developer Testing and Evaluation",
      "assessment_procedures": [
        {
          "procedure_id": "SA-11a.[01][02]",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop and implement a plan for ongoing security assessments",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SA-11a.[03][04]",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop and implement a plan for ongoing privacy assessments",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SA-11b.",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [organization-defined selection: unit; integration; system; regression] testing/evaluation at [organization-defined frequency] at [organization-defined depth \nand coverage]",
          "parameter": "CSP-defined selection: unit, integration, system, regression; CSP-defined frequency; CSP-defined depth and coverage",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11c.",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce:\n-evidence of the execution of the assessment plan\n-results of testing and evaluation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-11d.",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11e.",
          "objective": "Determine if the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-11 (1)": {
      "name": "Static Code Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "SA-11(01)",
          "objective": "Determine if the developer of the system, system component, or system service is required to employ static code analysis tools to identify common flaws and document results of this analysis",
          "parameter": NaN,
          "guidance": "Requirement: The service provider must document its methodology for reviewing newly developed code for the Service in its Continuous Monitoring Plan\n\nIf Static code analysis cannot be performed (for example, when the source code is not available), then dynamic code analysis must be performed (see SA-11 (8))\n\n",
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-11 (2)": {
      "name": "Threat Modeling and Vulnerability Analyses",
      "assessment_procedures": [
        {
          "procedure_id": "SA-11(02)(a)[01][02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform threat modeling and vulnerability analyses during development of the system, component, or service that uses [organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]",
          "parameter": "CSP-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(a)[03][04]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform threat modeling and vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that uses [organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]",
          "parameter": "CSP-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(b)[01][02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform threat modeling during development and subsequent testing and evaluation of the system, component, or service that employs [organization-defined tools and methods]",
          "parameter": "CSP-defined tools and methods",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(b)[03][04]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform vulnerability analyses during development and subsequent testing and evaluation of the system, component, or service that employs [organization-defined tools and methods]",
          "parameter": "CSP-defined tools and methods",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(c)[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform threat modeling at [organization-defined breadth and depth of modeling and analyses] during development of the system, component, or service",
          "parameter": "CSP-defined breadth and depth of modeling and analyses",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(c)[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that conducts modeling and analyses at [organization-defined breadth and depth of modeling and analyses]",
          "parameter": "CSP-defined breadth and depth of modeling and analyses",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-11(02)(d)[01][02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform threat modeling during development and subsequent testing and evaluation of the system, component, or service that produces evidence that meets [organization-defined acceptance criteria]",
          "parameter": "CSP-defined acceptance criteria",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-11(02)(d)[03][04]",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform vulnerability analyses during development and subsequent testing and evaluation of the system, component, or service that produces evidence that meets [organization-defined acceptance criteria]",
          "parameter": "CSP-defined acceptance criteria",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-15": {
      "name": "Development Process, Standards, and Tools",
      "assessment_procedures": [
        {
          "procedure_id": "SA-15a.01[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses security requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-15a.01[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process that explicitly addresses privacy requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-15a.02",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process that identifies the standards and tools used in the development process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-15a.03",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process that documents the specific tool and the tool configurations used in the development process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-15a.04",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process that documents, manages, and ensures the integrity of changes to the process and/or tools used in development",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SA-15b.[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [organization-defined frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [organization-defined security requirements]",
          "parameter": "before first use and annually thereafter; FedRAMP Security Authorization requirements",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-15b.[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to follow a documented development process in which the development process, standards, tools, tool options, and tool configurations are reviewed [organization-defined frequency] to determine that the process, standards, tools, tool options, and tool configurations selected and employed satisfy [organization-defined privacy requirements]",
          "parameter": "before first use and annually thereafter; FedRAMP Security Authorization requirements",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-15 (3)": {
      "name": "Criticality Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "SA-15(03)",
          "objective": "Determine if the developer of the system, system component, or system service is required to perform a criticality analysis at [organization-defined decision points in the system development life cycle] and at the [organization-defined breadth of criticality analysis] and [organization-defined depth of criticality analysis] in the system development life cycle",
          "parameter": "CSP-defined decision points in the system development life cycle; CSP-defined breadth of criticality analysis; CSP-defined depth of criticality analysis",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SA-16": {
      "name": "Developer-Provided Training",
      "assessment_procedures": [
        {
          "procedure_id": "SA-16",
          "objective": "Determine if the developer of the system, system component, or system service is required to provide [organization-defined training] on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms",
          "parameter": "CSP-defined training",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-17": {
      "name": "Developer Security and Privacy Architecture and Design",
      "assessment_procedures": [
        {
          "procedure_id": "SA-17a.[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and security architecture that are consistent with the organization's security architecture, which is an integral part the organization's enterprise architecture",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-17a.[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that are consistent with the organization's privacy architecture, which is an integral part the organization's enterprise architecture",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-17b.[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and security architecture that accurately and completely describe the required security functionality and the allocation of controls among physical and logical components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-17b.[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that accurately and completely describe the required privacy functionality and the allocation of controls among physical and logical components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-17c.[01]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and security architecture that express how individual security functions, mechanisms, and services work together to provide required security capabilities and a unified approach to protection",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-17c.[02]",
          "objective": "Determine if the developer of the system, system component, or system service is required to produce a design specification and privacy architecture that express how individual privacy functions, mechanisms, and services work together to provide required privacy capabilities and a unified approach to protection",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-21": {
      "name": "Developer Screening",
      "assessment_procedures": [
        {
          "procedure_id": "SA-21a.",
          "objective": "Determine if the developer of [organization-defined system, system component, or system service] is required to have appropriate access authorizations as determined by assigned [organization defined official government duties]",
          "parameter": "CSP-defined system, system component, or system service; CSP-defined official government duties",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SA-21b.",
          "objective": "Determine if the developer of [organization-defined system, system component, or system service] is required to satisfy [organization defined additional personnel screening criteria]",
          "parameter": "CSP-defined system, system component, or system service; CSP-defined additional personnel screening",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SA-22": {
      "name": "Unsupported System Components",
      "assessment_procedures": [
        {
          "procedure_id": "SA-22a.",
          "objective": "Determine if system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SA-22b.",
          "objective": "Determine if [organization-defined selection: in-house support; external providers] provide options for alternative sources for continued support for unsupported components",
          "parameter": "CSP-defined selection: in-house support; external providers",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    }
  },
  "SC": {
    "SC-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "SC-01a.[01][02]",
          "objective": "Determine if a system and communications protection policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-01a.[03][04]",
          "objective": "Determine if system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SC-01a.01(a)",
          "objective": "Determine if the [organization-defined level] system and communications protection policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SC-01a.01(b)",
          "objective": "Determine if the system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SC-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-01c.01",
          "objective": "Determine if the current system and communications protection policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-01c.02",
          "objective": "Determine if the current system and communications protection procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SC-2": {
      "name": "Separation of System and User Functionality",
      "assessment_procedures": [
        {
          "procedure_id": "SC-02",
          "objective": "Determine if user functionality, including user interface services, is separated from system management functionality",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SC-3": {
      "name": "Security Function Isolation",
      "assessment_procedures": [
        {
          "procedure_id": "SC-03",
          "objective": "Determine if security functions are isolated from non-security functions",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SC-4": {
      "name": "Information in Shared System Resources",
      "assessment_procedures": [
        {
          "procedure_id": "SC-04",
          "objective": "Determine if unauthorized and unintended information transfer via shared system resources is prevented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SC-5": {
      "name": "Denial-of-Service Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-05a",
          "objective": "Determine if the effects of [organization-defined types of denial-of-service events] are [organization-defined protect against; limit]",
          "parameter": "at a minimum: ICMP (ping) flood, SYN flood, slowloris, buffer overflow attack, and volume attack; protect against",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-05b",
          "objective": "Determine if [organization-defined controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective",
          "parameter": "CSP-defined controls by type of denial-of-service event",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "SC-7": {
      "name": "Boundary Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07a.[01][02]",
          "objective": "Determine if communications at external managed interfaces to the system are monitored and controlled",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-07a.[03][04]",
          "objective": "Determine if communications at key internal managed interfaces within the system are monitored and controlled",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-07b",
          "objective": "Determine if subnetworks for publicly accessible system components are [organization-defined physically; logically] separated from internal organizational networks",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance: SC-7 (b) should be met by subnet isolation. A subnetwork (subnet) is a physically or logically segmented section of a larger network defined at TCP/IP Layer 3, to both minimize traffic and, important for a FedRAMP Authorization, add a crucial layer of network isolation. Subnets are distinct from VLANs (Layer 2), security groups, and VPCs and are specifically required to satisfy SC-7 part b and other controls.  See the FedRAMP Subnets White Paper (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf) for additional information.",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-07c",
          "objective": "Determine if external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (3)": {
      "name": "Access Points",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(03)",
          "objective": "Determine if the number of external network connections to the system is limited",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (4)": {
      "name": "External Telecommunications Services",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(04)(a)",
          "objective": "Determine if a managed interface is implemented for each external telecommunication service",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-07(04)(b)",
          "objective": "Determine if a traffic flow policy is established for each managed interface",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-07(04)(c)",
          "objective": "Determine if the confidentiality and integrity of the information being transmitted across each interface is protected",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SC-07(04)(d)",
          "objective": "Determine if each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-07(04)(e)",
          "objective": "Determine if exceptions to the traffic flow policy are reviewed [organization-defined frequency] and the exception to the traffic flow policy that are no longer supported by an explicit mission or business need are removed",
          "parameter": "at least every ninety (90) days or whenever there is a change in the threat environment that warrants a review of the exceptions",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-07(04)(f)",
          "objective": "Determine if unauthorized exchanges of control plane traffic with external networks are prevented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-07(04)(g)",
          "objective": "Determine if information is published to enable remote networks to detect unauthorized control plane traffic from internal networks",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-07(04)(h)",
          "objective": "Determine if unauthorized control plane traffic is filtered from external networks",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (5)": {
      "name": "Deny by Default \u00f3 Allow by Exception",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(05)",
          "objective": "Determine if network communications traffic is denied by default and allowed by exception [Selection: at managed interfaces; for systems for which network communications traffic is denied by default and network communications traffic is allowed by exception]",
          "parameter": "any systems",
          "guidance": "\n",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (7)": {
      "name": "Split Tunneling for Remote Devices",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(07)",
          "objective": "Determine if split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [organization-defined safeguards]",
          "parameter": "CSP-defined safeguards",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (8)": {
      "name": "Route Traffic to Authenticated Proxy Servers",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(08)",
          "objective": "Determine if [organization-defined internal communications traffic] is routed to [organization-defined external networks] through authenticated proxy servers at managed interfaces",
          "parameter": "any network outside of organizational control and any network outside the authorization boundary",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (10)": {
      "name": "Prevent Exfiltration",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(10)(a)",
          "objective": "Determine if the exfiltration of information is prevented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-07(10)(b)",
          "objective": "Determine if exfiltration tests are conducted [organization-defined frequency]",
          "parameter": "CSP-defined frequency",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SC-7 (12)": {
      "name": "Host-based Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(12)",
          "objective": "Determine if [organization-defined host-based boundary protection mechanisms] are implemented at [organization-defined system components]",
          "parameter": "Host Intrusion Prevention System (HIPS), Host Intrusion Detection System (HIDS), or minimally a host-based firewall",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (18)": {
      "name": "Fail Secure",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(18)",
          "objective": "Determine if systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (20)": {
      "name": "Dynamic Isolation and Segregation",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(20)",
          "objective": "Determine if the capability to dynamically isolate [organization-defined system components] from other system components is provided",
          "parameter": "CSP-defined system components",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-7 (21)": {
      "name": "Isolation of System Components",
      "assessment_procedures": [
        {
          "procedure_id": "SC-07(21)",
          "objective": "Determine if boundary protection mechanisms are employed to isolate [organization-defined system components] supporting [organization-defined missions and/or business functions]",
          "parameter": "CSP-defined system components; CSP-defined missions and/or business functions",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-8": {
      "name": "Transmission Confidentiality and Integrity",
      "assessment_procedures": [
        {
          "procedure_id": "SC-08",
          "objective": "Determine if the [organization-defined confidentiality; integrity] of transmitted information is/are protected",
          "parameter": "confidentiality and integrity",
          "guidance": "Guidance: For each instance of data in transit, confidentiality AND integrity should be through cryptography as specified in SC-8 (1), physical means as specified in SC-8 (5), or in combination.\n\nFor clarity, this control applies to all data in transit. Examples include the following data flows:\n - Crossing the system boundary\n - Between compute instances - including containers\n - From a compute instance to storage\n - Replication between availability zones\n - Transmission of backups to storage\n - From a load balancer to a compute instance\n - Flows from management tools required for their work \u2013 e.g. log collection, scanning, etc.\n\nThe following applies only when choosing SC-8 (5) in lieu of SC-8 (1).\nFedRAMP-Defined Assignment / Selection Parameters \nSC-8 (5)-1 [a hardened or alarmed carrier Protective Distribution System (PDS) when outside of Controlled Access Area (CAA)]\nSC-8 (5)-2 [prevent unauthorized disclosure of information AND detect changes to information] \n\nSC-8 Guidance: SC-8 (5) applies when physical protection has been selected as the method to protect confidentiality and integrity. For physical protection, data in transit must be in either a Controlled Access Area (CAA), or a Hardened or alarmed PDS.\n\nHardened or alarmed PDS: Shall be as defined in SECTION X - CATEGORY 2 PDS INSTALLATION GUIDANCE of CNSSI No.7003, titled PROTECTED DISTRIBUTION SYSTEMS (PDS). Per the CNSSI No. 7003 Section VIII, PDS must originate and terminate in a Controlled Access Area (CAA). \n\nControlled Access Area (CAA): Data will be considered physically protected, and in a CAA if it meets Section 2.3 of the DHS\u2019s Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies. CSPs can meet Section 2.3 of the DHS\u2019 recommended practice by satisfactory implementation of the following controls PE-2 (1), PE-2 (2), PE-2 (3), PE-3 (2), PE-3 (3), PE-6 (2), and PE-6 (3).\n\nNote: When selecting SC-8 (5), the above SC-8(5), and the above referenced PE controls must be added to the SSP.\n\nCNSSI No.7003 can be accessed here:\nhttps://www.dcsa.mil/Portals/91/documents/ctp/nao/CNSSI_7003_PDS_September_2015.pdf \n\nDHS Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies can be accessed here:\nhttps://us-cert.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_Defense_in_Depth_Strategies_S508C.pdf ",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-8 (1)": {
      "name": "Cryptographic Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-08(01)",
          "objective": "Determine if cryptographic mechanisms are implemented to [organization-defined prevent unauthorized disclosure of information; detect changes to information] during transmission",
          "parameter": "prevent unauthorized disclosure of information and detect changes to information",
          "guidance": "Requirement: Please ensure SSP Section 10.3 Cryptographic Modules Implemented for Data At Rest (DAR) and Data In Transit (DIT) is fully populated for reference in this control.\n\nGuidance:\nSee M-22-09, including \"Agencies encrypt all DNS requests and HTTP traffic within their environment\"\n\nSC-8 (1) applies when encryption has been selected as the method to protect confidentiality and integrity. Otherwise refer to SC-8 (5). SC-8 (1) is strongly encouraged.\n\nGuidance: Note that this enhancement requires the use of cryptography which must be compliant with Federal requirements and utilize FIPS validated or NSA approved cryptography (see SC-13.)\n\nGuidance: When leveraging encryption from the underlying IaaS/PaaS: While some IaaS/PaaS services provide encryption by default, many require encryption to be configured, and enabled by the customer. The CSP has the responsibility to verify encryption is properly configured.   ",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-10": {
      "name": "Network Disconnect",
      "assessment_procedures": [
        {
          "procedure_id": "SC-10",
          "objective": "Determine if the network connection associated with a communication session is terminated at the end of the session or after [organization-defined time period] of inactivity",
          "parameter": "no longer than ten (10) minutes for privileged sessions and no longer than fifteen (15) minutes for user sessions",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-12": {
      "name": "Cryptographic Key Establishment and Management",
      "assessment_procedures": [
        {
          "procedure_id": "SC-12",
          "objective": "Determine if cryptographic keys are established and managed when cryptography is employed within the system in accordance with [organization-defined requirements for key generation, distribution, storage, access, and destruction]",
          "parameter": "in accordance with Federal requirements",
          "guidance": "Guidance: See references in NIST 800-53 documentation.\n\nGuidance: Must meet applicable Federal Cryptographic Requirements. See References Section of control.\n\nGuidance: Wildcard certificates may be used internally within the system, but are not permitted for external customer access to the system.",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-12 (1)": {
      "name": "Availability",
      "assessment_procedures": [
        {
          "procedure_id": "SC-12(01)",
          "objective": "Determine if information availability is maintained in the event of the loss of cryptographic keys by users",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SC-13": {
      "name": "Cryptographic Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-13a",
          "objective": "Determine if [organization-defined cryptographic uses] are identified",
          "parameter": "FIPS-validated or NSA-approved cryptography",
          "guidance": "Guidance: This control applies to all use of cryptography. In addition to encryption, this includes functions such as hashing, random number generation, and key generation. Examples include the following:\n - Encryption of data\n - Decryption of data\n - Generation of one time passwords (OTPs) for MFA\n - Protocols such as TLS, SSH, and HTTPS\n\nThe requirement for FIPS 140 validation, as well as timelines for acceptance of FIPS 140-2, and 140-3 can be found at the NIST Cryptographic Module Validation Program (CMVP).\nhttps://csrc.nist.gov/projects/cryptographic-module-validation-program \n\nGuidance: For NSA-approved cryptography, the National Information Assurance Partnership (NIAP) oversees a national program to evaluate Commercial IT Products for Use in National Security Systems. The NIAP Product Compliant List can be found at the following location: https://www.niap-ccevs.org/Product/index.cfm \n\nGuidance: When leveraging encryption from underlying IaaS/PaaS: While some IaaS/PaaS provide encryption by default, many require encryption to be configured, and enabled by the customer. The CSP has the responsibility to verify encryption is properly configured. \n\nGuidance: Moving to non-FIPS CM or product is acceptable when:\n- FIPS validated version has a known vulnerability\n- Feature with vulnerability is in use\n- Non-FIPS version fixes the vulnerability\n- Non-FIPS version is submitted to NIST for FIPS validation\n- POA&M is added to track approval, and deployment when ready\n\nGuidance: At a minimum, this control applies to cryptography in use for the following controls: AU-9(3), CP-9(8), IA-2(6), IA-5(1), MP-5, SC-8(1), and SC-28(1).",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-13b",
          "objective": "Determine if [organization-defined types of cryptography] for each specified cryptographic use (defined in organization-defined) are implemented",
          "parameter": "FIPS-validated or NSA-approved cryptography",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-15": {
      "name": "Collaborative Computing Devices and Applications",
      "assessment_procedures": [
        {
          "procedure_id": "SC-15a",
          "objective": "Determine if remote activation of collaborative computing devices and applications is prohibited except [organization-defined exceptions where remote activation is to be allowed]",
          "parameter": "no exceptions for computing devices",
          "guidance": "Requirement: The information system provides disablement (instead of physical disconnect) of collaborative computing devices in a manner that supports ease of use",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-15b",
          "objective": "Determine if an explicit indication of use is provided to users physically present at the devices",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-17": {
      "name": "Public Key Infrastructure Certificates",
      "assessment_procedures": [
        {
          "procedure_id": "SC-17a",
          "objective": "Determine if public key certificates are issued under [organization-defined certificate policy], or public key certificates are obtained from an approved service provider",
          "parameter": "CSP-defined certificate policy",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-17b",
          "objective": "Determine if only approved trust anchors are included in trust stores or certificate stores managed by the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-18": {
      "name": "Mobile Code",
      "assessment_procedures": [
        {
          "procedure_id": "SC-18a.",
          "objective": "Determine if acceptable/unacceptable mobile code and mobile code technologies are defined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SC-18b.",
          "objective": "Determine if the use of mobile code is authorized, monitored and controlled within the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SC-20": {
      "name": "Secure Name/Address Resolution Service (Authoritative Source)",
      "assessment_procedures": [
        {
          "procedure_id": "SC-20a.",
          "objective": "Determine if additional data origin authentication and integrity verification artifacts are provided along with the authoritative name resolution data that the system returns in response to external name/address resolution queries",
          "parameter": NaN,
          "guidance": "Requirement: Control Description should include how DNSSEC is implemented on authoritative DNS servers to supply valid responses to external DNSSEC requests.\n \nRequirement: Authoritative DNS servers must be geolocated in accordance with SA-9 (5).\n\nGuidance: SC-20 applies to use of external authoritative DNS to access a CSO from outside the boundary.\n\nGuidance: External authoritative DNS servers may be located outside an authorized environment. Positioning these servers inside an authorized boundary is encouraged.\n\nGuidance: CSPs are recommended to self-check DNSSEC configuration through one of many available analyzers such as Sandia National Labs (https://dnsviz.net)",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-20b.[01]",
          "objective": "Determine if the means to indicate the security status of child zones (and if the child supports secure resolution services) is provided when operating as part of a distributed, hierarchical namespace",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SC-20b.[02]",
          "objective": "Determine if the means to enable verification of a chain of trust among parent and child domains when operating as part of a distributed, hierarchical namespace is provided",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-21": {
      "name": "Secure Name/Address Resolution Service (Recursive or Caching Resolver)",
      "assessment_procedures": [
        {
          "procedure_id": "SC-21",
          "objective": "Determine if data origin authentication and integrity verification is requested and performed for the name/address resolution responses that the system receives from authoritative sources",
          "parameter": NaN,
          "guidance": "Requirement: Control description should include how DNSSEC is implemented on recursive DNS servers to make DNSSEC requests when resolving DNS requests from internal components to domains external to the CSO boundary.\n- If the reply is signed, and fails DNSSEC, do not use the reply\n- If the reply is unsigned:\n   -- CSP chooses the policy to apply\n\nRequirement: Internal recursive DNS servers must be located inside an authorized environment. It is typically within the boundary, or leveraged from an underlying IaaS/PaaS.\n\nGuidance: Accepting an unsigned reply is acceptable\n\nGuidance: SC-21 applies to use of internal recursive DNS to access a domain outside the boundary by a component inside the boundary.\n- DNSSEC resolution to access a component inside the boundary is excluded.",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-22": {
      "name": "Architecture and Provisioning for Name/Address Resolution Service",
      "assessment_procedures": [
        {
          "procedure_id": "SC-22",
          "objective": "Determine if the systems that collectively provide name/address resolution services for an organization are fault-tolerant, implement internal role separation and implement external role separation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-23": {
      "name": "Session Authenticity",
      "assessment_procedures": [
        {
          "procedure_id": "SC-23",
          "objective": "Determine if the authenticity of communication sessions is protected",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-24": {
      "name": "Fail in Known State",
      "assessment_procedures": [
        {
          "procedure_id": "SC-24",
          "objective": "Determine if [organization-defined types of system failures on system components] fail to a [organization-defined known system state] while preserving [organization-defined system state information] in failure",
          "parameter": "CSP-defined types of system failures on system components; CSP-defined known system state; CSP-defined system state information",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-28": {
      "name": "Protection of Information at Rest",
      "assessment_procedures": [
        {
          "procedure_id": "SC-28",
          "objective": "Determine if the [organization-defined confidentiality; integrity of organization-defined information at rest] is/are protected",
          "parameter": "confidentiality and integrity",
          "guidance": "Guidance: The organization supports the capability to use cryptographic mechanisms to protect information at rest. \n\nGuidance: When leveraging encryption from underlying IaaS/PaaS: While some IaaS/PaaS services provide encryption by default, many require encryption to be configured, and enabled by the customer. The CSP has the responsibility to verify encryption is properly configured.  \n\nGuidance: Note that this enhancement requires the use of cryptography in accordance with SC-13.",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-28 (1)": {
      "name": "Cryptographic Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SC-28(01)",
          "objective": "Determine if cryptographic mechanisms are implemented to prevent unauthorized disclosure and modification of [organization-defined information] at rest on [organization-defined system components or media]",
          "parameter": "all information system components storing Federal data or system data that must be protected at the High or Moderate impact levels",
          "guidance": "Guidance: Organizations should select a mode of protection that is targeted towards the relevant threat scenarios. \nExamples:\nA. Organizations may apply full disk encryption (FDE) to a mobile device where the primary threat is loss of the device while storage is locked. \nB. For a database application housing data for a single customer, encryption at the file system level would often provide more protection than FDE against the more likely threat of an intruder on the operating system accessing the storage.\nC. For a database application housing data for multiple customers, encryption with unique keys for each customer at the database record level may be more appropriate.",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-39": {
      "name": "Process Isolation",
      "assessment_procedures": [
        {
          "procedure_id": "SC-39",
          "objective": "Determine if a separate execution domain is maintained for each executing system process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-45": {
      "name": "System Time Synchronization",
      "assessment_procedures": [
        {
          "procedure_id": "SC-45",
          "objective": "Determine if system clocks are synchronized within and between systems and system components",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SC-45 (1)": {
      "name": "Synchronization with Authoritative Time Source",
      "assessment_procedures": [
        {
          "procedure_id": "SC-45(01)(a)",
          "objective": "Determine if the internal system clocks are compared [organization-defined frequency] with [organization-defined authoritative time source]",
          "parameter": "at least hourly; http://tf.nist.gov/tf-cgi/servers.cgi",
          "guidance": "Requirement: The service provider selects primary and secondary time servers used by the NIST Internet time service. The secondary server is selected from a different geographic region than the primary server.\n\n",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SC-45(01)(b)",
          "objective": "Determine if the internal system clocks are synchronized with the authoritative time source when the time difference is greater than [organization-defined time period]",
          "parameter": "any difference",
          "guidance": "Requirement: The service provider synchronizes the system clocks of network computers that run operating systems other than Windows to the Windows Server Domain Controller emulator or to the same time source for that server.\n\nGuidance: Synchronization of system clocks improves the accuracy of log analysis.",
          "test_method": "Test"
        }
      ]
    }
  },
  "SI": {
    "SI-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "SI-01a.[01][02]",
          "objective": "Determine if a system and information integrity policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-01a.[03][04]",
          "objective": "Determine if system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SI-01a.01(a)",
          "objective": "Determine if the [organization-defined level] system and information integrity policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SI-01a.01(b)",
          "objective": "Determine if the system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SI-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-01c.01",
          "objective": "Determine if the current system and information integrity policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-01c.02",
          "objective": "Determine if the current system and information integrity procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-2": {
      "name": "Flaw Remediation",
      "assessment_procedures": [
        {
          "procedure_id": "SI-02a.",
          "objective": "Determine if system flaws are identified, reported and corrected",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-02b.",
          "objective": "Determine if software and firmware updates related to flaw remediation are tested for effectiveness and potential side effects before installation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-02c.",
          "objective": "Determine if security-relevant software and firmware updates are installed within [organization-defined time period] of the release of the updates",
          "parameter": "within thirty (30) days of release of updates",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-02d.",
          "objective": "Determine if flaw remediation is incorporated into the organizational configuration management process",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-2 (2)": {
      "name": "Automated Flaw Remediation Status",
      "assessment_procedures": [
        {
          "procedure_id": "SI-02(02)",
          "objective": "Determine if system components have applicable security-relevant software and firmware updates installed [organization-defined frequency] using [organization-defined automated mechanisms]",
          "parameter": "at least monthly",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-2 (3)": {
      "name": "Time to Remediate Flaws and Benchmarks for Corrective Actions",
      "assessment_procedures": [
        {
          "procedure_id": "SI-02(03)(a)",
          "objective": "Determine if the time between flaw identification and flaw remediation is measured",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-02(03)(b)",
          "objective": "Determine if [organization-defined benchmarks] for taking corrective actions have been established",
          "parameter": "CSP-defined benchmarks",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-3": {
      "name": "Malicious Code Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SI-03a.",
          "objective": "Determine if [signature based; non-signature-based] malicious code protection mechanisms are implemented at system entry and exit points to detect and eradicate malicious code",
          "parameter": "signature based and non-signature-based",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-03b.",
          "objective": "Determine if malicious code protection mechanisms are updated automatically as new releases are available in accordance with organizational configuration management policy and procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-03c.01[01]",
          "objective": "Determine if malicious code protection mechanisms are configured to perform periodic scans of the system [organization-defined frequency]",
          "parameter": "at least weekly",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-03c.01[02]",
          "objective": "Determine if malicious code protection mechanisms are configured to perform real-time scans of files from external sources at [organization-defined endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy",
          "parameter": "to include endpoints and network entry and exit points",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-03c.02[01] ",
          "objective": "Determine if malicious code protection mechanisms are configured to [Selection: block malicious code; quarantine malicious code; take action to be taken in response to malicious code detection] in response to malicious code detection",
          "parameter": "to include blocking and quarantining malicious code and alerting administrators or defined security personnel near-real-time",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-03c.02[02]",
          "objective": "Determine if malicious code protection mechanisms are configured to send alerts to [organization-defined personnel or roles] in response to malicious code detection",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-03d.",
          "objective": "Determine if the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system are addressed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SI-4": {
      "name": "System Monitoring",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04a.01",
          "objective": "Determine if the system is monitored to detect attacks and indicators of potential attacks in accordance with [organization-defined monitoring objectives]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance: See US-CERT Incident Response Reporting Guidelines",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-04a.02",
          "objective": "Determine if the system is monitored to detect unauthorized local, network and remote connections",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-04b",
          "objective": "Determine if unauthorized use of the system is identified through [organization-defined techniques and methods]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance: See US-CERT Incident Response Reporting Guidelines",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-04c.01",
          "objective": "Determine if internal monitoring capabilities are invoked or monitoring devices are deployed strategically within the system to collect organization-determined essential information",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-04c.02",
          "objective": "Determine if internal monitoring capabilities are invoked or monitoring devices are deployed at ad hoc locations within the system to track specific types of transactions of interest to the organization",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-04d.",
          "objective": "Determine if detected events and anomalies are analyzed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-04e",
          "objective": "Determine if the level of system monitoring activity is adjusted when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-04f",
          "objective": "Determine if a legal opinion regarding system monitoring activities is obtained",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-04g",
          "objective": "Determine if [organization-defined system monitoring information] is provided to [organization-defined\npersonnel or roles] [organization-defined as needed;\norganization-defined frequency]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Guidance: See US-CERT Incident Response Reporting Guidelines",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (1)": {
      "name": "System-wide Intrusion Detection System",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(01)[01][02]",
          "objective": "Determine if individual intrusion detection tools are connected and configured to a system-wide intrusion detection system;",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (2)": {
      "name": "Automated Tools and Mechanisms for Real-time Analysis",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(02)",
          "objective": "Determine if automated tools and mechanisms are employed to support a near real-time analysis of events",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (4)": {
      "name": "Inbound and Outbound Communications Traffic",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(04)(a)",
          "objective": "Determine if criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic are defined",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-04(04)(b)",
          "objective": "Determine if inbound and outbound communications traffic is monitored [organization-defined frequency] for [organization-defined unusual or unauthorized activities or conditions]",
          "parameter": "continuously; CSP-defined unusual or unauthorized activities or conditions",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (5)": {
      "name": "System-Generated Alerts",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(05)",
          "objective": "Determine if [organization-defined personnel or roles] are alerted when system-generated [organization-defined compromise indicators] occur",
          "parameter": "CSP-defined personnel or roles; CSP-defined compromise indicators",
          "guidance": "Guidance: In accordance with the incident response plan",
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (10)": {
      "name": "Visibility of Encrypted Communications",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(10)",
          "objective": "Determine if provisions are made so that [organization-defined encrypted communications traffic] is visible to [organization-defined system monitoring tools and mechanisms]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: The service provider must support Agency requirements to comply with M-21-31 (https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf) and M-22-09 (https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf).",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (11)": {
      "name": "Analyze Communications Traffic Anomalies",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(11)",
          "objective": "Determine if outbound communications traffic at the external interfaces and [organization-defined interior points] to the system is analyzed to discover anomalies",
          "parameter": "CSP-defined interior points",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (12)": {
      "name": "Automated Organization-generated Alerts",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(12)",
          "objective": "Determine if [organization-defined personnel or roles] is/are alerted using [organization-defined automated mechanisms] when [organization-defined activities that trigger alerts] indicate inappropriate or unusual activities with security or privacy implications",
          "parameter": "CSP-defined personnel or roles; CSP-defined automated mechanisms; CSP-defined activities that trigger alerts",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (14)": {
      "name": "Wireless Intrusion Detection",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(14)",
          "objective": "Determine if a wireless intrusion detection system is employed to identify rogue wireless devices, detect attack attempts and detect potential compromises or breaches to the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (16)": {
      "name": "Correlate Monitoring Information",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(16)",
          "objective": "Determine if information from monitoring tools and mechanisms employed throughout the system is correlated",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (18)": {
      "name": "Analyze Traffic and Covert Exfiltration",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(18)",
          "objective": "Determine if outbound communications traffic is analyzed at interfaces external to the system and [organization-defined interior points] to detect covert exfiltration of information",
          "parameter": "CSP-defined interior points",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (19)": {
      "name": "Risk for Individuals",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(19)",
          "objective": "Determine if [organization-defined additional monitoring] is implemented on individuals who have been identified by [organization-defined sources] as posing an increased level of risk",
          "parameter": "CSP-defined additional monitoring; CSP-defined sources",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-4 (20)": {
      "name": "Privileged Users",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(20)",
          "objective": "Determine if [organization-defined additional monitoring] of privileged users is implemented",
          "parameter": "CSP-defined additional monitoring",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-4 (22)": {
      "name": "Unauthorized Network Services",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(22)(a)",
          "objective": "Determine if network services that have not been authorized or approved by [organization-defined authorization or approval processes] are detected",
          "parameter": "CSP-defined authorization or approval processes",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-04(22)(b)",
          "objective": "Determine if [organization-defined audit; alert\norganization-defined personnel or roles] is/are initiated when network services that have not been authorized or approved by authorization or approval processes are detected",
          "parameter": "CSP-defined audit or alert of CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SI-4 (23)": {
      "name": "Host-Based Devices",
      "assessment_procedures": [
        {
          "procedure_id": "SI-04(23)",
          "objective": "Determine if [organization-defined host-based monitoring mechanisms] are implemented on [organization-defined system components]",
          "parameter": "CSP-defined host-based monitoring mechanisms; CSP-defined system components",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-5": {
      "name": "Security Alerts, Advisories, and Directives",
      "assessment_procedures": [
        {
          "procedure_id": "SI-05a",
          "objective": "Determine if system security alerts, advisories, and directives are received from [organization-defined external organizations] on an ongoing basis",
          "parameter": "to include US-CERT and Cybersecurity and Infrastructure Security Agency (CISA) Directives",
          "guidance": "Requirement: Service Providers must address the CISA Emergency and Binding Operational Directives applicable to their cloud service offering per FedRAMP guidance.  This includes listing the applicable directives and stating compliance status",
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-05b.",
          "objective": "Determine if internal security alerts, advisories, and directives are generated as deemed necessary",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-05c",
          "objective": "Determine if security alerts, advisories, and directives are disseminated to [organization-defined [organization-defined personnel or roles]; [organization-defined elements]; [organization-defined external organizations]",
          "parameter": "to include system security personnel and administrators with configuration/patch-management responsibilities",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        },
        {
          "procedure_id": "SI-05d",
          "objective": "Determine if security directives are implemented in accordance with established time frames or if the issuing organization is notified of the degree of noncompliance",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SI-5 (1)": {
      "name": "Automated Alerts and Advisories",
      "assessment_procedures": [
        {
          "procedure_id": "SI-05(01)",
          "objective": "Determine if [organization-defined automated mechanisms] are used to broadcast security alert and advisory information throughout the organization",
          "parameter": "CSP-defined automated mechanisms",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-6": {
      "name": "Security and Privacy Function Verification",
      "assessment_procedures": [
        {
          "procedure_id": "SI-06a.",
          "objective": "Determine if [organization-defined security and privacy functions] are verified to be operating correctly",
          "parameter": "CSP-defined security and privacy functions",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-06b.",
          "objective": "Determine if [organization-defined security and privacy functions] are verified [organization-defined system transitional states]; upon command by user with appropriate privilege; [organization-defined frequency]",
          "parameter": "to include upon system startup and/or restart; at least monthly",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-06c.",
          "objective": "Determine if [organization-defined personnel or roles] is/are alerted to failed security and privacy verification tests",
          "parameter": "to include system administrators and security personnel",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SI-06d.",
          "objective": "Determine if [organization-defined shut the\nsystem down; restart the system; [organization-defined alternative action(s)] is/are initiated when anomalies are discovered",
          "parameter": "CSP-defined shut down or restart the system; CSP-defined alternative action",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-7": {
      "name": "Software, Firmware, and Information Integrity",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07a.",
          "objective": "Determine if integrity verification tools are employed to detect unauthorized changes to [organization-defined software, firmware and information]",
          "parameter": "CSP-defined software, firmware, and information",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-07b.",
          "objective": "Determine if [organization-defined actions] are taken when unauthorized changes to the software, firmware and information, are detected",
          "parameter": "CSP-defined actions",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SI-7 (1)": {
      "name": "Integrity Checks",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07(01)",
          "objective": "Determine if an integrity check of [organization-defined software, firmware and information] is performed [Selection: at startup; at [organization-defined transitional states or security-relevant events]; [organization-defined frequency]]",
          "parameter": "CSP-defined software, firmware, and information; selection to include security relevant events; at least monthly",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-7 (2)": {
      "name": "Automated Notifications of Integrity Violations",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07(02)",
          "objective": "Determine if automated tools that provide notification to [organization-defined personnel or roles] upon discovering discrepancies during integrity verification are employed",
          "parameter": "to include the ISSO and/or similar roles within the organization",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-7 (5)": {
      "name": "Automated Response to Integrity Violations",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07(05)",
          "objective": "Determine if [organization-defined shut down the\nsystem; restart the system; implement organization-defined controls] are automatically performed when integrity violations are discovered",
          "parameter": "CSP-defined selection: shut down the system; restart the system; implement CSP-defined controls",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SI-7 (7)": {
      "name": "Integration of Detection and Response",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07(07)",
          "objective": "Determine if the detection of [organization-defined security-relevant changes to the system] are incorporated into the organizational incident response capability",
          "parameter": "CSP-defined changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-7 (15)": {
      "name": "Code Authentication",
      "assessment_procedures": [
        {
          "procedure_id": "SI-07(15)",
          "objective": "Determine if cryptographic mechanisms are implemented to authenticate [organization-defined software or firmware components] prior to installation",
          "parameter": "to include all software and firmware inside the boundary",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-8": {
      "name": "Spam Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SI-08a.",
          "objective": "Determine if spam protection mechanisms are employed at system entry and exit points to detect and act on unsolicited messages",
          "parameter": NaN,
          "guidance": "Guidance: When CSO sends email on behalf of the government as part of the business offering, Control Description should include implementation of Domain-based Message Authentication, Reporting & Conformance (DMARC) on the sending domain for outgoing messages as described in DHS Binding Operational Directive (BOD) 18-01.\nhttps://cyber.dhs.gov/bod/18-01/ \n\nGuidance: CSPs should confirm DMARC configuration (where appropriate) to ensure that policy=reject and the parameter includes reports@dmarc.cyber.dhs.gov.  DMARC compliance should be documented in the SI-08 control implementation solution description, and list the FROM: domain(s) that will be seen by email recipients.",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SI-08b",
          "objective": "Determine if spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-8 (2)": {
      "name": "Automatic Updates",
      "assessment_procedures": [
        {
          "procedure_id": "SI-08(02)",
          "objective": "Determine if spam protection mechanisms are automatically updated [organization-defined frequency]",
          "parameter": "CSP-defined frequency",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SI-10": {
      "name": "Information Input Validation",
      "assessment_procedures": [
        {
          "procedure_id": "SI-10",
          "objective": "Determine if the validity of the [organization-defined information inputs] is checked",
          "parameter": "CSP-defined information inputs",
          "guidance": "Requirement: Validate all information inputs and document any exceptions",
          "test_method": "Test"
        }
      ]
    },
    "SI-11": {
      "name": "Error Handling",
      "assessment_procedures": [
        {
          "procedure_id": "SI-11a",
          "objective": "Determine if error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Test"
        },
        {
          "procedure_id": "SI-11b",
          "objective": "Determine if error messages are revealed only to [organization-defined personnel or roles]",
          "parameter": "to include the ISSO and/or similar role within the organization",
          "guidance": NaN,
          "test_method": "Test"
        }
      ]
    },
    "SI-12": {
      "name": "Information Management and Retention",
      "assessment_procedures": [
        {
          "procedure_id": "SI-12",
          "objective": "Determine if information within the system and information output from the system is managed and retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SI-16": {
      "name": "Memory Protection",
      "assessment_procedures": [
        {
          "procedure_id": "SI-16",
          "objective": "Determine if [organization-defined controls] are implemented to protect the system memory from unauthorized code execution",
          "parameter": "CSP-defined controls",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    }
  },
  "SR": {
    "SR-1": {
      "name": "Policy and Procedures",
      "assessment_procedures": [
        {
          "procedure_id": "SR-01a.[01][02]",
          "objective": "Determine if a supply chain risk management policy is developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles, to include chief privacy and ISSO and/or similar role or designees",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-01a.[03][04]",
          "objective": "Determine if supply chain risk management procedures to facilitate the implementation of the supply chain risk management policy and associated supply chain risk management controls are developed, documented and disseminated to [organization-defined personnel or roles]",
          "parameter": "CSP-defined personnel or roles, to include chief privacy and ISSO and/or similar role or designees",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SR-01a.01(a)",
          "objective": "Determine if the [organization-defined level] supply chain risk management policy addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance",
          "parameter": "organizational-level, mission/business process-level, or system-level",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SR-01a.01(b)",
          "objective": "Determine if the supply chain risk management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SR-01b.",
          "objective": "Determine if the [organization-defined official] is designated to manage the development, documentation, and dissemination of the supply chain risk management policy and procedures",
          "parameter": "CSP-defined official",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-01c.01",
          "objective": "Determine if the current supply chain risk management policy is reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-01c.02",
          "objective": "Determine if the current supply chain risk management procedures are reviewed and updated [in accordance with the organization-defined frequency] and after [organization-defined events]",
          "parameter": "at least annually; significant changes",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-2": {
      "name": "Supply Chain Risk Management Plan",
      "assessment_procedures": [
        {
          "procedure_id": "SR-02a.[01]",
          "objective": "Determine if a plan for managing supply chain risks is developed",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-02a.[02][03][04][05][06][07][08][09]",
          "objective": "Determine if the supply chain risk management plan addresses risks associated with the research, development, design, manufacturing, acquisition, delivery, integration, operation and disposal of [organization-defined systems, system components, or system services]",
          "parameter": "CSP-defined systems, system components, or system services",
          "guidance": NaN,
          "test_method": "Examine"
        },
        {
          "procedure_id": "SR-02b.",
          "objective": "Determine if the supply chain risk management plan is reviewed and updated [organization-defined frequency] or as required to address threat, organizational, or environmental changes",
          "parameter": "at least annually",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-02c.",
          "objective": "Determine if the supply chain risk management plan is protected from unauthorized disclosure and modification",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SR-2 (1)": {
      "name": "Establish SCRM Team",
      "assessment_procedures": [
        {
          "procedure_id": "SR-02(01)",
          "objective": "Determine if a supply chain risk management team consisting of [organization-defined personnel, roles and responsibilities] is established to lead and support [organization-defined supply chain risk management activities]",
          "parameter": "CSP-defined personnel, roles, and responsibilities; CSP-defined supply chain risk management activities",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-3": {
      "name": "Supply Chain Controls and Processes",
      "assessment_procedures": [
        {
          "procedure_id": "SR-03a.[01]",
          "objective": "Determine if a process or processes is/are established to identify and address weaknesses or deficiencies in the supply chain elements and processes of [organization-defined system or system component]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: CSOs must document and maintain the supply chain custody, including replacement devices, to ensure the integrity of the devices before being introduced to the boundary",
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-03a.[02]",
          "objective": "Determine if the process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [organization-defined system or system component] is/are coordinated with [organization-defined supply chain personnel]",
          "parameter": "CSP-defined system or system component; CSP-defined supply chain personnel",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-03b.",
          "objective": "Determine if [organization-defined supply chain controls] are employed to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events",
          "parameter": "CSP-defined supply chain controls",
          "guidance": NaN,
          "test_method": "Interview, Test"
        },
        {
          "procedure_id": "SR-03c.",
          "objective": "Determine if the selected and implemented supply chain processes and controls are documented in [Selection: security and privacy plans; supply chain risk management plan; organization-defined document identifying the selected and implemented supply chain processes and controls]",
          "parameter": "CSP-defined security and privacy plans,  supply chain risk management plan, CSP-defined document identifying the selected and implemented supply chain processes and controls",
          "guidance": NaN,
          "test_method": "Interview, Test"
        }
      ]
    },
    "SR-5": {
      "name": "Acquisition Strategies, Tools, and Methods",
      "assessment_procedures": [
        {
          "procedure_id": "SR-05",
          "objective": "Determine if [organization-defined acquisition strategies, contract tools, and procurement methods] are employed to protect, identify and mitigate against supply chain risks",
          "parameter": "CSP-defined strategies, tools, and methods",
          "guidance": NaN,
          "test_method": "Examine, Interview, Test"
        }
      ]
    },
    "SR-6": {
      "name": "Supplier Assessments and Reviews",
      "assessment_procedures": [
        {
          "procedure_id": "SR-06",
          "objective": "Determine if the supply chain-related risks associated with suppliers or contractors and the systems, system components, or system services they provide are assessed and reviewed [organization-defined frequency]",
          "parameter": "at least annually",
          "guidance": "Requirement: CSOs must ensure that their supply chain vendors build and test their systems in alignment with NIST SP 800-171 or a commensurate security and compliance framework. CSOs must ensure that vendors are compliant with physical facility access and logical access controls to supplied products.  ",
          "test_method": "Interview, Test"
        }
      ]
    },
    "SR-8": {
      "name": "Notification Agreements",
      "assessment_procedures": [
        {
          "procedure_id": "SR-08",
          "objective": "Determine if agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Selection: notification of supply chain compromises; results of assessments or audits; organization-defined information]",
          "parameter": "notification of supply chain compromises and results of assessment or audits",
          "guidance": "Requirement: CSOs must ensure and document how they receive notifications from their supply chain vendor of newly discovered vulnerabilities including zero-day vulnerabilities.",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-9": {
      "name": "Tamper Resistance and Detection",
      "assessment_procedures": [
        {
          "procedure_id": "SR-09",
          "objective": "Determine if a tamper protection program is implemented for the system, system component, or system service",
          "parameter": NaN,
          "guidance": "Requirement: CSOs must ensure vendors provide authenticity of software and patches supplied to the service provider including documenting the safeguards in place. ",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-9 (1)": {
      "name": "Multiple Stages of System Development Life Cycle",
      "assessment_procedures": [
        {
          "procedure_id": "SR-09(01)",
          "objective": "Determine if anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-10": {
      "name": "Inspection of Systems or Components",
      "assessment_procedures": [
        {
          "procedure_id": "SR-10",
          "objective": "Determine if [organization-defined systems or system components] are inspected [at random; at [organization-defined frequency]; upon [organization-defined indications of need for inspection] to detect tampering",
          "parameter": "CSP-defined systems or system components] are inspected [at random; at [organization-defined frequency]; upon [organization-defined indications of need for inspection",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-11": {
      "name": "Component Authenticity",
      "assessment_procedures": [
        {
          "procedure_id": "SR-11a.[01][02]",
          "objective": "Determine if anti-counterfeit policy and anti-counterfeit procedures are developed and implemented",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-11a.[03][04]",
          "objective": "Determine if the anti-counterfeit procedures include the means to detect and prevent counterfeit components entering the system",
          "parameter": NaN,
          "guidance": NaN,
          "test_method": "Examine, Interview"
        },
        {
          "procedure_id": "SR-11b",
          "objective": "Determine if counterfeit system components are reported to [organization-defined source of counterfeit component, external reporting organizations, personnel or roles]",
          "parameter": "see Additional FedRAMP Requirements / Guidance",
          "guidance": "Requirement: CSOs must ensure that their supply chain vendors provide authenticity of software and patches and the vendor must have a plan to protect the development pipeline. ",
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-11 (1)": {
      "name": "Anti-Counterfeit Training",
      "assessment_procedures": [
        {
          "procedure_id": "SR-11(01)",
          "objective": "Determine if [organization-defined personnel or roles] are trained to detect counterfeit system components (including hardware, software, and firmware).",
          "parameter": "CSP-defined personnel or roles",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-11 (2)": {
      "name": "Configuration Control for Component Service and Repair",
      "assessment_procedures": [
        {
          "procedure_id": "SR-11(02)",
          "objective": "Determine if configuration control over [organization-defined system components] awaiting service or repair and configuration control over serviced or repaired [organization-defined system components] awaiting return to service is maintained",
          "parameter": "all system components",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    },
    "SR-12": {
      "name": "Component Disposal",
      "assessment_procedures": [
        {
          "procedure_id": "SR-12",
          "objective": "Determine if [organization-defined data, documentation, tools, or system component] are disposed of using [organization-defined techniques and methods]",
          "parameter": "CSP-defined data, documentation, tools, or system component; CSP-defined techniques and methods",
          "guidance": NaN,
          "test_method": "Examine, Interview"
        }
      ]
    }
  }
}