From b867720c5db937490d7e0e140e474392fc50c5a0 Mon Sep 17 00:00:00 2001 From: jpower432 Date: Mon, 26 Feb 2024 14:32:31 +0000 Subject: [PATCH] adds profile test_profile --- markdown/profiles/example/ac/ac-1.md | 32 ++- markdown/profiles/example/ac/ac-2.md | 32 ++- markdown/profiles/example/ac/ac-4.4.md | 32 ++- markdown/profiles/example/sc/sc-1.md | 32 ++- .../fedramp_rev5_iaas_high/ac/ac-1.md | 32 ++- .../fedramp_rev5_iaas_high/ac/ac-2.md | 32 ++- .../fedramp_rev5_iaas_high/ac/ac-3.md | 2 +- .../fedramp_rev5_iaas_high/ac/ac-4.md | 32 ++- .../fedramp_rev5_iaas_high/ac/ac-6.md | 2 +- .../fedramp_rev5_iaas_high/au/au-2.md | 33 ++- .../fedramp_rev5_iaas_high/au/au-3.md | 2 +- .../fedramp_rev5_iaas_high/cm/cm-6.md | 33 ++- .../fedramp_rev5_iaas_high/cm/cm-7.md | 32 ++- .../fedramp_rev5_iaas_high/cm/cm-8.md | 32 ++- .../fedramp_rev5_iaas_high/ia/ia-2.md | 3 +- .../fedramp_rev5_iaas_high/ia/ia-3.md | 32 ++- .../fedramp_rev5_iaas_high/ia/ia-4.md | 32 ++- .../fedramp_rev5_iaas_high/sc/sc-5.md | 32 ++- .../fedramp_rev5_iaas_high/sc/sc-7.md | 33 ++- .../fedramp_rev5_iaas_high/sc/sc-8.md | 34 ++- .../fedramp_rev5_iaas_high/si/si-2.md | 32 ++- .../fedramp_rev5_iaas_high/si/si-3.md | 32 ++- .../fedramp_rev5_iaas_high/si/si-4.md | 33 ++- .../fedramp_rev5_paas_high/ac/ac-1.md | 32 ++- .../fedramp_rev5_paas_high/ac/ac-2.md | 32 ++- .../fedramp_rev5_paas_high/ac/ac-3.md | 2 +- .../fedramp_rev5_paas_high/ac/ac-4.md | 32 ++- .../fedramp_rev5_paas_high/ac/ac-6.md | 2 +- .../fedramp_rev5_paas_high/au/au-2.md | 33 ++- .../fedramp_rev5_paas_high/au/au-3.md | 2 +- .../fedramp_rev5_paas_high/cm/cm-6.md | 33 ++- .../fedramp_rev5_paas_high/cm/cm-7.md | 32 ++- .../fedramp_rev5_paas_high/cm/cm-8.md | 32 ++- .../fedramp_rev5_paas_high/ia/ia-2.md | 3 +- .../fedramp_rev5_paas_high/ia/ia-3.md | 32 ++- .../fedramp_rev5_paas_high/ia/ia-4.md | 32 ++- .../fedramp_rev5_paas_high/sa/sa-10.md | 32 ++- .../fedramp_rev5_paas_high/sa/sa-11.md | 32 ++- .../fedramp_rev5_paas_high/sa/sa-4.md | 33 ++- .../fedramp_rev5_paas_high/sa/sa-5.md | 32 ++- .../fedramp_rev5_paas_high/sa/sa-8.md | 32 ++- .../fedramp_rev5_paas_high/sa/sa-9.md | 32 ++- .../fedramp_rev5_paas_high/sc/sc-5.md | 32 ++- .../fedramp_rev5_paas_high/sc/sc-7.md | 33 ++- .../fedramp_rev5_paas_high/sc/sc-8.md | 34 ++- .../fedramp_rev5_paas_high/si/si-2.md | 32 ++- .../fedramp_rev5_paas_high/si/si-3.md | 32 ++- .../fedramp_rev5_paas_high/si/si-4.md | 33 ++- .../fedramp_rev5_saas_high/ac/ac-1.md | 32 ++- .../fedramp_rev5_saas_high/ac/ac-2.md | 32 ++- .../fedramp_rev5_saas_high/ac/ac-3.md | 2 +- .../fedramp_rev5_saas_high/ac/ac-4.md | 32 ++- .../fedramp_rev5_saas_high/ac/ac-6.md | 2 +- .../fedramp_rev5_saas_high/at/at-2.md | 32 ++- .../fedramp_rev5_saas_high/at/at-3.md | 32 ++- .../fedramp_rev5_saas_high/at/at-4.md | 32 ++- .../fedramp_rev5_saas_high/au/au-2.md | 33 ++- .../fedramp_rev5_saas_high/au/au-3.md | 2 +- .../fedramp_rev5_saas_high/cm/cm-6.md | 33 ++- .../fedramp_rev5_saas_high/cm/cm-7.md | 32 ++- .../fedramp_rev5_saas_high/cm/cm-8.md | 32 ++- .../fedramp_rev5_saas_high/ia/ia-2.md | 3 +- .../fedramp_rev5_saas_high/ia/ia-3.md | 32 ++- .../fedramp_rev5_saas_high/ia/ia-4.md | 32 ++- .../fedramp_rev5_saas_high/sa/sa-10.md | 32 ++- .../fedramp_rev5_saas_high/sa/sa-11.md | 32 ++- .../fedramp_rev5_saas_high/sa/sa-4.md | 33 ++- .../fedramp_rev5_saas_high/sa/sa-5.md | 32 ++- .../fedramp_rev5_saas_high/sa/sa-8.md | 32 ++- .../fedramp_rev5_saas_high/sa/sa-9.md | 32 ++- .../fedramp_rev5_saas_high/sc/sc-5.md | 32 ++- .../fedramp_rev5_saas_high/sc/sc-7.md | 33 ++- .../fedramp_rev5_saas_high/sc/sc-8.md | 34 ++- .../fedramp_rev5_saas_high/si/si-2.md | 32 ++- .../fedramp_rev5_saas_high/si/si-3.md | 32 ++- .../fedramp_rev5_saas_high/si/si-4.md | 33 ++- markdown/profiles/test_profile/ac/ac-1.md | 153 +++++++++++++ markdown/profiles/test_profile/ac/ac-2.md | 204 ++++++++++++++++++ markdown/profiles/test_profile/ac/ac-4.4.md | 83 +++++++ markdown/profiles/test_profile/sc/sc-1.md | 153 +++++++++++++ profiles/test_profile/profile.json | 23 ++ 81 files changed, 2187 insertions(+), 524 deletions(-) create mode 100644 markdown/profiles/test_profile/ac/ac-1.md create mode 100644 markdown/profiles/test_profile/ac/ac-2.md create mode 100644 markdown/profiles/test_profile/ac/ac-4.4.md create mode 100644 markdown/profiles/test_profile/sc/sc-1.md create mode 100644 profiles/test_profile/profile.json diff --git a/markdown/profiles/example/ac/ac-1.md b/markdown/profiles/example/ac/ac-1.md index bb6050b..80bd1cb 100644 --- a/markdown/profiles/example/ac/ac-1.md +++ b/markdown/profiles/example/ac/ac-1.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-1_prm_1: values: @@ -109,4 +125,4 @@ Access control policy and procedures address the controls in the AC family that - + diff --git a/markdown/profiles/example/ac/ac-2.md b/markdown/profiles/example/ac/ac-2.md index a9f17b8..ea9fead 100644 --- a/markdown/profiles/example/ac/ac-2.md +++ b/markdown/profiles/example/ac/ac-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-02_odp.01: values: @@ -155,4 +171,4 @@ Temporary and emergency accounts are intended for short-term use. Organizations - + diff --git a/markdown/profiles/example/ac/ac-4.4.md b/markdown/profiles/example/ac/ac-4.4.md index c3677d5..c6907e3 100644 --- a/markdown/profiles/example/ac/ac-4.4.md +++ b/markdown/profiles/example/ac/ac-4.4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-04.04_odp.01: values: @@ -55,4 +71,4 @@ Flow control mechanisms include content checking, security policy filters, and d - + diff --git a/markdown/profiles/example/sc/sc-1.md b/markdown/profiles/example/sc/sc-1.md index ce37ef3..7c381d7 100644 --- a/markdown/profiles/example/sc/sc-1.md +++ b/markdown/profiles/example/sc/sc-1.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-1_prm_1: values: @@ -109,4 +125,4 @@ System and communications protection policy and procedures address the controls - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-1.md b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-1.md index a9eb930..5a277bc 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-1.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-1.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-1_prm_1: values: @@ -109,4 +125,4 @@ Access control policy and procedures address the controls in the AC family that - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-2.md b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-2.md index 4512b40..f813315 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-2.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-02_odp.01: values: @@ -155,4 +171,4 @@ Temporary and emergency accounts are intended for short-term use. Organizations - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-3.md b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-3.md index c0105f3..2bb7047 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-3.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-3.md @@ -34,4 +34,4 @@ Access control policies control access between active entities or subjects (i.e. - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-4.md b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-4.md index b09f8bd..806dc15 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-4.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-04_odp: values: @@ -49,4 +65,4 @@ Organizations commonly employ information flow control policies and enforcement - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-6.md b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-6.md index fbbd174..491666d 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-6.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ac/ac-6.md @@ -34,4 +34,4 @@ Organizations employ least privilege for specific duties and systems. The princi - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/au/au-2.md b/markdown/profiles/fedramp_rev5_iaas_high/au/au-2.md index c34b2cc..46e0269 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/au/au-2.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/au/au-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # au-2_prm_2: values: @@ -62,6 +78,7 @@ x-trestle-global: ## Control guidance Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO. + An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system. To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage. @@ -83,4 +100,4 @@ Event logging requirements, including the need to log specific event types, may - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/au/au-3.md b/markdown/profiles/fedramp_rev5_iaas_high/au/au-3.md index f8becf4..b88f055 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/au/au-3.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/au/au-3.md @@ -56,4 +56,4 @@ Audit record content that may be necessary to support the auditing function incl - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-6.md b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-6.md index c09bee7..3c53e72 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-6.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-6.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-06_odp.01: values: @@ -60,6 +76,7 @@ x-trestle-global: Compliance checks are used to evaluate configuration settings and provide general insight into the overall effectiveness of configuration management activities. CSPs and 3PAOs typically combine compliance check findings into a single CM-6 finding, which is acceptable. However, for initial assessments, annual assessments, and significant change requests, FedRAMP requires a clear understanding, on a per-control basis, where risks exist. Therefore, 3PAOs must also analyze compliance check findings as part of the controls assessment. Where a direct mapping exists, the 3PAO must document additional findings per control in the corresponding SAR Risk Exposure Table (RET), which are then documented in the CSP’s Plan of Action and Milestones (POA&M). This will likely result in the details of individual control findings overlapping with those in the combined CM-6 finding, which is acceptable. During monthly continuous monitoring, new findings from CSP compliance checks may be combined into a single CM-6 POA&M item. CSPs are not required to map the findings to specific controls because controls are only assessed during initial assessments, annual assessments, and significant change requests. + Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. @@ -81,4 +98,4 @@ Implementation of a common secure configuration may be mandated at the organizat - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-7.md b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-7.md index 7d6e59d..7f150ce 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-7.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-7_prm_2: values: @@ -73,4 +89,4 @@ Systems provide a wide variety of functions and services. Some of the functions - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-8.md b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-8.md index 791d85a..6d75694 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-8.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/cm/cm-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-08_odp.01: values: @@ -71,4 +87,4 @@ Preventing duplicate accounting of system components addresses the lack of accou - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-2.md b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-2.md index 48d5f7f..fd25033 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-2.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-2.md @@ -26,6 +26,7 @@ Uniquely identify and authenticate organizational users and associate that uniqu ## Control guidance \"Phishing-resistant\" authentication refers to authentication processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. + Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks. @@ -47,4 +48,4 @@ The use of encrypted virtual private networks for network connections between or - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-3.md b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-3.md index c56dea0..53931a1 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-3.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-03_odp.01: values: @@ -49,4 +65,4 @@ Devices that require unique device-to-device identification and authentication a - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-4.md b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-4.md index f30dace..6aaf043 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-4.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/ia/ia-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-04_odp.01: values: @@ -63,4 +79,4 @@ Common device identifiers include Media Access Control (MAC) addresses, Internet - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-5.md b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-5.md index 87238db..fee33b1 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-5.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-5.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-05_odp.01: values: @@ -55,4 +71,4 @@ Denial-of-service events may occur due to a variety of internal and external cau - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-7.md b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-7.md index a0b3342..8cb4507 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-7.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-07_odp: values: @@ -46,6 +62,7 @@ x-trestle-global: ## Control guidance SC-7 (b) should be met by subnet isolation. A subnetwork (subnet) is a physically or logically segmented section of a larger network defined at TCP/IP Layer 3, to both minimize traffic and, important for a FedRAMP Authorization, add a crucial layer of network isolation. Subnets are distinct from VLANs (Layer 2), security groups, and VPCs and are specifically required to satisfy SC-7 part b and other controls. See the FedRAMP Subnets White Paper (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf) for additional information. + Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary). # Editable Content @@ -63,4 +80,4 @@ Managed interfaces include gateways, routers, firewalls, guards, network-based m - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-8.md b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-8.md index b30447a..c6876eb 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-8.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/sc/sc-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-08_odp: values: @@ -56,6 +72,7 @@ FedRAMP-Defined Assignment / Selection Parameters SC-8 (5)-1 [a hardened or alarmed carrier Protective Distribution System (PDS) when outside of Controlled Access Area (CAA)] SC-8 (5)-2 [prevent unauthorized disclosure of information AND detect changes to information] + SC-8 (5) applies when physical protection has been selected as the method to protect confidentiality and integrity. For physical protection, data in transit must be in either a Controlled Access Area (CAA), or a Hardened or alarmed PDS. @@ -81,6 +98,7 @@ https://www.dcsa.mil/Portals/91/documents/ctp/nao/CNSSI_7003_PDS_September_2015. DHS Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies can be accessed here: https://us-cert.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_Defense_in_Depth_Strategies_S508C.pdf + Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls. @@ -100,4 +118,4 @@ Organizations that rely on commercial providers who offer transmission services - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/si/si-2.md b/markdown/profiles/fedramp_rev5_iaas_high/si/si-2.md index 61acf5e..25650da 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/si/si-2.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/si/si-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-02_odp: values: @@ -73,4 +89,4 @@ Organization-defined time periods for updating security-relevant software and fi - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/si/si-3.md b/markdown/profiles/fedramp_rev5_iaas_high/si/si-3.md index 727f9c3..b660f69 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/si/si-3.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/si/si-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-03_odp.01: values: @@ -89,4 +105,4 @@ In situations where malicious code cannot be detected by detection methods or te - + diff --git a/markdown/profiles/fedramp_rev5_iaas_high/si/si-4.md b/markdown/profiles/fedramp_rev5_iaas_high/si/si-4.md index c37a5a1..3ba0962 100644 --- a/markdown/profiles/fedramp_rev5_iaas_high/si/si-4.md +++ b/markdown/profiles/fedramp_rev5_iaas_high/si/si-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-04_odp.01: values: @@ -86,6 +102,7 @@ x-trestle-global: ## Control guidance See US-CERT Incident Response Reporting Guidelines. + System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. @@ -105,4 +122,4 @@ Depending on the security architecture, the distribution and configuration of mo - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-1.md b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-1.md index 64e13e7..f33da99 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-1.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-1.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-1_prm_1: profile-values: @@ -110,4 +126,4 @@ Access control policy and procedures address the controls in the AC family that - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-2.md b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-2.md index 6d1912c..35d222d 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-2.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-02_odp.01: values: @@ -155,4 +171,4 @@ Temporary and emergency accounts are intended for short-term use. Organizations - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-3.md b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-3.md index d57db52..82fd062 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-3.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-3.md @@ -34,4 +34,4 @@ Access control policies control access between active entities or subjects (i.e. - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-4.md b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-4.md index 5d0b13e..5eae127 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-4.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-04_odp: values: @@ -49,4 +65,4 @@ Organizations commonly employ information flow control policies and enforcement - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-6.md b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-6.md index 34ed3f0..2b9e280 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ac/ac-6.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ac/ac-6.md @@ -34,4 +34,4 @@ Organizations employ least privilege for specific duties and systems. The princi - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/au/au-2.md b/markdown/profiles/fedramp_rev5_paas_high/au/au-2.md index 09b3553..805c63d 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/au/au-2.md +++ b/markdown/profiles/fedramp_rev5_paas_high/au/au-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # au-2_prm_2: values: @@ -62,6 +78,7 @@ x-trestle-global: ## Control guidance Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO. + An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system. To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage. @@ -83,4 +100,4 @@ Event logging requirements, including the need to log specific event types, may - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/au/au-3.md b/markdown/profiles/fedramp_rev5_paas_high/au/au-3.md index 1a4dd57..430ddc7 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/au/au-3.md +++ b/markdown/profiles/fedramp_rev5_paas_high/au/au-3.md @@ -56,4 +56,4 @@ Audit record content that may be necessary to support the auditing function incl - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-6.md b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-6.md index 9527f82..41d5414 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-6.md +++ b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-6.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-06_odp.01: values: @@ -60,6 +76,7 @@ x-trestle-global: Compliance checks are used to evaluate configuration settings and provide general insight into the overall effectiveness of configuration management activities. CSPs and 3PAOs typically combine compliance check findings into a single CM-6 finding, which is acceptable. However, for initial assessments, annual assessments, and significant change requests, FedRAMP requires a clear understanding, on a per-control basis, where risks exist. Therefore, 3PAOs must also analyze compliance check findings as part of the controls assessment. Where a direct mapping exists, the 3PAO must document additional findings per control in the corresponding SAR Risk Exposure Table (RET), which are then documented in the CSP’s Plan of Action and Milestones (POA&M). This will likely result in the details of individual control findings overlapping with those in the combined CM-6 finding, which is acceptable. During monthly continuous monitoring, new findings from CSP compliance checks may be combined into a single CM-6 POA&M item. CSPs are not required to map the findings to specific controls because controls are only assessed during initial assessments, annual assessments, and significant change requests. + Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. @@ -81,4 +98,4 @@ Implementation of a common secure configuration may be mandated at the organizat - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-7.md b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-7.md index 5c2d9b3..3ca98e5 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-7.md +++ b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-7_prm_2: values: @@ -73,4 +89,4 @@ Systems provide a wide variety of functions and services. Some of the functions - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-8.md b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-8.md index ce66b40..5abc717 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/cm/cm-8.md +++ b/markdown/profiles/fedramp_rev5_paas_high/cm/cm-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-08_odp.01: values: @@ -71,4 +87,4 @@ Preventing duplicate accounting of system components addresses the lack of accou - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-2.md b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-2.md index 5cecb91..81af497 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-2.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-2.md @@ -26,6 +26,7 @@ Uniquely identify and authenticate organizational users and associate that uniqu ## Control guidance \"Phishing-resistant\" authentication refers to authentication processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. + Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks. @@ -47,4 +48,4 @@ The use of encrypted virtual private networks for network connections between or - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-3.md b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-3.md index af9de64..336ae3c 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-3.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-03_odp.01: values: @@ -49,4 +65,4 @@ Devices that require unique device-to-device identification and authentication a - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-4.md b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-4.md index a27f3f2..1aab297 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/ia/ia-4.md +++ b/markdown/profiles/fedramp_rev5_paas_high/ia/ia-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-04_odp.01: values: @@ -63,4 +79,4 @@ Common device identifiers include Media Access Control (MAC) addresses, Internet - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-10.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-10.md index 4ab8f25..4e76074 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-10.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-10.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-10_odp.01: values: @@ -87,4 +103,4 @@ The configuration items that are placed under configuration management include t - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-11.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-11.md index 0cbb2f2..d1c1052 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-11.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-11.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-11_odp.01: values: @@ -79,4 +95,4 @@ Developers can use the analysis approaches, along with security instrumentation - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-4.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-4.md index af8c9f5..41830c5 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-4.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-04_odp.01: values: @@ -92,6 +108,7 @@ Include the following requirements, descriptions, and criteria, explicitly or by The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/. + Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle. Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle. @@ -113,4 +130,4 @@ Security and privacy documentation requirements address all stages of the system - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-5.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-5.md index f3f3b55..f657fde 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-5.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-5.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-05_odp.01: values: @@ -107,4 +123,4 @@ System documentation helps personnel understand the implementation and operation - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-8.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-8.md index 83ccc92..eb2110e 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-8.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-8_prm_1: profile-values: @@ -74,4 +90,4 @@ Organizations that apply systems security and privacy engineering concepts and p - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-9.md b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-9.md index 991414f..f6b44a9 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sa/sa-9.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sa/sa-9.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-09_odp.01: values: @@ -64,4 +80,4 @@ External system services are provided by an external provider, and the organizat - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-5.md b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-5.md index 48ea9fe..a72d780 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-5.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-5.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-05_odp.01: values: @@ -55,4 +71,4 @@ Denial-of-service events may occur due to a variety of internal and external cau - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-7.md b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-7.md index 755d927..e87fc76 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-7.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-07_odp: values: @@ -46,6 +62,7 @@ x-trestle-global: ## Control guidance SC-7 (b) should be met by subnet isolation. A subnetwork (subnet) is a physically or logically segmented section of a larger network defined at TCP/IP Layer 3, to both minimize traffic and, important for a FedRAMP Authorization, add a crucial layer of network isolation. Subnets are distinct from VLANs (Layer 2), security groups, and VPCs and are specifically required to satisfy SC-7 part b and other controls. See the FedRAMP Subnets White Paper (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf) for additional information. + Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary). # Editable Content @@ -63,4 +80,4 @@ Managed interfaces include gateways, routers, firewalls, guards, network-based m - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-8.md b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-8.md index 5b420a3..8f77813 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/sc/sc-8.md +++ b/markdown/profiles/fedramp_rev5_paas_high/sc/sc-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-08_odp: values: @@ -56,6 +72,7 @@ FedRAMP-Defined Assignment / Selection Parameters SC-8 (5)-1 [a hardened or alarmed carrier Protective Distribution System (PDS) when outside of Controlled Access Area (CAA)] SC-8 (5)-2 [prevent unauthorized disclosure of information AND detect changes to information] + SC-8 (5) applies when physical protection has been selected as the method to protect confidentiality and integrity. For physical protection, data in transit must be in either a Controlled Access Area (CAA), or a Hardened or alarmed PDS. @@ -81,6 +98,7 @@ https://www.dcsa.mil/Portals/91/documents/ctp/nao/CNSSI_7003_PDS_September_2015. DHS Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies can be accessed here: https://us-cert.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_Defense_in_Depth_Strategies_S508C.pdf + Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls. @@ -100,4 +118,4 @@ Organizations that rely on commercial providers who offer transmission services - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/si/si-2.md b/markdown/profiles/fedramp_rev5_paas_high/si/si-2.md index 723cc25..e8b2ebb 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/si/si-2.md +++ b/markdown/profiles/fedramp_rev5_paas_high/si/si-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-02_odp: values: @@ -73,4 +89,4 @@ Organization-defined time periods for updating security-relevant software and fi - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/si/si-3.md b/markdown/profiles/fedramp_rev5_paas_high/si/si-3.md index 03649ff..f2c05f7 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/si/si-3.md +++ b/markdown/profiles/fedramp_rev5_paas_high/si/si-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-03_odp.01: values: @@ -89,4 +105,4 @@ In situations where malicious code cannot be detected by detection methods or te - + diff --git a/markdown/profiles/fedramp_rev5_paas_high/si/si-4.md b/markdown/profiles/fedramp_rev5_paas_high/si/si-4.md index 5e15799..a009327 100644 --- a/markdown/profiles/fedramp_rev5_paas_high/si/si-4.md +++ b/markdown/profiles/fedramp_rev5_paas_high/si/si-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-04_odp.01: values: @@ -86,6 +102,7 @@ x-trestle-global: ## Control guidance See US-CERT Incident Response Reporting Guidelines. + System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. @@ -105,4 +122,4 @@ Depending on the security architecture, the distribution and configuration of mo - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-1.md b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-1.md index 6e736e9..8a3cb18 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-1.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-1.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-1_prm_1: profile-values: @@ -110,4 +126,4 @@ Access control policy and procedures address the controls in the AC family that - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-2.md b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-2.md index fbd0176..66a5948 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-2.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-02_odp.01: values: @@ -155,4 +171,4 @@ Temporary and emergency accounts are intended for short-term use. Organizations - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-3.md b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-3.md index 00f2b50..f113e89 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-3.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-3.md @@ -34,4 +34,4 @@ Access control policies control access between active entities or subjects (i.e. - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-4.md b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-4.md index 3084f1c..0c1b137 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-4.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ac-04_odp: values: @@ -49,4 +65,4 @@ Organizations commonly employ information flow control policies and enforcement - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-6.md b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-6.md index 7d780e4..52903be 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ac/ac-6.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ac/ac-6.md @@ -34,4 +34,4 @@ Organizations employ least privilege for specific duties and systems. The princi - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/at/at-2.md b/markdown/profiles/fedramp_rev5_saas_high/at/at-2.md index 31d1f5d..dcfd56e 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/at/at-2.md +++ b/markdown/profiles/fedramp_rev5_saas_high/at/at-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # at-2_prm_1: profile-values: @@ -96,4 +112,4 @@ Awareness techniques include displaying posters, offering supplies inscribed wit - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/at/at-3.md b/markdown/profiles/fedramp_rev5_saas_high/at/at-3.md index 801a61c..6d6db76 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/at/at-3.md +++ b/markdown/profiles/fedramp_rev5_saas_high/at/at-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # at-3_prm_1: profile-values: @@ -86,4 +102,4 @@ Comprehensive role-based training addresses management, operational, and technic - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/at/at-4.md b/markdown/profiles/fedramp_rev5_saas_high/at/at-4.md index 36e0f0a..56ed489 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/at/at-4.md +++ b/markdown/profiles/fedramp_rev5_saas_high/at/at-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # at-04_odp: values: @@ -54,4 +70,4 @@ Documentation for specialized training may be maintained by individual superviso - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/au/au-2.md b/markdown/profiles/fedramp_rev5_saas_high/au/au-2.md index 1668e33..b996102 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/au/au-2.md +++ b/markdown/profiles/fedramp_rev5_saas_high/au/au-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # au-2_prm_2: values: @@ -62,6 +78,7 @@ x-trestle-global: ## Control guidance Annually or whenever changes in the threat environment are communicated to the service provider by the JAB/AO. + An event is an observable occurrence in a system. The types of events that require logging are those events that are significant and relevant to the security of systems and the privacy of individuals. Event logging also supports specific monitoring and auditing needs. Event types include password changes, failed logons or failed accesses related to systems, security or privacy attribute changes, administrative privilege usage, PIV credential usage, data action changes, query parameters, or external credential usage. In determining the set of event types that require logging, organizations consider the monitoring and auditing appropriate for each of the controls to be implemented. For completeness, event logging includes all protocols that are operational and supported by the system. To balance monitoring and auditing requirements with other system needs, event logging requires identifying the subset of event types that are logged at a given point in time. For example, organizations may determine that systems need the capability to log every file access successful and unsuccessful, but not activate that capability except for specific circumstances due to the potential burden on system performance. The types of events that organizations desire to be logged may change. Reviewing and updating the set of logged events is necessary to help ensure that the events remain relevant and continue to support the needs of the organization. Organizations consider how the types of logging events can reveal information about individuals that may give rise to privacy risk and how best to mitigate such risks. For example, there is the potential to reveal personally identifiable information in the audit trail, especially if the logging event is based on patterns or time of usage. @@ -83,4 +100,4 @@ Event logging requirements, including the need to log specific event types, may - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/au/au-3.md b/markdown/profiles/fedramp_rev5_saas_high/au/au-3.md index 55eb247..491eff5 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/au/au-3.md +++ b/markdown/profiles/fedramp_rev5_saas_high/au/au-3.md @@ -56,4 +56,4 @@ Audit record content that may be necessary to support the auditing function incl - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-6.md b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-6.md index d15b4db..5dbb918 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-6.md +++ b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-6.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-06_odp.01: values: @@ -60,6 +76,7 @@ x-trestle-global: Compliance checks are used to evaluate configuration settings and provide general insight into the overall effectiveness of configuration management activities. CSPs and 3PAOs typically combine compliance check findings into a single CM-6 finding, which is acceptable. However, for initial assessments, annual assessments, and significant change requests, FedRAMP requires a clear understanding, on a per-control basis, where risks exist. Therefore, 3PAOs must also analyze compliance check findings as part of the controls assessment. Where a direct mapping exists, the 3PAO must document additional findings per control in the corresponding SAR Risk Exposure Table (RET), which are then documented in the CSP’s Plan of Action and Milestones (POA&M). This will likely result in the details of individual control findings overlapping with those in the combined CM-6 finding, which is acceptable. During monthly continuous monitoring, new findings from CSP compliance checks may be combined into a single CM-6 POA&M item. CSPs are not required to map the findings to specific controls because controls are only assessed during initial assessments, annual assessments, and significant change requests. + Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. @@ -81,4 +98,4 @@ Implementation of a common secure configuration may be mandated at the organizat - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-7.md b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-7.md index f9c115b..7e5b41f 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-7.md +++ b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-7_prm_2: values: @@ -73,4 +89,4 @@ Systems provide a wide variety of functions and services. Some of the functions - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-8.md b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-8.md index 31c3ba4..af2f73c 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/cm/cm-8.md +++ b/markdown/profiles/fedramp_rev5_saas_high/cm/cm-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # cm-08_odp.01: values: @@ -71,4 +87,4 @@ Preventing duplicate accounting of system components addresses the lack of accou - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-2.md b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-2.md index 69b63bc..a012ccd 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-2.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-2.md @@ -26,6 +26,7 @@ Uniquely identify and authenticate organizational users and associate that uniqu ## Control guidance \"Phishing-resistant\" authentication refers to authentication processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. + Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks. @@ -47,4 +48,4 @@ The use of encrypted virtual private networks for network connections between or - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-3.md b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-3.md index 6ff49ba..ce7a6aa 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-3.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-03_odp.01: values: @@ -49,4 +65,4 @@ Devices that require unique device-to-device identification and authentication a - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-4.md b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-4.md index 72faa14..46679b4 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/ia/ia-4.md +++ b/markdown/profiles/fedramp_rev5_saas_high/ia/ia-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # ia-04_odp.01: values: @@ -63,4 +79,4 @@ Common device identifiers include Media Access Control (MAC) addresses, Internet - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-10.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-10.md index 9792021..e8e46fb 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-10.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-10.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-10_odp.01: values: @@ -87,4 +103,4 @@ The configuration items that are placed under configuration management include t - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-11.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-11.md index 4a42ab1..9d930e2 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-11.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-11.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-11_odp.01: values: @@ -79,4 +95,4 @@ Developers can use the analysis approaches, along with security instrumentation - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-4.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-4.md index d85984e..17ebcf2 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-4.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-04_odp.01: values: @@ -92,6 +108,7 @@ Include the following requirements, descriptions, and criteria, explicitly or by The use of Common Criteria (ISO/IEC 15408) evaluated products is strongly preferred. See https://www.niap-ccevs.org/Product/index.cfm or https://www.commoncriteriaportal.org/products/. + Security and privacy functional requirements are typically derived from the high-level security and privacy requirements described in [SA-2](#sa-2) . The derived requirements include security and privacy capabilities, functions, and mechanisms. Strength requirements associated with such capabilities, functions, and mechanisms include degree of correctness, completeness, resistance to tampering or bypass, and resistance to direct attack. Assurance requirements include development processes, procedures, and methodologies as well as the evidence from development and assessment activities that provide grounds for confidence that the required functionality is implemented and possesses the required strength of mechanism. [SP 800-160-1](#e3cc0520-a366-4fc9-abc2-5272db7e3564) describes the process of requirements engineering as part of the system development life cycle. Controls can be viewed as descriptions of the safeguards and protection capabilities appropriate for achieving the particular security and privacy objectives of the organization and for reflecting the security and privacy requirements of stakeholders. Controls are selected and implemented in order to satisfy system requirements and include developer and organizational responsibilities. Controls can include technical, administrative, and physical aspects. In some cases, the selection and implementation of a control may necessitate additional specification by the organization in the form of derived requirements or instantiated control parameter values. The derived requirements and control parameter values may be necessary to provide the appropriate level of implementation detail for controls within the system development life cycle. @@ -113,4 +130,4 @@ Security and privacy documentation requirements address all stages of the system - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-5.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-5.md index 7dd557b..9721bac 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-5.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-5.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-05_odp.01: values: @@ -107,4 +123,4 @@ System documentation helps personnel understand the implementation and operation - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-8.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-8.md index f332e7b..85b3ce4 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-8.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-8_prm_1: profile-values: @@ -74,4 +90,4 @@ Organizations that apply systems security and privacy engineering concepts and p - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-9.md b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-9.md index d999043..8842380 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sa/sa-9.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sa/sa-9.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sa-09_odp.01: values: @@ -64,4 +80,4 @@ External system services are provided by an external provider, and the organizat - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-5.md b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-5.md index 408d10c..0ab3e6e 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-5.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-5.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-05_odp.01: values: @@ -55,4 +71,4 @@ Denial-of-service events may occur due to a variety of internal and external cau - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-7.md b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-7.md index 97441bb..104f737 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-7.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-7.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-07_odp: values: @@ -46,6 +62,7 @@ x-trestle-global: ## Control guidance SC-7 (b) should be met by subnet isolation. A subnetwork (subnet) is a physically or logically segmented section of a larger network defined at TCP/IP Layer 3, to both minimize traffic and, important for a FedRAMP Authorization, add a crucial layer of network isolation. Subnets are distinct from VLANs (Layer 2), security groups, and VPCs and are specifically required to satisfy SC-7 part b and other controls. See the FedRAMP Subnets White Paper (https://www.fedramp.gov/assets/resources/documents/FedRAMP_subnets_white_paper.pdf) for additional information. + Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary). # Editable Content @@ -63,4 +80,4 @@ Managed interfaces include gateways, routers, firewalls, guards, network-based m - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-8.md b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-8.md index 7aec063..665e26c 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/sc/sc-8.md +++ b/markdown/profiles/fedramp_rev5_saas_high/sc/sc-8.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # sc-08_odp: values: @@ -56,6 +72,7 @@ FedRAMP-Defined Assignment / Selection Parameters SC-8 (5)-1 [a hardened or alarmed carrier Protective Distribution System (PDS) when outside of Controlled Access Area (CAA)] SC-8 (5)-2 [prevent unauthorized disclosure of information AND detect changes to information] + SC-8 (5) applies when physical protection has been selected as the method to protect confidentiality and integrity. For physical protection, data in transit must be in either a Controlled Access Area (CAA), or a Hardened or alarmed PDS. @@ -81,6 +98,7 @@ https://www.dcsa.mil/Portals/91/documents/ctp/nao/CNSSI_7003_PDS_September_2015. DHS Recommended Practice: Improving Industrial Control System Cybersecurity with Defense-in-Depth Strategies can be accessed here: https://us-cert.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_Defense_in_Depth_Strategies_S508C.pdf + Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls. @@ -100,4 +118,4 @@ Organizations that rely on commercial providers who offer transmission services - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/si/si-2.md b/markdown/profiles/fedramp_rev5_saas_high/si/si-2.md index 678fb47..d937239 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/si/si-2.md +++ b/markdown/profiles/fedramp_rev5_saas_high/si/si-2.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-02_odp: values: @@ -73,4 +89,4 @@ Organization-defined time periods for updating security-relevant software and fi - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/si/si-3.md b/markdown/profiles/fedramp_rev5_saas_high/si/si-3.md index 60f15c6..d2ec23c 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/si/si-3.md +++ b/markdown/profiles/fedramp_rev5_saas_high/si/si-3.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-03_odp.01: values: @@ -89,4 +105,4 @@ In situations where malicious code cannot be detected by detection methods or te - + diff --git a/markdown/profiles/fedramp_rev5_saas_high/si/si-4.md b/markdown/profiles/fedramp_rev5_saas_high/si/si-4.md index c010028..227132f 100644 --- a/markdown/profiles/fedramp_rev5_saas_high/si/si-4.md +++ b/markdown/profiles/fedramp_rev5_saas_high/si/si-4.md @@ -1,14 +1,30 @@ --- x-trestle-set-params: - # You may set values for parameters in the assembled Profile by adding + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. # - # profile-values: - # - value 1 - # - value 2 + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: # - # below a section of values: - # The values list refers to the values in the catalog, and the profile-values represent values - # in SetParameters of the Profile. + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE # si-04_odp.01: values: @@ -86,6 +102,7 @@ x-trestle-global: ## Control guidance See US-CERT Incident Response Reporting Guidelines. + System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at external interfaces to the system. Internal monitoring includes the observation of events occurring within the system. Organizations monitor systems by observing audit activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives guide and inform the determination of the events. System monitoring capabilities are achieved through a variety of tools and techniques, including intrusion detection and prevention systems, malicious code protection software, scanning tools, audit record monitoring software, and network monitoring software. Depending on the security architecture, the distribution and configuration of monitoring devices may impact throughput at key internal and external boundaries as well as at other locations across a network due to the introduction of network throughput latency. If throughput management is needed, such devices are strategically located and deployed as part of an established organization-wide security architecture. Strategic locations for monitoring devices include selected perimeter locations and near key servers and server farms that support critical applications. Monitoring devices are typically employed at the managed interfaces associated with controls [SC-7](#sc-7) and [AC-17](#ac-17) . The information collected is a function of the organizational monitoring objectives and the capability of systems to support such objectives. Specific types of transactions of interest include Hypertext Transfer Protocol (HTTP) traffic that bypasses HTTP proxies. System monitoring is an integral part of organizational continuous monitoring and incident response programs, and output from system monitoring serves as input to those programs. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other controls (e.g., [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-17(1)](#ac-17.1), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) ). Adjustments to levels of system monitoring are based on law enforcement information, intelligence information, or other sources of information. The legality of system monitoring activities is based on applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. @@ -105,4 +122,4 @@ Depending on the security architecture, the distribution and configuration of mo - + diff --git a/markdown/profiles/test_profile/ac/ac-1.md b/markdown/profiles/test_profile/ac/ac-1.md new file mode 100644 index 0000000..77df54a --- /dev/null +++ b/markdown/profiles/test_profile/ac/ac-1.md @@ -0,0 +1,153 @@ +--- +x-trestle-set-params: + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. + # + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: + # + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE + # + ac-1_prm_1: + aggregates: + - ac-01_odp.01 + - ac-01_odp.02 + profile-param-value-origin: + ac-01_odp.01: + profile-values: + - + profile-param-value-origin: + ac-01_odp.02: + profile-values: + - + profile-param-value-origin: + ac-01_odp.03: + alt-identifier: ac-1_prm_2 + profile-values: + - + profile-param-value-origin: + ac-01_odp.04: + alt-identifier: ac-1_prm_3 + profile-values: + - + profile-param-value-origin: + ac-01_odp.05: + alt-identifier: ac-1_prm_4 + profile-values: + - + profile-param-value-origin: + ac-01_odp.06: + alt-identifier: ac-1_prm_5 + profile-values: + - + profile-param-value-origin: + ac-01_odp.07: + alt-identifier: ac-1_prm_6 + profile-values: + - + profile-param-value-origin: + ac-01_odp.08: + alt-identifier: ac-1_prm_7 + profile-values: + - + profile-param-value-origin: +x-trestle-global: + profile: + title: REPLACE_ME + sort-id: ac-01 +--- + +# ac-1 - \[Access Control\] Policy and Procedures + +## Control Statement + +- \[a.\] Develop, document, and disseminate to {{ insert: param, ac-1_prm_1 }}: + + - \[1.\] {{ insert: param, ac-01_odp.03 }} access control policy that: + + - \[(a)\] Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and + - \[(b)\] Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and + + - \[2.\] Procedures to facilitate the implementation of the access control policy and the associated access controls; + +- \[b.\] Designate an {{ insert: param, ac-01_odp.04 }} to manage the development, documentation, and dissemination of the access control policy and procedures; and + +- \[c.\] Review and update the current access control: + + - \[1.\] Policy {{ insert: param, ac-01_odp.05 }} and following {{ insert: param, ac-01_odp.06 }} ; and + - \[2.\] Procedures {{ insert: param, ac-01_odp.07 }} and following {{ insert: param, ac-01_odp.08 }}. + +## Control Assessment Objective + +- \[AC-01a.\] + + - \[AC-01a.[01]\] an access control policy is developed and documented; + - \[AC-01a.[02]\] the access control policy is disseminated to {{ insert: param, ac-01_odp.01 }}; + - \[AC-01a.[03]\] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented; + - \[AC-01a.[04]\] the access control procedures are disseminated to {{ insert: param, ac-01_odp.02 }}; + - \[AC-01a.01\] + + - \[AC-01a.01(a)\] + + - \[AC-01a.01(a)[01]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses purpose; + - \[AC-01a.01(a)[02]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses scope; + - \[AC-01a.01(a)[03]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses roles; + - \[AC-01a.01(a)[04]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses responsibilities; + - \[AC-01a.01(a)[05]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses management commitment; + - \[AC-01a.01(a)[06]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses coordination among organizational entities; + - \[AC-01a.01(a)[07]\] the {{ insert: param, ac-01_odp.03 }} access control policy addresses compliance; + + - \[AC-01a.01(b)\] the {{ insert: param, ac-01_odp.03 }} access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; + +- \[AC-01b.\] the {{ insert: param, ac-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the access control policy and procedures; + +- \[AC-01c.\] + + - \[AC-01c.01\] + + - \[AC-01c.01[01]\] the current access control policy is reviewed and updated {{ insert: param, ac-01_odp.05 }}; + - \[AC-01c.01[02]\] the current access control policy is reviewed and updated following {{ insert: param, ac-01_odp.06 }}; + + - \[AC-01c.02\] + + - \[AC-01c.02[01]\] the current access control procedures are reviewed and updated {{ insert: param, ac-01_odp.07 }}; + - \[AC-01c.02[02]\] the current access control procedures are reviewed and updated following {{ insert: param, ac-01_odp.08 }}. + +## Control guidance + +Access control policy and procedures address the controls in the AC family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of access control policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies reflecting the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to access control policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure. + +# Editable Content + + + + + + + + + + + + + + + diff --git a/markdown/profiles/test_profile/ac/ac-2.md b/markdown/profiles/test_profile/ac/ac-2.md new file mode 100644 index 0000000..2457991 --- /dev/null +++ b/markdown/profiles/test_profile/ac/ac-2.md @@ -0,0 +1,204 @@ +--- +x-trestle-set-params: + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. + # + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: + # + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE + # + ac-02_odp.01: + alt-identifier: ac-2_prm_1 + profile-values: + - + profile-param-value-origin: + ac-02_odp.02: + alt-identifier: ac-2_prm_2 + profile-values: + - + profile-param-value-origin: + ac-02_odp.03: + alt-identifier: ac-2_prm_3 + profile-values: + - + profile-param-value-origin: + ac-02_odp.04: + alt-identifier: ac-2_prm_4 + profile-values: + - + profile-param-value-origin: + ac-02_odp.05: + alt-identifier: ac-2_prm_5 + profile-values: + - + profile-param-value-origin: + ac-02_odp.06: + alt-identifier: ac-2_prm_6 + profile-values: + - + profile-param-value-origin: + ac-02_odp.07: + alt-identifier: ac-2_prm_7 + profile-values: + - + profile-param-value-origin: + ac-02_odp.08: + alt-identifier: ac-2_prm_8 + profile-values: + - + profile-param-value-origin: + ac-02_odp.09: + alt-identifier: ac-2_prm_9 + profile-values: + - + profile-param-value-origin: + ac-02_odp.10: + alt-identifier: ac-2_prm_10 + profile-values: + - + profile-param-value-origin: +x-trestle-global: + profile: + title: REPLACE_ME + sort-id: ac-02 +--- + +# ac-2 - \[Access Control\] Account Management + +## Control Statement + +- \[a.\] Define and document the types of accounts allowed and specifically prohibited for use within the system; + +- \[b.\] Assign account managers; + +- \[c.\] Require {{ insert: param, ac-02_odp.01 }} for group and role membership; + +- \[d.\] Specify: + + - \[1.\] Authorized users of the system; + - \[2.\] Group and role membership; and + - \[3.\] Access authorizations (i.e., privileges) and {{ insert: param, ac-02_odp.02 }} for each account; + +- \[e.\] Require approvals by {{ insert: param, ac-02_odp.03 }} for requests to create accounts; + +- \[f.\] Create, enable, modify, disable, and remove accounts in accordance with {{ insert: param, ac-02_odp.04 }}; + +- \[g.\] Monitor the use of accounts; + +- \[h.\] Notify account managers and {{ insert: param, ac-02_odp.05 }} within: + + - \[1.\] {{ insert: param, ac-02_odp.06 }} when accounts are no longer required; + - \[2.\] {{ insert: param, ac-02_odp.07 }} when users are terminated or transferred; and + - \[3.\] {{ insert: param, ac-02_odp.08 }} when system usage or need-to-know changes for an individual; + +- \[i.\] Authorize access to the system based on: + + - \[1.\] A valid access authorization; + - \[2.\] Intended system usage; and + - \[3.\] {{ insert: param, ac-02_odp.09 }}; + +- \[j.\] Review accounts for compliance with account management requirements {{ insert: param, ac-02_odp.10 }}; + +- \[k.\] Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and + +- \[l.\] Align account management processes with personnel termination and transfer processes. + +## Control Assessment Objective + +- \[AC-02a.\] + + - \[AC-02a.[01]\] account types allowed for use within the system are defined and documented; + - \[AC-02a.[02]\] account types specifically prohibited for use within the system are defined and documented; + +- \[AC-02b.\] account managers are assigned; + +- \[AC-02c.\] {{ insert: param, ac-02_odp.01 }} for group and role membership are required; + +- \[AC-02d.\] + + - \[AC-02d.01\] authorized users of the system are specified; + - \[AC-02d.02\] group and role membership are specified; + - \[AC-02d.03\] + + - \[AC-02d.03[01]\] access authorizations (i.e., privileges) are specified for each account; + - \[AC-02d.03[02]\] {{ insert: param, ac-02_odp.02 }} are specified for each account; + +- \[AC-02e.\] approvals are required by {{ insert: param, ac-02_odp.03 }} for requests to create accounts; + +- \[AC-02f.\] + + - \[AC-02f.[01]\] accounts are created in accordance with {{ insert: param, ac-02_odp.04 }}; + - \[AC-02f.[02]\] accounts are enabled in accordance with {{ insert: param, ac-02_odp.04 }}; + - \[AC-02f.[03]\] accounts are modified in accordance with {{ insert: param, ac-02_odp.04 }}; + - \[AC-02f.[04]\] accounts are disabled in accordance with {{ insert: param, ac-02_odp.04 }}; + - \[AC-02f.[05]\] accounts are removed in accordance with {{ insert: param, ac-02_odp.04 }}; + +- \[AC-02g.\] the use of accounts is monitored; + +- \[AC-02h.\] + + - \[AC-02h.01\] account managers and {{ insert: param, ac-02_odp.05 }} are notified within {{ insert: param, ac-02_odp.06 }} when accounts are no longer required; + - \[AC-02h.02\] account managers and {{ insert: param, ac-02_odp.05 }} are notified within {{ insert: param, ac-02_odp.07 }} when users are terminated or transferred; + - \[AC-02h.03\] account managers and {{ insert: param, ac-02_odp.05 }} are notified within {{ insert: param, ac-02_odp.08 }} when system usage or the need to know changes for an individual; + +- \[AC-02i.\] + + - \[AC-02i.01\] access to the system is authorized based on a valid access authorization; + - \[AC-02i.02\] access to the system is authorized based on intended system usage; + - \[AC-02i.03\] access to the system is authorized based on {{ insert: param, ac-02_odp.09 }}; + +- \[AC-02j.\] accounts are reviewed for compliance with account management requirements {{ insert: param, ac-02_odp.10 }}; + +- \[AC-02k.\] + + - \[AC-02k.[01]\] a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group; + - \[AC-02k.[02]\] a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group; + +- \[AC-02l.\] + + - \[AC-02l.[01]\] account management processes are aligned with personnel termination processes; + - \[AC-02l.[02]\] account management processes are aligned with personnel transfer processes. + +## Control guidance + +Examples of system account types include individual, shared, group, system, guest, anonymous, emergency, developer, temporary, and service. Identification of authorized system users and the specification of access privileges reflect the requirements in other controls in the security plan. Users requiring administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access, including system owner, mission or business owner, senior agency information security officer, or senior agency official for privacy. Types of accounts that organizations may wish to prohibit due to increased risk include shared, group, emergency, anonymous, temporary, and guest accounts. + +Where access involves personally identifiable information, security programs collaborate with the senior agency official for privacy to establish the specific conditions for group and role membership; specify authorized users, group and role membership, and access authorizations for each account; and create, adjust, or remove system accounts in accordance with organizational policies. Policies can include such information as account expiration dates or other factors that trigger the disabling of accounts. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of the two. Examples of other attributes required for authorizing access include restrictions on time of day, day of week, and point of origin. In defining other system account attributes, organizations consider system-related requirements and mission/business requirements. Failure to consider these factors could affect system availability. + +Temporary and emergency accounts are intended for short-term use. Organizations establish temporary accounts as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. Organizations establish emergency accounts in response to crisis situations and with the need for rapid account activation. Therefore, emergency account activation may bypass normal account authorization processes. Emergency and temporary accounts are not to be confused with infrequently used accounts, including local logon accounts used for special tasks or when network resources are unavailable (may also be known as accounts of last resort). Such accounts remain available and are not subject to automatic disabling or removal dates. Conditions for disabling or deactivating accounts include when shared/group, emergency, or temporary accounts are no longer required and when individuals are transferred or terminated. Changing shared/group authenticators when members leave the group is intended to ensure that former group members do not retain access to the shared or group account. Some types of system accounts may require specialized training. + +# Editable Content + + + + + + + + + + + + + + + diff --git a/markdown/profiles/test_profile/ac/ac-4.4.md b/markdown/profiles/test_profile/ac/ac-4.4.md new file mode 100644 index 0000000..fb1e7ba --- /dev/null +++ b/markdown/profiles/test_profile/ac/ac-4.4.md @@ -0,0 +1,83 @@ +--- +x-trestle-set-params: + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. + # + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: + # + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE + # + ac-04.04_odp.01: + alt-identifier: ac-4.4_prm_1 + profile-values: + - + profile-param-value-origin: + ac-04.04_odp.02: + alt-identifier: ac-4.4_prm_2 + profile-values: + - + profile-param-value-origin: + ac-04.04_odp.03: + alt-identifier: ac-4.4_prm_3 + profile-values: + - + profile-param-value-origin: +x-trestle-global: + profile: + title: REPLACE_ME + sort-id: ac-04.04 +--- + +# ac-4.4 - \[Access Control\] Flow Control of Encrypted Information + +## Control Statement + +Prevent encrypted information from bypassing {{ insert: param, ac-04.04_odp.01 }} by {{ insert: param, ac-04.04_odp.02 }}. + +- \[4_fr\] + + - \[Requirement:\] The service provider must support Agency requirements to comply with M-21-31 (https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf) and M-22-09 (https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf). + +## Control Assessment Objective + +encrypted information is prevented from bypassing {{ insert: param, ac-04.04_odp.01 }} by {{ insert: param, ac-04.04_odp.02 }}. + +## Control guidance + +Flow control mechanisms include content checking, security policy filters, and data type identifiers. The term encryption is extended to cover encoded data not recognized by filtering mechanisms. + +# Editable Content + + + + + + + + + + + + + + + diff --git a/markdown/profiles/test_profile/sc/sc-1.md b/markdown/profiles/test_profile/sc/sc-1.md new file mode 100644 index 0000000..aabeb66 --- /dev/null +++ b/markdown/profiles/test_profile/sc/sc-1.md @@ -0,0 +1,153 @@ +--- +x-trestle-set-params: + # This section contains the parameters that are part of this control. + # Each parameter has properties. Only the profile-values and display-name properties are editable. + # The other properties are informational. + # + # The values property for a parameter represents values inherited from the OSCAL catalog. + # To override the catalog settings, use bullets under profile-values as shown below: + # + # profile-values: + # - value 1 + # - value 2 + # + # If the "- " placeholder appears under profile-values, it is the same as if + # the profile-values property were left empty. + # + # Some parameters may show an aggregates property which lists other parameters. This means + # the parameter value is made up of the values from the other parameters. For parameters + # that aggregate, profile-values is not applicable. + # + # Property param-value-origin is meant for putting the origin from where that parameter comes from. + # In order to be changed in the current profile, profile-param-value-origin property will be displayed with + # the placeholder "" for you to be replaced. If a parameter already has a param-value-origin + # coming from an inherited profile, do no change this value, instead use profile-param-value-origin as follows: + # + # param-value-origin: DO NOT REPLACE - this is the original value + # profile-param-value-origin: - replace the new value required HERE + # + sc-1_prm_1: + aggregates: + - sc-01_odp.01 + - sc-01_odp.02 + profile-param-value-origin: + sc-01_odp.01: + profile-values: + - + profile-param-value-origin: + sc-01_odp.02: + profile-values: + - + profile-param-value-origin: + sc-01_odp.03: + alt-identifier: sc-1_prm_2 + profile-values: + - + profile-param-value-origin: + sc-01_odp.04: + alt-identifier: sc-1_prm_3 + profile-values: + - + profile-param-value-origin: + sc-01_odp.05: + alt-identifier: sc-1_prm_4 + profile-values: + - + profile-param-value-origin: + sc-01_odp.06: + alt-identifier: sc-1_prm_5 + profile-values: + - + profile-param-value-origin: + sc-01_odp.07: + alt-identifier: sc-1_prm_6 + profile-values: + - + profile-param-value-origin: + sc-01_odp.08: + alt-identifier: sc-1_prm_7 + profile-values: + - + profile-param-value-origin: +x-trestle-global: + profile: + title: REPLACE_ME + sort-id: sc-01 +--- + +# sc-1 - \[System and Communications Protection\] Policy and Procedures + +## Control Statement + +- \[a.\] Develop, document, and disseminate to {{ insert: param, sc-1_prm_1 }}: + + - \[1.\] {{ insert: param, sc-01_odp.03 }} system and communications protection policy that: + + - \[(a)\] Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and + - \[(b)\] Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and + + - \[2.\] Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls; + +- \[b.\] Designate an {{ insert: param, sc-01_odp.04 }} to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and + +- \[c.\] Review and update the current system and communications protection: + + - \[1.\] Policy {{ insert: param, sc-01_odp.05 }} and following {{ insert: param, sc-01_odp.06 }} ; and + - \[2.\] Procedures {{ insert: param, sc-01_odp.07 }} and following {{ insert: param, sc-01_odp.08 }}. + +## Control Assessment Objective + +- \[SC-01a.\] + + - \[SC-01a.[01]\] a system and communications protection policy is developed and documented; + - \[SC-01a.[02]\] the system and communications protection policy is disseminated to {{ insert: param, sc-01_odp.01 }}; + - \[SC-01a.[03]\] system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented; + - \[SC-01a.[04]\] the system and communications protection procedures are disseminated to {{ insert: param, sc-01_odp.02 }}; + - \[SC-01a.01\] + + - \[SC-01a.01(a)\] + + - \[SC-01a.01(a)[01]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses purpose; + - \[SC-01a.01(a)[02]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses scope; + - \[SC-01a.01(a)[03]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses roles; + - \[SC-01a.01(a)[04]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses responsibilities; + - \[SC-01a.01(a)[05]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses management commitment; + - \[SC-01a.01(a)[06]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses coordination among organizational entities; + - \[SC-01a.01(a)[07]\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy addresses compliance; + + - \[SC-01a.01(b)\] the {{ insert: param, sc-01_odp.03 }} system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; + +- \[SC-01b.\] the {{ insert: param, sc-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; + +- \[SC-01c.\] + + - \[SC-01c.01\] + + - \[SC-01c.01[01]\] the current system and communications protection policy is reviewed and updated {{ insert: param, sc-01_odp.05 }}; + - \[SC-01c.01[02]\] the current system and communications protection policy is reviewed and updated following {{ insert: param, sc-01_odp.06 }}; + + - \[SC-01c.02\] + + - \[SC-01c.02[01]\] the current system and communications protection procedures are reviewed and updated {{ insert: param, sc-01_odp.07 }}; + - \[SC-01c.02[02]\] the current system and communications protection procedures are reviewed and updated following {{ insert: param, sc-01_odp.08 }}. + +## Control guidance + +System and communications protection policy and procedures address the controls in the SC family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of system and communications protection policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to system and communications protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure. + +# Editable Content + + + + + + + + + + + + + + + diff --git a/profiles/test_profile/profile.json b/profiles/test_profile/profile.json new file mode 100644 index 0000000..a3eb106 --- /dev/null +++ b/profiles/test_profile/profile.json @@ -0,0 +1,23 @@ +{ + "profile": { + "uuid": "82c60402-6acc-4e58-871f-4ce8d60a1317", + "metadata": { + "title": "REPLACE_ME", + "last-modified": "2024-02-26T14:32:21.117077+00:00", + "version": "REPLACE_ME", + "oscal-version": "1.0.4" + }, + "imports": [ + { + "href": "trestle://profiles/example/profile.json", + "include-all": {} + } + ], + "merge": { + "combine": { + "method": "merge" + }, + "as-is": true + } + } +} \ No newline at end of file