From 916ae4e8c16331fc6d9dd8fa997dbf5f36af3784 Mon Sep 17 00:00:00 2001 From: Rene Tshiteya Date: Thu, 21 Sep 2023 21:31:10 -0400 Subject: [PATCH] Update LI-SaaS profile --- .../FedRAMP_rev5_LI-SaaS-baseline_profile.xml | 392 +++++++++--------- 1 file changed, 199 insertions(+), 193 deletions(-) diff --git a/src/content/rev5/baselines/xml/FedRAMP_rev5_LI-SaaS-baseline_profile.xml b/src/content/rev5/baselines/xml/FedRAMP_rev5_LI-SaaS-baseline_profile.xml index e2841bd5e..2d03562a6 100644 --- a/src/content/rev5/baselines/xml/FedRAMP_rev5_LI-SaaS-baseline_profile.xml +++ b/src/content/rev5/baselines/xml/FedRAMP_rev5_LI-SaaS-baseline_profile.xml @@ -1,12 +1,12 @@ - + FedRAMP Rev 5 Tailored Low Impact Software as a Service (LI-SaaS) Baseline 2023-08-31T00:00:00Z - 2023-08-31T00:00:00Z - fedramp-2.0.0-oscal1.0.4 - 1.0.4 + 2023-09-21T14:45:00Z + fedramp-2.0.0-oscal1.1.1 + 1.1.1 Document creator @@ -1316,7 +1316,7 @@ - + @@ -1336,28 +1336,28 @@ - + - - - + + +

Determine if the organization defines information system account types to be identified and selected to support organizational missions/business functions.

- +

Access control policy; procedures addressing account management; security plan; information system design documentation; information system configuration settings and associated documentation; list of active system accounts along with the name of the individual associated with each account; list of conditions for group and role membership; notifications or records of recently transferred, separated, or terminated employees; list of recently disabled information system accounts along with the name of the individual associated with each account; access authorization records; account management compliance reviews; information system monitoring records; information system audit records; other relevant documents or records.

- +

Organizational personnel with account management responsibilities; system/network administrators; organizational personnel with information security responsibilities.

- +

Organizational processes for account management on the information system; automated mechanisms for implementing account management.

@@ -1370,7 +1370,7 @@
- + @@ -1380,8 +1380,8 @@ - - + +

NSO for non-privileged users. Attestation for privileged users related to multi-factor identification and authentication.

@@ -1392,7 +1392,7 @@ - +

FED - This is related to agency data and agency policy solution.

@@ -1403,7 +1403,7 @@ - +

FED - This is related to agency data and agency policy solution.

@@ -1415,7 +1415,7 @@
- + @@ -1424,7 +1424,7 @@ - +

NSO - All access to Cloud SaaS are via web services and/or API. The device accessed from or whether via wired or wireless connection is out of scope. Regardless of device accessed from, must utilize approved remote access methods (AC-17), secure communication with strong encryption (SC-13), key management (SC-12), and multi-factor authentication for privileged access (IA-2[1]).

@@ -1436,7 +1436,7 @@ - +

NSO - All access to Cloud SaaS are via web service and/or API. The device accessed from is out of the scope. Regardless of device accessed from, must utilize approved remote access methods (AC-17), secure communication with strong encryption (SC-13), key management (SC-12), and multi-factor authentication for privileged access (IA-2 [1]).

@@ -1447,7 +1447,7 @@ - + @@ -1457,7 +1457,7 @@
- + @@ -1466,7 +1466,7 @@ - + @@ -1475,7 +1475,7 @@ - + @@ -1484,7 +1484,7 @@ - + @@ -1493,7 +1493,7 @@ - + @@ -1502,7 +1502,7 @@ - + @@ -1511,7 +1511,7 @@ - + @@ -1520,7 +1520,7 @@ - + @@ -1529,7 +1529,7 @@
- + @@ -1537,7 +1537,7 @@ - +

NSO - Loss of availability of the audit data has been determined to have little or no impact to government business/mission needs.

@@ -1549,7 +1549,7 @@
- + @@ -1559,7 +1559,7 @@
- + @@ -1567,7 +1567,7 @@ - + @@ -1575,7 +1575,7 @@ - + @@ -1584,7 +1584,7 @@ - +

NSO - Loss of availability of the audit data has been determined as little or no impact to government business/mission needs.

@@ -1595,7 +1595,7 @@ - + @@ -1604,7 +1604,7 @@ - + @@ -1614,7 +1614,7 @@
- + @@ -1622,7 +1622,7 @@ - + @@ -1632,8 +1632,8 @@
- - + +

Condition: There are connection(s) to external systems. Connections (if any) shall be authorized and must: 1) Identify the interface/connection. 2) Detail what data is involved and its sensitivity. 3) Determine whether the connection is one-way or bi-directional. 4) Identify how the connection is secured.

@@ -1645,7 +1645,7 @@ - +

Attestation - for compliance with FedRAMP Tailored LI-SaaS Continuous Monitoring Requirements.

@@ -1657,7 +1657,7 @@
- + @@ -1667,7 +1667,7 @@
- + @@ -1677,7 +1677,7 @@ - + @@ -1687,7 +1687,7 @@ - + @@ -1697,8 +1697,8 @@ - - + +

Condition: There are connection(s) to external systems. Connections (if any) shall be authorized and must: 1) Identify the interface/connection. 2) Detail what data is involved and its sensitivity. 3) Determine whether the connection is one-way or bi-directional. 4) Identify how the connection is secured.

@@ -1710,7 +1710,7 @@ - + @@ -1718,7 +1718,7 @@ - + @@ -1727,7 +1727,7 @@
- + @@ -1737,7 +1737,7 @@ - + @@ -1747,7 +1747,7 @@ - +

Required - Specifically include details of least functionality.

@@ -1773,7 +1773,7 @@ - + @@ -1783,7 +1783,7 @@
- + @@ -1791,7 +1791,7 @@ - +

NSO- Not directly related to protection of the data.

@@ -1802,7 +1802,7 @@ - +

NSO - Boundary is specific to SaaS environment; all access is via web services; users' machine or internal network are not contemplated. External services (SA-9), internal connection (CA-9), remote access (AC-17), and secure access (SC-12 and SC-13), and privileged authentication (IA-2[1]) are considerations.

@@ -1814,7 +1814,7 @@ - + @@ -1823,7 +1823,7 @@ - +

NSO - Loss of availability of the SaaS has been determined as little or no impact to government business/mission needs.

@@ -1835,7 +1835,7 @@ - +

NSO - Loss of availability of the SaaS has been determined as little or no impact to government business/mission needs.

@@ -1847,7 +1847,7 @@ - +

NSO - Loss of availability of the SaaS has been determined as little or no impact to government business/mission needs.

@@ -1859,7 +1859,7 @@
- + @@ -1867,7 +1867,7 @@ - +

NSO - Loss of availability of the SaaS has been determined as little or no impact to government business/mission needs.

@@ -1879,7 +1879,7 @@ - + @@ -1887,8 +1887,8 @@ - - + +

NSO for non-privileged users. Attestation for privileged users related to multi-factor identification and authentication - specifically include description of management of service accounts.

@@ -1900,7 +1900,7 @@
- + IA-2(1) Additional FedRAMP Requirements and Guidance @@ -1913,9 +1913,12 @@ - + + + + - + @@ -1925,7 +1928,7 @@ - + @@ -1934,13 +1937,13 @@
- - + + - - - + + +

Determine if the information system:

  • Accepts PIV credentials.
  • @@ -1955,7 +1958,7 @@ - + @@ -1964,7 +1967,7 @@ - + @@ -1973,7 +1976,7 @@ - + @@ -1982,15 +1985,18 @@ - + + + + - + @@ -1998,7 +2004,7 @@ - + @@ -2007,8 +2013,8 @@ - - + +

    Condition: Must document and assess for privileged users. May attest to this control for non-privileged users. FedRAMP requires a minimum of multi-factor authentication for all Federal privileged users, if acceptance of PIV credentials is not supported. The implementation status and details of how this control is implemented must be clearly defined by the CSP.

    @@ -2020,8 +2026,8 @@
    - - + +

    Condition: Must document and assess for privileged users. May attest to this control for non-privileged users. FedRAMP requires a minimum of multi-factor authentication for all Federal privileged users, if acceptance of PIV credentials is not supported. The implementation status and details of how this control is implemented must be clearly defined by the CSP.

    @@ -2032,7 +2038,7 @@ - + @@ -2041,7 +2047,7 @@ - + @@ -2050,7 +2056,7 @@ - + @@ -2059,7 +2065,7 @@ - + @@ -2068,7 +2074,7 @@
    - + @@ -2076,7 +2082,7 @@ - + @@ -2086,7 +2092,7 @@ - + @@ -2094,7 +2100,7 @@ - + @@ -2103,7 +2109,7 @@ - +

    Attestation - Specifically attest to US-CERT compliance.

    @@ -2115,7 +2121,7 @@ - + @@ -2124,8 +2130,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2137,7 +2143,7 @@ - + @@ -2146,8 +2152,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2159,7 +2165,7 @@ - + @@ -2168,8 +2174,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2181,8 +2187,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2194,8 +2200,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2207,7 +2213,7 @@ - + @@ -2217,8 +2223,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2231,8 +2237,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2245,8 +2251,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2259,8 +2265,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2272,8 +2278,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2285,8 +2291,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2298,8 +2304,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2320,8 +2326,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2333,8 +2339,8 @@
    - - + +

    Condition: Control is not inherited from a FedRAMP-authorized PaaS or IaaS.

    @@ -2346,7 +2352,7 @@ - + @@ -2356,7 +2362,7 @@
    - + @@ -2364,7 +2370,7 @@ - + @@ -2373,7 +2379,7 @@ - + @@ -2383,7 +2389,7 @@ - + @@ -2392,7 +2398,7 @@ - + @@ -2401,7 +2407,7 @@ - + @@ -2410,7 +2416,7 @@ - + @@ -2418,7 +2424,7 @@ - + @@ -2427,7 +2433,7 @@ - + @@ -2436,7 +2442,7 @@ - + @@ -2445,7 +2451,7 @@ - + @@ -2454,7 +2460,7 @@ - + @@ -2463,7 +2469,7 @@ - +

    Attestation - Specifically stating that any third-party security personnel are treated as CSP employees.

    @@ -2474,7 +2480,7 @@ - + @@ -2483,7 +2489,7 @@ - + @@ -2492,7 +2498,7 @@ - + @@ -2503,7 +2509,7 @@
    - + @@ -2512,7 +2518,7 @@ - + @@ -2521,7 +2527,7 @@ - + @@ -2531,7 +2537,7 @@ - + @@ -2541,7 +2547,7 @@ - + @@ -2551,7 +2557,7 @@ - + @@ -2561,7 +2567,7 @@ - + @@ -2570,7 +2576,7 @@ - + @@ -2578,7 +2584,7 @@ - + @@ -2586,7 +2592,7 @@ - + @@ -2594,7 +2600,7 @@ - + @@ -2603,7 +2609,7 @@ - + @@ -2611,7 +2617,7 @@ - + @@ -2620,7 +2626,7 @@ - + @@ -2629,7 +2635,7 @@ - + @@ -2639,7 +2645,7 @@ - + @@ -2648,7 +2654,7 @@ - + @@ -2657,8 +2663,8 @@ - - + +

    Condition: If availability is a requirement, define protections in place as per control requirement.

    @@ -2670,7 +2676,7 @@
    - + @@ -2680,7 +2686,7 @@ - + @@ -2690,7 +2696,7 @@ - + @@ -2699,7 +2705,7 @@ - + @@ -2709,8 +2715,8 @@ - - + +

    Condition: If implementing need to detail how they meet it or don't meet it.

    @@ -2721,7 +2727,7 @@ - +

    NSO - Not directly related to the security of the SaaS.

    @@ -2732,7 +2738,7 @@ - + @@ -2740,7 +2746,7 @@ - + @@ -2748,7 +2754,7 @@ - + @@ -2758,7 +2764,7 @@
    - + @@ -2768,7 +2774,7 @@
    - + @@ -2776,7 +2782,7 @@ - + @@ -2785,7 +2791,7 @@ - + @@ -2795,7 +2801,7 @@ - + @@ -2805,7 +2811,7 @@ - + @@ -2815,7 +2821,7 @@ - + @@ -2823,7 +2829,7 @@ - + @@ -2831,7 +2837,7 @@ - +

    Attestation - Specifically related to US-CERT and FedRAMP communications procedures.

    @@ -2843,7 +2849,7 @@ - + @@ -2852,7 +2858,7 @@ - + @@ -2861,7 +2867,7 @@ - + @@ -2870,7 +2876,7 @@ - + @@ -2879,7 +2885,7 @@ - + @@ -2888,7 +2894,7 @@ - + @@ -2897,7 +2903,7 @@ - + @@ -2906,7 +2912,7 @@ - + @@ -2915,7 +2921,7 @@ - + @@ -2924,7 +2930,7 @@ - + @@ -2933,7 +2939,7 @@ - +