3 Aspects of the FedRAMP Assessment Process: What Do You Need to Provide?

Control Family

Control Family Description & Personnel Involved

CA

Security Assessment

• Deals with the sponsoring Authorizing Official (AO), the independence of your assessor, and whether you have conducted a penetration test.
• Also covers the continuous monitoring of the environment’s security posture, Plan of Actions and Milestones (POA&M), and overall program monitoring.

AC

Access Control

• Covers administrative and technical controls, e.g., bringing personnel on and going through the administrative process of assigning their corresponding privileges.
• Also deals with ensuring internal hosts have the appropriate limited access to other hosts.

Personnel generally involved: ISSM, ISSO, Security Engineers (SE), Security Administrator (SA), and IT/Systems Admins (ITA)

AT

Security Awareness Training

• Covers security awareness program content, tracking, and retention.

Personnel generally involved: ISSO, ISSM

AU

Audit and Accountability

• Analyzes the Security Information and Event Manager (SIEM), log content, log management, alerting, and monitoring.

Personnel generally involved: ISSM, ISSO, SA

CM

Configuration Management

• Reviews baseline management, change management control process, inventory, baseline scanning, and Configuration Management Plan (CMP)

Personnel generally involved: Members of the Change Advisory Board (CAB)

CP

Contingency Planning

• Addresses data and environment backup, recovery, availability, and your Contingency Plan

Personnel generally involved: ISSM, ISSO, Contingency Planning (CP) Team

IA

Identification and Authorization

• Evaluates means of identifying and verifying personnel through usernames, passwords, Common Access Card (CAC), Multi-Factor Authentication (MFA) tokens, MFA mobile apps, etc.

Personnel generally involved: ISSM, ISSO, Physical Security, Administrative Management

IR

Incident Response

• Examines how incidents are found, investigated, reported, and tracked.

Personnel generally involved: ISSM, ISSO, IR Team

MA

Maintenance

• Deals with how maintenance is managed, tracked, and logged, as well as how systems are maintained. (Generally inherited unless you are managing equipment for your boundary in a data center.)

Personnel generally involved: ISSM, ISSO, Data Center Management

MP

Media Protection

• Addresses how media is managed, stored, tracked, and protected. (Also generally inherited.)

Personnel generally involved: ISSM, ISSO, Data Center Management

PE

Physical and Environmental Security

• Reviews how the data center is protected, how those personnel are managed, tracked, and monitored, and what access controls into the datacenter are in place. (Also generally inherited.)

Personnel generally involved: ISSM, ISSO, Data Center Management

PL

Security Planning

• Focuses on how well you have documented your environment and the design diagrams. (Leverages the System Security Plan (SSP) heavily.)

Personnel generally involved: ISSM, ISSO

PS

Personnel Security

• Evaluates the hiring, firing, sanctioning, and background checking of personnel.

Personnel generally involved: Administrative management and legal team

RA

Risk Assessments

• Examines OS and Infrastructure scans—A.K.A. vulnerability scans—database scans, web application scans, and container scans.

** NOTE: Revision 5 Includes threat hunting capabilities including monitoring, detection, tracking, and threat disruption.

Personnel generally involved: ISSM, ISSO, vulnerability management team, ** Threat Hunting Team

SA

System and Services Acquisition

• Addresses vendor management, external system interconnections, third-party risk, and supply chain management.

Personnel generally involved: ISSM, ISSO

SC

System and Communications Protection

• Covers security of external/internal data-in-transit, data-at-rest, internal/external encryption, Public Key Infrastructure (PKI), bastion hosts, Virtual Private Networks (VPNs), firewalls, and other boundary protection.

** NOTE: Rev 5 will introduce new privacy requirements SC-7(24)

Personnel generally involved: ISSM, ISSO, SE, SA, ITA, ** Privacy Team

SI

Systems and Information Integrity

• Deals primarily with the verification of the functionality and security of the system, including bug or flaw remediation, file integrity monitoring, antivirus, spam protection, system/security functionality verification, error handling, and software whitelisting.

** NOTE: Rev 5 will introduce new privacy requirements SI-18 and SI-19

Personnel generally involved: ISSM, ISSO, SE, SA, ITA, **Privacy Team

SR

Supply Chain Risk Management

• New with Rev 5
• Focused on the third-party supply chain procurement of purchased services, contractors, and equipment—supply chain control process, verification, monitoring, and decommissioning.
• You must now have a supply chain risk management plan that will document all the planned execution of these requirements.

** NOTE: These controls are not currently being assessed by 3PAOs so the below is hypothetically who would be involved.

Personnel possibly involved: ISSM, ISSO, CAB

PT

Personally Identifiable Information Processing and Transparency

• New with Rev 5
• Covers privacy when collecting, storing, handling, processing, notifying of use of, and destroying (when no longer needed) personnel’s Personally Identifiable Information (PII).

** NOTE: These controls are not currently being assessed by 3PAOs so the below is hypothetically who would be involved.

Personnel possibly involved: ISSM, ISSO, SE, SA, ITA, **Privacy Team

PM

Program Management

• New with Rev 5
• Examines the overall security program and how it works together overall to create metrics.
• Much of this will be covered by your SSP, but there’s an additional requirement in the Critical Infrastructure Plan.

** NOTE: These controls are not currently being assessed by 3PAOs so the below is hypothetically who would be involved.

Personnel possibly involved: ISSM, ISSO