Compliance, Mapped to Your Cloud

Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Authorize remote access systems prior to connection. Enforce remote connection requirements to information systems.

The organization: a. Determines that the information system is capable of auditing the following events: \[Assignment: organization-defined auditable events\]; b. Coordinates the security audit function with other organizational entities requiring audit- related information to enhance mutual support and to help guide the selection of auditable events; c. Provides a rationale for why the auditable events are deemed to be adequate support after- the-fact investigations of security incidents.

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

The organization retains audit records for at least 90 days to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Continuously monitor configuration management processes. Determine security impact, environment and operational risks.

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

The organization develops and documents an inventory of information system components that accurately reflects the current information system, includes all components within the authorization boundary of the information system, is at the level of granularity deemed necessary for tracking and reporting and reviews and updates the information system component inventory.

The organization conducts backups of user-level information, system-level information and information system documentation including security-related documentation contained in the information system and protects the confidentiality, integrity, and availability of backup information at storage locations.

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

The organization implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery, coordinates incident handling activities with contingency planning activities and incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

The organization manages the information system using organization-defined system development life cycle, defines and documents information security roles and responsibilities throughout the system development life cycle, identifies individuals having information security roles and responsibilities and integrates the organizational information security risk management process into system development life cycle activities.

The information system protects against or limits the effects of the following types of denial of service attacks: \[Assignment: organization-defined types of denial of service attacks or references to sources for such information\] by employing \[Assignment: organization-defined security safeguards\].

The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are \[Selection: physically; logically\] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with \[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction\].

The information system implements FIPS-validated or NSA-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.