Compliance, Mapped to Your Cloud

The organization employs automated mechanisms to support the management of information system accounts.

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies \[Assignment: organization-defined personnel or roles\].

The organization: * a. Monitors information system accounts for \[Assignment: organization-defined atypical use\].

The organization: * f. Creates, enables, modifies, disables, and removes information system accounts in accordance with \[Assignment: organization-defined procedures or conditions\].

The organization: * g. Monitors the use of information system accounts.

The organization: * j. Reviews accounts for compliance with account management requirements \[Assignment: organization-defined frequency\].

The information system automatically disables inactive accounts after 90 days for user accounts.

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on \[Assignment: organization-defined information flow control policies\].

The organization: * c. Defines information system access authorizations to support separation of duties.

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

The information system monitors and controls remote access methods.

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

The organization: * b. Employs \[Assignment: organization-defined automated mechanisms or manual processes\] to assist users in making information sharing/collaboration decisions.

The organization: * a. Determines that the information system is capable of auditing the following events: Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes. * d. Determines that the following events are to be audited within the information system: \[organization-defined subset of the auditable events defined in AU-2 a to be audited continually for each identified event\].

The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

* (1) The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. * (3) The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

The information system provides the capability to process audit records for events of interest based on \[Assignment: organization-defined audit fields within audit records\].

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

The information system backs up audit records at least weekly onto a physically different system or system component than the system or component being audited.

The organization retains audit records for at least 90 days to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

The information system: * a. Provides audit record generation capability for the auditable events defined in AU-2 a. at all information system and network components where audit capability is deployed/available * c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: * a. Establishment of \[Assignment: organization-defined metrics\] to be monitored; * b. Establishment of \[Assignment: organization-defined frequencies\] for monitoring and \[Assignment: organization-defined frequencies\] for assessments supporting such monitoring

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

The organization: * a. Configures the information system to provide only essential capabilities.

The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

The organization: * a. Employs automated mechanisms continuously, using automated mechanisms with a maximum five-minute delay in detection, to detect the presence of unauthorized hardware, software, and firmware components within the information system

The organization: * b. Conducts backups of system-level information contained in the information system (daily incremental; weekly full).

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

(1) The information system implements multifactor authentication for network access to privileged accounts.

* (1) The information system implements multifactor authentication for network access to privileged accounts. * (2) The information system implements multifactor authentication for network access to non- privileged accounts.

The information system, for password-based authentication: * a. Enforces minimum password complexity of \[Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type\]; * d. Enforces password minimum and maximum lifetime restrictions of \[Assignment: organization- defined numbers for lifetime minimum, lifetime maximum\]; * e. Prohibits password reuse for 24 generations

The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy \[Assignment: organization-defined requirements\].

The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.

The organization employs automated mechanisms to support the incident handling process.

The organization employs automated mechanisms to assist in the reporting of security incidents.

The organization employs automated mechanisms to increase the availability of incident response-related information and support.

The organization: * a. Scans for vulnerabilities in the information system and hosted applications monthly \[operating system/infrastructure; monthly web applications and databases\] and when new vulnerabilities potentially affecting the system/applications are identified and reported; * b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; * c. Analyzes vulnerability scan reports and results from security control assessments; * d. Remediates legitimate vulnerabilities: high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery, in accordance with an organizational assessment of risk; * e. Shares information obtained from the vulnerability scanning process and security control assessments with \[Assignment: organization-defined personnel or roles\] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

The organization: * a. Manages the information system using \[Assignment: organization-defined system development life cycle\] that incorporates information security considerations.

The organization requires the developer of the information system, system component, or information system service to: * a. Perform configuration management during system, component, or service development, implementation, AND operation; * b. Document, manage, and control the integrity of changes to \[Assignment: organization-defined configuration items under configuration management\]; * c. Implement only organization-approved changes to the system, component, or service; * d. Document approved changes to the system, component, or service and the potential security impacts of such changes; * e. Track security flaws and flaw resolution within the system, component, or service and report findings to \[Assignment: organization-defined personnel\].

The information system separates user functionality (including user interface services) from information system management functionality.

The information system prevents unauthorized and unintended information transfer via shared system resources.

The information system protects against or limits the effects of the following types of denial of service attacks: \[Assignment: organization-defined types of denial of service attacks or references to sources for such information\] by employing \[Assignment: organization-defined security safeguards\].

The information system: * a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; * b. Implements subnetworks for publicly accessible system components that are \[Selection: physically; logically\] separated from internal organizational networks; * c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

The organization limits the number of external network connections to the information system.

The information system protects the confidentiality AND integrity of transmitted information.

The information system implements cryptographic mechanisms to \[Selection (one or more): prevent unauthorized disclosure of information; detect changes to information\] during transmission unless otherwise protected by \[Assignment: organization-defined alternative physical safeguards\].

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with \[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction\].

The information system implements FIPS-validated or NSA-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

The information system protects the authenticity of communications sessions.

The information system protects the confidentiality AND integrity of \[Assignment: organization-defined information at rest\].

The organization employs automated mechanisms at least monthly to determine the state of information system components with regard to flaw remediation.

The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

The organization correlates information from monitoring tools employed throughout the information system.

The organization employs automated tools to support near real-time analysis of events.

The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.

The information system alerts \[Assignment: organization-defined personnel or roles\] when the following indications of compromise or potential compromise occur: \[Assignment: organization- defined compromise indicators\].

The organization: * a. Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with \[Assignment: organization- defined monitoring objectives\]; and 2. Unauthorized local, network, and remote connections; * b. Identifies unauthorized use of the information system through \[Assignment: organization- defined techniques and methods\]; * c. Deploys monitoring devices: i. strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization.

The organization employs integrity verification tools to detect unauthorized changes to \[Assignment: organization-defined software, firmware, and information\].

The information system performs an integrity check security relevant events at least monthly.

The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.