Compliance, Mapped to Your Cloud

Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.

The organization employs automated mechanisms to support the management of information system accounts.

The information system automatically disables inactive accounts after 90 days for user accounts.

The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies \[Assignment: organization-defined personnel or roles\].

Monitors and reports atypical usage of information system accounts to organization-defined personnel or roles.

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on organization-defined information flow control policies.

Separate duties of individuals to prevent malevolent activity. automate separation of duties and access authorizations.

The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

The information system monitors and controls remote access methods.

The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

The information system routes all remote accesses through organization-defined managed network access control points.

Facilitate information sharing. Enable authorized users to grant access to partners.

Automate security audit function with other organizational entities. Enable mutual support of audit of auditable events.

The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.

The organization employs automated mechanisms to integrate audit review, analysis,and reporting processes to support organizational processes for investigation and response to suspicious activities.

The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.

The information system provides the capability to process audit records for events of interest based on \[Assignment: organization-defined audit fields within audit records\].

The information system protects audit information and audit tools from unauthorized access, modification, and deletion.

The information system backs up audit records \[Assignment: organization-defined frequency\] onto a physically different system or system component than the system or component being audited.

The organization retains audit records for \[Assignment: organization-defined time period consistent with records retention policy\] to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.

Audit events defined in AU-2. Allow trusted personnel to select which events to audit. Generate audit records for events.

Continuously monitor configuration management processes. Determine security impact, environment and operational risks.

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

The organization configures the information system to provide only essential capabilities and prohibits or restricts the use of the functions, ports, protocols, and/or services.

The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

The organization employs automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the information system and takes actions (disables network access by such components, isolates the components etc) when unauthorized components are detected.

The organization conducts backups of user-level information, system-level information and information system documentation including security-related documentation contained in the information system and protects the confidentiality, integrity, and availability of backup information at storage locations.

The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

The information system implements multi-factor authentication for network access to privileged accounts.

The information system implements multifactor authentication for network access to non-privileged accounts.

The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets \[Assignment: organization-defined strength of mechanism requirements\].

The information system, for password-based authentication that enforces minimum password complexity, stores and transmits only cryptographically-protected passwords, enforces password minimum and maximum lifetime restrictions, prohibits password reuse, allows the use of a temporary password for system logons with an immediate change to a permanent password etc.

The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy \[Assignment: organization-defined requirements\].

The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.

The organization employs automated mechanisms to support the incident handling process.

The organization report suspected security incidents to the organizational incident response capability within organization-defined time period.

The organization employs automated mechanisms to increase the availability of incident response-related information and support.

Scan for system vulnerabilities. Share vulnerability information and security controls that eliminate vulnerabilities.

The organization manages the information system using organization-defined system development life cycle, defines and documents information security roles and responsibilities throughout the system development life cycle, identifies individuals having information security roles and responsibilities and integrates the organizational information security risk management process into system development life cycle activities.

The organization requires the developer of the information system, system component, or information system service to: a. Perform configuration management during system, component, or service \[Selection (one or more): design; development; implementation; operation\]; b. Document, manage, and control the integrity of changes to \[Assignment: organization-defined configuration items under configuration management\]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to \[Assignment: organization-defined personnel\].

The information system separates user functionality (including user interface services) from information system management functionality.

The information system prevents unauthorized and unintended information transfer via shared system resources.

The information system protects against or limits the effects of the following types of denial of service attacks: \[Assignment: organization-defined types of denial of service attacks or references to sources for such information\] by employing \[Assignment: organization-defined security safeguards\].

The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are \[Selection: physically; logically\] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

The organization limits the number of external network connections to the information system.

The information system protects the \[Selection (one or more): confidentiality; integrity\] of transmitted information.

The information system implements cryptographic mechanisms to \[Selection (one or more): prevent unauthorized disclosure of information; detect changes to information\] during transmission unless otherwise protected by \[Assignment: organization-defined alternative physical safeguards\].

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with \[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction\].

The information system implements \[Assignment: organization-defined cryptographic uses and type of cryptography required for each use\] in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

TThe information system protects the authenticity of communications sessions.

The information system protects the \[Selection (one or more): confidentiality; integrity\] of \[Assignment: organization-defined information at rest\].

The organization employs automated mechanisms to determine the state of information system components with regard to flaw remediation.

The organization: a.Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with \[Assignment: organization-defined monitoring objectives\]; and 2.Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through \[Assignment: organization-defined techniques and methods\]; c. Deploys monitoring devices: 1. Strategically within the information system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g. Provides \[Assignment: organization-defined information system monitoring information\] to \[Assignment: organization-defined personnel or roles\] \[Selection (one or more): as needed; \[Assignment: organization-defined frequency\]\].

The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.

The organization employs automated tools to support near real-time analysis of events.

The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.

The information system alerts organization-defined personnel or roles when the following indications of compromise or potential compromise occur: \[Assignment: organization-defined compromise indicators\].

The organization correlates information from monitoring tools employed throughout the information system.

The organization employs integrity verification tools to detect unauthorized changes to \[Assignment: organization-defined software, firmware, and information\].

The information system performs an integrity check of security relevant events at least monthly.

The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.