Compliance, Mapped to Your Cloud

Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.

Support the management of system accounts using \[Assignment: organization-defined automated mechanisms\].

Monitors and reports atypical usage of information system accounts to organization-defined personnel or roles.

The organization: Establishes and administers privileged user accounts in accordance with a role-based access scheme that organizes allowed information system access and privileges into roles; Monitors privileged role assignments; and Takes \[Assignment: organization-defined actions\] when privileged role assignments are no longer appropriate.

Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on \[Assignment: organization-defined information flow control policies\].

Separate duties of individuals to prevent malevolent activity. automate separation of duties and access authorizations.

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.

Authorize remote access systems prior to connection. Enforce remote connection requirements to information systems.

Employ automated mechanisms to monitor and control remote access methods.

Integrate audit review, analysis, and reporting with processes for investigation and response to suspicious activities.

Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.

Integrate analysis of audit records with analysis of \[Selection (one or more): vulnerability scanning information; performance data; system monitoring information; \[Assignment: organization-defined data/information collected from other sources\]\] to further enhance the ability to identify inappropriate or unusual activity.

Audit events defined in AU-2. Allow trusted personnel to select which events to audit. Generate audit records for events.

Compile audit records from \[Assignment: organization-defined system components\] into a system-wide (logical or physical) audit trail that is time-correlated to within \[Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail\].

The organization: (i) establishes mandatory configuration settings for information technology products employed within the information system; (ii) configures the security settings of information technology products to the most restrictive mode consistent with operational requirements; (iii) documents the configuration settings; and (iv) enforces the configuration settings in all components of the information system.

The organization configures the information system to provide only essential capabilities and prohibits or restricts the use of the functions, ports, protocols, and/or services.

a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site.

Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.

a. Conduct backups of user-level information contained in \[Assignment: organization-defined system components\] \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\]; b. Conduct backups of system-level information contained in the system \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\]; c. Conduct backups of system documentation, including security- and privacy-related documentation \[Assignment: organization-defined frequency consistent with recovery time and recovery point objectives\]; and d. Protect the confidentiality, integrity, and availability of backup information.

The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Manage information system identifiers for users and devices. Automate authorizing and disabling users to prevent misuse.

Authenticate users and devices. Automate administrative control. Enforce restrictions. Protect against unauthorized use.

The information system, for password-based authentication that enforces minimum password complexity, stores and transmits only cryptographically-protected passwords, enforces password minimum and maximum lifetime restrictions, prohibits password reuse, allows the use of a temporary password for system logons with an immediate change to a permanent password etc.

a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Track incidents and collect and analyze incident information using \[Assignment: organization-defined automated mechanisms\].

Scan for system vulnerabilities. Share vulnerability information and security controls that eliminate vulnerabilities.

Isolate security functions from nonsecurity functions.

The information system protects against or limits the effects of the following types of denial of service attacks: \[Assignment: organization-defined types of denial of service attacks or references to sources for such information\] by employing \[Assignment: organization-defined security safeguards\].

The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are \[Selection: physically; logically\] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

The organization limits the number of external network connections to the information system.

The information system protects the \[Selection (one or more): confidentiality; integrity\] of transmitted information.

The information system implements cryptographic mechanisms to \[Selection (one or more): prevent unauthorized disclosure of information; detect changes to information\] during transmission unless otherwise protected by \[Assignment: organization-defined alternative physical safeguards\].

The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with \[Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction\].

The information system protects the \[Selection (one or more): confidentiality; integrity\] of \[Assignment: organization-defined information at rest\].

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on \[Assignment: organization-defined system components or media\]: \[Assignment: organization-defined information\].

The organization: a.Identifies, reports, and corrects information system flaws; b.Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c.Installs security-relevant software and firmware updates within \[Assignment: organization-defined time period\] of the release of the updates; and d.Incorporates flaw remediation into the organizational configuration management process.

Implement \[Assignment (one or more): signature based, non-signature based\] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;

The organization: a.Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with \[Assignment: organization-defined monitoring objectives\]; and 2.Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through \[Assignment: organization-defined techniques and methods\]; c. Deploys monitoring devices: 1. Strategically within the information system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g. Provides \[Assignment: organization-defined information system monitoring information\] to \[Assignment: organization-defined personnel or roles\] \[Selection (one or more): as needed; \[Assignment: organization-defined frequency\]\].