NIST FISMA Authorization Tool

Security Controls

Refresh Download SSP (Excel) Download SSP (PDF)

Control ID	Name	Status	Inherited	Actions
AC-17	Remote Access	Not Implemented	No	Manage
AC-18	Wireless Access	Not Implemented	No	Manage
AC-19	Access Control for Mobile Devices	Not Implemented	No	Manage
AC-2	Account Management	Not Implemented	No	Manage
AC-20	Use of External Systems	Not Implemented	No	Manage
AC-22	Publicly Accessible Content	Not Implemented	No	Manage
AC-3	Access Enforcement	Not Implemented	No	Manage
AC-7	Unsuccessful Logon Attempts	Not Implemented	No	Manage
AC-8	System Use Notification	Not Implemented	No	Manage
AT-1	Policy and Procedures	Not Implemented	No	Manage
AT-2	Literacy Training and Awareness	Not Implemented	No	Manage
AT-3	Role-based Training	Not Implemented	No	Manage
AT-4	Training Records	Not Implemented	No	Manage
AU-1	Policy and Procedures	Not Implemented	No	Manage
AU-11	Audit Record Retention	Not Implemented	No	Manage
AU-12	Audit Record Generation	Not Implemented	No	Manage
AU-2	Event Logging	Not Implemented	No	Manage
AU-3	Content of Audit Records	Not Implemented	No	Manage
AU-4	Audit Log Storage Capacity	Not Implemented	No	Manage
AU-5	Response to Audit Logging Process Failures	Not Implemented	No	Manage
AU-6	Audit Record Review, Analysis, and Reporting	Not Implemented	No	Manage
AU-7	Audit Record Reduction and Report Generation	Not Implemented	No	Manage
AU-8	Time Stamps	Not Implemented	No	Manage
AU-9	Protection of Audit Information	Not Implemented	No	Manage
CA-1	Policy and Procedures	Not Implemented	No	Manage
CA-2	Control Assessments	Not Implemented	No	Manage
CA-3	Information Exchange	Not Implemented	No	Manage
CA-5	Plan of Action and Milestones	Not Implemented	No	Manage
CA-6	Authorization	Not Implemented	No	Manage
CA-7	Continuous Monitoring	Not Implemented	No	Manage
CA-9	Internal System Connections	Not Implemented	No	Manage
CM-1	Policy and Procedures	Not Implemented	No	Manage
CM-10	Software Usage Restrictions	Not Implemented	No	Manage
CM-11	User-installed Software	Not Implemented	No	Manage
CM-2	Baseline Configuration	Not Implemented	No	Manage
CM-4	Impact Analyses	Not Implemented	No	Manage
CM-6	Configuration Settings	Not Implemented	No	Manage
CM-7	Least Functionality	Not Implemented	No	Manage
CM-8	System Component Inventory	Not Implemented	No	Manage
AC-14	Permitted Actions Without Identification or Authentication	Implemented	No	Manage
CP-1	Policy and Procedures	Not Implemented	No	Manage
CP-10	System Recovery and Reconstitution	Not Implemented	No	Manage
CP-2	Contingency Plan	Not Implemented	No	Manage
CP-3	Contingency Training	Not Implemented	No	Manage
CP-4	Contingency Plan Testing	Not Implemented	No	Manage
CP-9	System Backup	Inherited	Yes	Manage
IA-1	Policy and Procedures	Not Implemented	No	Manage
IA-12	Identity Proofing	Not Implemented	No	Manage
IA-2	Identification and Authentication (organizational Users)	Not Implemented	No	Manage
IA-4	Identifier Management	Not Implemented	No	Manage
IA-5	Authenticator Management	Not Implemented	No	Manage
IA-8	Identification and Authentication (non-organizational Users)	Not Implemented	No	Manage
IR-1	Policy and Procedures	Not Implemented	No	Manage
IR-2	Incident Response Training	Not Implemented	No	Manage
IR-4	Incident Handling	Not Implemented	No	Manage
IR-5	Incident Monitoring	Not Implemented	No	Manage
IR-6	Incident Reporting	Not Implemented	No	Manage
IR-7	Incident Response Assistance	Not Implemented	No	Manage
IR-8	Incident Response Plan	Not Implemented	No	Manage
MA-1	Policy and Procedures	Not Implemented	No	Manage
MA-2	Controlled Maintenance	Not Implemented	No	Manage
MA-4	Nonlocal Maintenance	Not Implemented	No	Manage
MA-5	Maintenance Personnel	Not Implemented	No	Manage
MP-1	Policy and Procedures	Inherited	Yes	Manage
MP-2	Media Access	Inherited	Yes	Manage
MP-6	Media Sanitization	Inherited	Yes	Manage
MP-7	Media Use	Inherited	Yes	Manage
PE-1	Policy and Procedures	Inherited	Yes	Manage
PE-12	Emergency Lighting	Inherited	Yes	Manage
PE-13	Fire Protection	Inherited	Yes	Manage
PE-14	Environmental Controls	Inherited	Yes	Manage
PE-15	Water Damage Protection	Inherited	Yes	Manage
PE-16	Delivery and Removal	Inherited	Yes	Manage
PE-2	Physical Access Authorizations	Inherited	Yes	Manage
PE-3	Physical Access Control	Inherited	Yes	Manage
PE-6	Monitoring Physical Access	Inherited	Yes	Manage
PE-8	Visitor Access Records	Inherited	Yes	Manage
PL-1	Policy and Procedures	Not Implemented	No	Manage
PL-10	Baseline Selection	Not Implemented	No	Manage
PL-11	Baseline Tailoring	Not Implemented	No	Manage
PL-2	System Security and Privacy Plans	Not Implemented	No	Manage
PL-4	Rules of Behavior	Not Implemented	No	Manage
PS-1	Policy and Procedures	Inherited	Yes	Manage
PS-2	Position Risk Designation	Inherited	Yes	Manage
PS-3	Personnel Screening	Inherited	Yes	Manage
PS-4	Personnel Termination	Inherited	Yes	Manage
PS-5	Personnel Transfer	Inherited	Yes	Manage
PS-6	Access Agreements	Inherited	Yes	Manage
PS-7	External Personnel Security	Inherited	Yes	Manage
PS-8	Personnel Sanctions	Inherited	Yes	Manage
PS-9	Position Descriptions	Inherited	Yes	Manage
RA-1	Policy and Procedures	Not Implemented	No	Manage
RA-2	Security Categorization	Not Implemented	No	Manage
RA-3	Risk Assessment	Not Implemented	No	Manage
RA-5	Vulnerability Monitoring and Scanning	Not Implemented	No	Manage
RA-7	Risk Response	Not Implemented	No	Manage
RA-9	Criticality Analysis	Not Implemented	No	Manage
SA-1	Policy and Procedures	Not Implemented	No	Manage
SA-10	Developer Configuration Management	Not Implemented	No	Manage
SA-11	Developer Testing and Evaluation	Not Implemented	No	Manage
SA-2	Allocation of Resources	Not Implemented	No	Manage
SA-3	System Development Life Cycle	Not Implemented	No	Manage
SA-4	Acquisition Process	Inherited	Yes	Manage
SA-5	System Documentation	Inherited	Yes	Manage
SA-8	Security and Privacy Engineering Principles	Not Implemented	No	Manage
SA-9	External System Services	Inherited	Yes	Manage
SC-1	Policy and Procedures	Not Implemented	No	Manage
SC-12	Cryptographic Key Establishment and Management	Not Implemented	No	Manage
SC-13	Cryptographic Protection	Not Implemented	No	Manage
SC-15	Collaborative Computing Devices and Applications	Not Implemented	No	Manage
SC-20	Secure Name/address Resolution Service (authoritative Source)	Not Implemented	No	Manage
SC-21	Secure Name/address Resolution Service (recursive or Caching Resolver)	Not Implemented	No	Manage
SC-22	Architecture and Provisioning for Name/address Resolution Service	Not Implemented	No	Manage
SC-39	Process Isolation	Not Implemented	No	Manage
SC-5	Denial-of-service Protection	Not Implemented	No	Manage
SC-7	Boundary Protection	Not Implemented	No	Manage
SI-1	Policy and Procedures	Not Implemented	No	Manage
SI-12	Information Management and Retention	Not Implemented	No	Manage
SI-2	Flaw Remediation	Not Implemented	No	Manage
SI-3	Malicious Code Protection	Not Implemented	No	Manage
SI-4	System Monitoring	Not Implemented	No	Manage
SI-5	Security Alerts, Advisories, and Directives	Not Implemented	No	Manage
SR-1	Policy and Procedures	Not Implemented	No	Manage
SR-10	Inspection of Systems or Components	Not Implemented	No	Manage
SR-11	Component Authenticity	Not Implemented	No	Manage
SR-12	Component Disposal	Not Implemented	No	Manage
SR-2	Supply Chain Risk Management Plan	Not Implemented	No	Manage
SR-9	Tamper Resistance and Detection	Not Implemented	No	Manage
AC-1	Policy and Procedures	Implemented	No	Manage

Control ID	Name	Actions
AC-14	Permitted Actions Without Identification or Authentication	Manage
AC-1	Policy and Procedures	Manage

Control ID	Name	Actions

Control ID	Name	Inherited From	Actions
CP-9	System Backup	AWS	Manage
MP-1	Policy and Procedures	AWS	Manage
MP-2	Media Access	AWS	Manage
MP-6	Media Sanitization	AWS	Manage
MP-7	Media Use	AWS	Manage
PE-1	Policy and Procedures	AWS	Manage
PE-12	Emergency Lighting	AWS	Manage
PE-13	Fire Protection	AWS	Manage
PE-14	Environmental Controls	AWS	Manage
PE-15	Water Damage Protection	AWS	Manage
PE-16	Delivery and Removal	AWS	Manage
PE-2	Physical Access Authorizations	AWS	Manage
PE-3	Physical Access Control	AWS	Manage
PE-6	Monitoring Physical Access	AWS	Manage
PE-8	Visitor Access Records	AWS	Manage
PS-1	Policy and Procedures	AWS	Manage
PS-2	Position Risk Designation	AWS	Manage
PS-3	Personnel Screening	AWS	Manage
PS-4	Personnel Termination	AWS	Manage
PS-5	Personnel Transfer	AWS	Manage
PS-6	Access Agreements	AWS	Manage
PS-7	External Personnel Security	AWS	Manage
PS-8	Personnel Sanctions	AWS	Manage
PS-9	Position Descriptions	AWS	Manage
SA-4	Acquisition Process	AWS	Manage
SA-5	System Documentation	AWS	Manage
SA-9	External System Services	AWS	Manage

Control ID	Name	Actions
AC-17	Remote Access	Manage
AC-18	Wireless Access	Manage
AC-19	Access Control for Mobile Devices	Manage
AC-2	Account Management	Manage
AC-20	Use of External Systems	Manage
AC-22	Publicly Accessible Content	Manage
AC-3	Access Enforcement	Manage
AC-7	Unsuccessful Logon Attempts	Manage
AC-8	System Use Notification	Manage
AT-1	Policy and Procedures	Manage
AT-2	Literacy Training and Awareness	Manage
AT-3	Role-based Training	Manage
AT-4	Training Records	Manage
AU-1	Policy and Procedures	Manage
AU-11	Audit Record Retention	Manage
AU-12	Audit Record Generation	Manage
AU-2	Event Logging	Manage
AU-3	Content of Audit Records	Manage
AU-4	Audit Log Storage Capacity	Manage
AU-5	Response to Audit Logging Process Failures	Manage
AU-6	Audit Record Review, Analysis, and Reporting	Manage
AU-7	Audit Record Reduction and Report Generation	Manage
AU-8	Time Stamps	Manage
AU-9	Protection of Audit Information	Manage
CA-1	Policy and Procedures	Manage
CA-2	Control Assessments	Manage
CA-3	Information Exchange	Manage
CA-5	Plan of Action and Milestones	Manage
CA-6	Authorization	Manage
CA-7	Continuous Monitoring	Manage
CA-9	Internal System Connections	Manage
CM-1	Policy and Procedures	Manage
CM-10	Software Usage Restrictions	Manage
CM-11	User-installed Software	Manage
CM-2	Baseline Configuration	Manage
CM-4	Impact Analyses	Manage
CM-6	Configuration Settings	Manage
CM-7	Least Functionality	Manage
CM-8	System Component Inventory	Manage
CP-1	Policy and Procedures	Manage
CP-10	System Recovery and Reconstitution	Manage
CP-2	Contingency Plan	Manage
CP-3	Contingency Training	Manage
CP-4	Contingency Plan Testing	Manage
IA-1	Policy and Procedures	Manage
IA-12	Identity Proofing	Manage
IA-2	Identification and Authentication (organizational Users)	Manage
IA-4	Identifier Management	Manage
IA-5	Authenticator Management	Manage
IA-8	Identification and Authentication (non-organizational Users)	Manage
IR-1	Policy and Procedures	Manage
IR-2	Incident Response Training	Manage
IR-4	Incident Handling	Manage
IR-5	Incident Monitoring	Manage
IR-6	Incident Reporting	Manage
IR-7	Incident Response Assistance	Manage
IR-8	Incident Response Plan	Manage
MA-1	Policy and Procedures	Manage
MA-2	Controlled Maintenance	Manage
MA-4	Nonlocal Maintenance	Manage
MA-5	Maintenance Personnel	Manage
PL-1	Policy and Procedures	Manage
PL-10	Baseline Selection	Manage
PL-11	Baseline Tailoring	Manage
PL-2	System Security and Privacy Plans	Manage
PL-4	Rules of Behavior	Manage
RA-1	Policy and Procedures	Manage
RA-2	Security Categorization	Manage
RA-3	Risk Assessment	Manage
RA-5	Vulnerability Monitoring and Scanning	Manage
RA-7	Risk Response	Manage
RA-9	Criticality Analysis	Manage
SA-1	Policy and Procedures	Manage
SA-10	Developer Configuration Management	Manage
SA-11	Developer Testing and Evaluation	Manage
SA-2	Allocation of Resources	Manage
SA-3	System Development Life Cycle	Manage
SA-8	Security and Privacy Engineering Principles	Manage
SC-1	Policy and Procedures	Manage
SC-12	Cryptographic Key Establishment and Management	Manage
SC-13	Cryptographic Protection	Manage
SC-15	Collaborative Computing Devices and Applications	Manage
SC-20	Secure Name/address Resolution Service (authoritative Source)	Manage
SC-21	Secure Name/address Resolution Service (recursive or Caching Resolver)	Manage
SC-22	Architecture and Provisioning for Name/address Resolution Service	Manage
SC-39	Process Isolation	Manage
SC-5	Denial-of-service Protection	Manage
SC-7	Boundary Protection	Manage
SI-1	Policy and Procedures	Manage
SI-12	Information Management and Retention	Manage
SI-2	Flaw Remediation	Manage
SI-3	Malicious Code Protection	Manage
SI-4	System Monitoring	Manage
SI-5	Security Alerts, Advisories, and Directives	Manage
SR-1	Policy and Procedures	Manage
SR-10	Inspection of Systems or Components	Manage
SR-11	Component Authenticity	Manage
SR-12	Component Disposal	Manage
SR-2	Supply Chain Risk Management Plan	Manage
SR-9	Tamper Resistance and Detection	Manage

ya

Assessment & Authorization Status

Current Status:

Assessment Actions:

Complete Assessment:

System Description

System Details

AWS Services

Security Controls

Plan of Action & Milestones (POAMs)