FedRAMP Low Revision 4

fedramp_low_revision_4_aws

FedRAMP-Low-Revision-4

OfficialVerified

The Federal Risk and Authorization Management Program (FedRAMP) was established in 2011. It provides a cost-effective, risk-based approach for the adoption and use of cloud services by the U.S. federal government. FedRAMP empowers federal agencies to use modern cloud technologies, with an emphasis on the security and protection of federal information.

18requirements76checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance fedramp_low_revision_4_aws

Requirements (18)

Access Control (AC)368

ac-2Manage system accounts, group memberships, privileges, workflow, notifications, deactivations, and authorizations.28

Attributes

Item Id: ac-2
Section: Access Control (AC)
Service: aws

ac-3The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.20

Attributes

Item Id: ac-3
Section: Access Control (AC)
Service: aws

ac-17Authorize remote access systems prior to connection. Enforce remote connection requirements to information systems.20

Attributes

Item Id: ac-17
Section: Access Control (AC)
Service: aws

Audit and Accountability (AU)315

au-2The organization: a. Determines that the information system is capable of auditing the following events: [Assignment: organization-defined auditable events]; b. Coordinates the security audit function with other organizational entities requiring audit- related information to enhance mutual support and to help guide the selection of auditable events; c. Provides a rationale for why the auditable events are deemed to be adequate support after- the-fact investigations of security incidents10

Attributes

Item Id: au-2
Section: Audit and Accountability (AU)
Service: aws

au-9The information system protects audit information and audit tools from unauthorized access, modification, and deletion.4

Attributes

Item Id: au-9
Section: Audit and Accountability (AU)
Service: aws

au-11The organization retains audit records for at least 90 days to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.1

Attributes

Item Id: au-11
Section: Audit and Accountability (AU)
Service: aws

Security Assessment And Authorization (CA)110

ca-7Continuously monitor configuration management processes. Determine security impact, environment and operational risks.10

Attributes

Item Id: ca-7
Section: Security Assessment And Authorization (CA)
Service: aws

Configuration Management (CM)222

cm-2The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.19

Attributes

Item Id: cm-2
Section: Configuration Management (CM)
Service: aws

cm-8The organization develops and documents an inventory of information system components that accurately reflects the current information system, includes all components within the authorization boundary of the information system, is at the level of granularity deemed necessary for tracking and reporting and reviews and updates the information system component inventory.3

Attributes

Item Id: cm-8
Section: Configuration Management (CM)
Service: aws

Contingency Planning (CP)212

cp-9The organization conducts backups of user-level information, system-level information and information system documentation including security-related documentation contained in the information system and protects the confidentiality, integrity, and availability of backup information at storage locations.5

Attributes

Item Id: cp-9
Section: Contingency Planning (CP)
Service: aws

cp-10The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.7

Attributes

Item Id: cp-10
Section: Contingency Planning (CP)
Service: aws

Identification and Authentication (IA)15

ia-2The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).5

Attributes

Item Id: ia-2
Section: Identification and Authentication (IA)
Service: aws

Incident Response (IR)17

ir-4The organization implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery, coordinates incident handling activities with contingency planning activities and incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.7

Attributes

Item Id: ir-4
Section: Incident Response (IR)
Service: aws

System and Services Acquisition (SA)11

sa-3The organization manages the information system using organization-defined system development life cycle, defines and documents information security roles and responsibilities throughout the system development life cycle, identifies individuals having information security roles and responsibilities and integrates the organizational information security risk management process into system development life cycle activities.1

Attributes

Item Id: sa-3
Section: System and Services Acquisition (SA)
Service: aws

System and Communications Protection (SC)433

sc-5The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or references to sources for such information] by employing [Assignment: organization-defined security safeguards].8

Attributes

Item Id: sc-5
Section: System and Communications Protection (SC)
Service: aws

sc-7The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.19

Attributes

Item Id: sc-7
Section: System and Communications Protection (SC)
Service: aws

sc-12The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].2

Attributes

Item Id: sc-12
Section: System and Communications Protection (SC)
Service: aws

sc-13The information system implements FIPS-validated or NSA-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.4

Attributes

Item Id: sc-13
Section: System and Communications Protection (SC)
Service: aws