at least every 3 years

at least annually

significant changes

twenty-four (24) hours

eight (8) hours

eight (8) hours

at least annually

see additional Requirements and Guidance

see additional Requirements and Guidance

at least quarterly

at least every 3 years

at least annually

significant changes

at least annually

at least annually

at least annually

at least annually

at least annually

at least one (1) year or 1 year after completion of a specific training program

at least every 3 years

at least annually

significant changes

successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes

organization-defined subset of the auditable events defined in AU-2a to be audited continually for each identified event.

organization-defined subset of the auditable events defined in AU-2a to be audited continually for each identified event.

annually and whenever there is a change in the threat environment

overwrite oldest record

at least weekly

one second granularity of time measurement

a time period in compliance with M-21-31

all information system and network components where audit capability is deployed/available

at least every 3 years

at least annually

significant changes

at least annually

individuals or roles to include FedRAMP PMO

at least annually and on input from AO

at least monthly

in accordance with OMB A-130 requirements or when a significant change occurs

to include AO

to include AO

at least annually

at least every 3 years

at least annually

significant changes

at least annually and when a significant change occurs

to include when directed by the AO

at least monthly

Continuously (via CM-7 (5))

at least every 3 years

at least annually

significant changes

at least annually

*See Additional Requirements

at least annually

at least annually

at least every 3 years

classroom exercise/table top written tests

classroom exercise/table top written tests

daily incremental; weekly full

daily incremental; weekly full

daily incremental; weekly full

at least every 3 years

at least annually

significant changes

at a minimum, the ISSO (or similar role within the organization)

at least two (2) years

at least every 3 years

at least annually

significant changes

ten (10) days for privileged users, thirty (30) days for Incident Response roles

at least annually

at least annually

US-CERT incident reporting timelines as specified in NIST Special Publication 800-61 (as amended)

at least annually

see additional FedRAMP Requirements and Guidance

see additional FedRAMP Requirements and Guidance

see additional FedRAMP Requirements and Guidance

see additional FedRAMP Requirements and Guidance

at least every 3 years

at least annually

significant changes

at least every 3 years

at least annually

significant changes

techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware

techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware

techniques and procedures IAW NIST SP 800-88 Section 4: Reuse and Disposal of Storage Media and Hardware

at least every 3 years

at least annually

significant changes

at least annually

CSP defined physical access control systems/devices AND guards

in all circumstances within restricted access area where the information system resides

at least annually

at least annually

at least annually

at least monthly

for a minimum of one (1) year

at least monthly

consistent with American Society of Heating, Refrigerating and Air-conditioning Engineers (ASHRAE) document entitled Thermal Guidelines for Data Processing Environments

continuously

all information system components

all information system components

at least every 3 years

at least annually

significant changes

at least annually

at least every 3 years

at least annually and when the rules are revised or changed

at least annually and when a significant change occurs

at least every 3 years

at least annually

significant changes

at least every three years

for national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance.

For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year. There is no reinvestigation for other moderate risk positions or any low risk positions

for national security clearances; a reinvestigation is required during the fifth (5th) year for top secret security clearance, the tenth (10th) year for secret security clearance, and fifteenth (15th) year for confidential security clearance.

For moderate risk law enforcement and high impact public trust level, a reinvestigation is required during the fifth (5th) year. There is no reinvestigation for other moderate risk positions or any low risk positions

four (4) hours

twenty-four (24) hours

twenty-four (24) hours

at least annually

at least annually and any time there is a change to the user's level of access

including access control personnel responsible for the system and/or facilities, as appropriate

within twenty-four (24) hours

at a minimum, the ISSO and/or similar role within the organization

at least every 3 years

at least annually

significant changes

security assessment report

at least every three (3) years and when a significant change occurs

at least every three (3) years

monthly operating system/infrastructure; monthly web applications (including APIs) and databases

monthly operating system/infrastructure; monthly web applications (including APIs) and databases

high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate-risk vulnerabilities mitigated within ninety (90) days from date of discovery; low risk vulnerabilities mitigated within one hundred and eighty (180) days from date of discovery

prior to a new scan

at least every 3 years

at least annually

significant changes

at a minimum, the ISSO (or similar role within the organization)

Appropriate FedRAMP Security Controls Baseline (s) if Federal information is processed or stored within the external system

Federal/FedRAMP Continuous Monitoring requirements must be met for external systems where Federal information is processed or stored

at least every 3 years

at least annually

significant changes

Protect against

at a minimum: ICMP (ping) flood, SYN flood, slowloris, buffer overflow attack, and volume attack

In accordance with Federal requirements

FIPS-validated or NSA-approved cryptography

no exceptions for computing devices

all information system components storing Federal data or system data that must be protected at the High or Moderate impact levels

at least every 3 years

at least annually

significant changes

within thirty (30) days of release of updates

signature based and non-signature based

at least weekly

to include endpoints and network entry and exit points

to include blocking and quarantining malicious code

administrator or defined security personnel near-realtime

to include US-CERT and Cybersecurity and Infrastructure Security Agency (CISA) Directives

to include system security personnel and administrators with configuration/patch-management responsibilities

to include chief privacy and ISSO and/or similar role or designees

at least every 3 years

at least annually

significant changes

at least annually

notification of supply chain compromises and results of assessment or audits

all