Cybersecurity/Goverment - Revision history

Mflavell: /* FedRAMP High */

2026-10-22T21:51:06Z

FedRAMP High

← Older revision		Revision as of 21:51, 22 October 2026
Line 162:		Line 162:
	* 4.0 - 6.9 = 90 days		* 4.0 - 6.9 = 90 days
	* 0.1 - 3.9 = 180 days		* 0.1 - 3.9 = 180 days


			=== Incident Response ===

			* Incidents must be reported to US-CERT or DOD in one hour


			=== Crypto and Key Management ===

			* Must use CMK - Customer managed keys
			* Must use FIPS 140-2 / 140-3 Level 3 HSM

	= NIST 800-53 Rev 5 =		= NIST 800-53 Rev 5 =
	= GovRAMP/StateRAMP =		= GovRAMP/StateRAMP =
	= 3PAO =		= 3PAO =

2026-10-22T21:46:06Z

Continious Monitoring

← Older revision		Revision as of 21:46, 22 October 2026
Line 155:		Line 155:
	* POA&M Logs - showing remediation		* POA&M Logs - showing remediation
	* Annual Security Assessment - review of core controls and major changes to the system		* Annual Security Assessment - review of core controls and major changes to the system


			ConMom SLAs based on CVSS score:

			* 7.0 - 10 = 30 days
			* 4.0 - 6.9 = 90 days
			* 0.1 - 3.9 = 180 days

	= NIST 800-53 Rev 5 =		= NIST 800-53 Rev 5 =
	= GovRAMP/StateRAMP =		= GovRAMP/StateRAMP =
	= 3PAO =		= 3PAO =

2026-10-22T21:42:04Z

Continious Monitoring

← Older revision		Revision as of 21:42, 22 October 2026
Line 147:		Line 147:
	* Plan of Action with Milestones (POA&M)		* Plan of Action with Milestones (POA&M)
	** Used to track and remediate vulnerabilities		** Used to track and remediate vulnerabilities



	==== Continious Monitoring ====		==== Continious Monitoring ====

2026-10-22T21:41:44Z

Comtinious Monitoring

← Older revision		Revision as of 21:41, 22 October 2026
Line 148:		Line 148:
	** Used to track and remediate vulnerabilities		** Used to track and remediate vulnerabilities

	==== ~~Comtinious~~ Monitoring ====		==== Continious Monitoring ====

	* Monthly scan reports		* Monthly scan reports

2026-10-22T21:41:26Z

Independent assessment

← Older revision		Revision as of 21:41, 22 October 2026
Line 136:		Line 136:

	These are validated by an accredieted FedRAMP 3PAO proving the controls are implemented.		These are validated by an accredieted FedRAMP 3PAO proving the controls are implemented.


	* Security Assesment Plan (SAP)		* Security Assesment Plan (SAP)
Line 148:		Line 147:
	* Plan of Action with Milestones (POA&M)		* Plan of Action with Milestones (POA&M)
	** Used to track and remediate vulnerabilities		** Used to track and remediate vulnerabilities


	==== Comtinious Monitoring ====		==== Comtinious Monitoring ====

2026-10-22T21:41:08Z

FedRAMP High

@@ Line 110: / Line 110: @@
 Continues monitoring (3PAO) is reqired.
 === FedRAMP requires arifacts ===
 These are documents:
 = NIST 800-53 Rev 5 =
 = GovRAMP/StateRAMP =
 = 3PAO =

2026-10-22T21:20:10Z

FedRAMP High

← Older revision		Revision as of 21:20, 22 October 2026
Line 110:		Line 110:

	Continues monitoring (3PAO) is reqired.		Continues monitoring (3PAO) is reqired.

			=== FedRAMP requires arifacts ===
			These are documents:


	= NIST 800-53 Rev 5 =		= NIST 800-53 Rev 5 =
	= GovRAMP/StateRAMP =		= GovRAMP/StateRAMP =
	= 3PAO =		= 3PAO =

2026-10-22T18:05:37Z

FedRAMP High

← Older revision		Revision as of 18:05, 22 October 2026
Line 103:		Line 103:

	= FedRAMP High =		= FedRAMP High =
			This is for IL4 and below - designed for cloud systems.

			Used in situations where a data breach would cause "castastropic effects" in national security or human life.

			NIST SP 800-53 is used for this

			Continues monitoring (3PAO) is reqired.

	= NIST 800-53 Rev 5 =		= NIST 800-53 Rev 5 =
	= GovRAMP/StateRAMP =		= GovRAMP/StateRAMP =
	= 3PAO =		= 3PAO =

2026-10-22T17:52:57Z

DoD IL4/IL5

← Older revision		Revision as of 17:52, 22 October 2026
Line 99:		Line 99:


	Where is Top Secret in this?
	~~This~~ is goverened by ICD 503 instead of a SRG and operate on dedicated air gapped networks.		Where is Top Secret in this? - Top Secret is goverened by ICD 503 instead of a SRG and operate on dedicated air gapped networks.

	= FedRAMP High =		= FedRAMP High =

2026-10-22T17:47:06Z

DoD IL4/IL5

← Older revision		Revision as of 17:47, 22 October 2026
Line 79:		Line 79:
	** Non-sensative public data		** Non-sensative public data
	** Must meet FedRAMP moderate baseline		** Must meet FedRAMP moderate baseline
	**

	* IL4		* IL4
Line 86:		Line 86:
	** Requies background checks		** Requies background checks
	** An example could be a NASA system		** An example could be a NASA system


	* IL5		* IL5
Line 91:		Line 92:
	** Must be isolated from non federal tenants / use of GovCloud		** Must be isolated from non federal tenants / use of GovCloud
	** US person only		** US person only
	*


			* IL6
			** Data classified to the secret level
			** Personel must hold secret clearance


			Where is Top Secret in this?
			This is goverened by ICD 503 instead of a SRG and operate on dedicated air gapped networks.

	= FedRAMP High =		= FedRAMP High =