Question Regarding SA-4 in SSP Appendix A Low FedRAMP Controls

[Telos-sa]

• This is a ...

  • [ ] concern - I think something needs to be different.
  • [X] question - I didn't understand something.
  • [ ] kudos - I found something helpful and want to encourage it in future FedRAMP publications.
  • [ ] request - I would like to see something additional provided.

• This relates to ...

  • [ ] the FedRAMP OSCAL Registry (Excel File)
  • [ ] the Guide to OSCAL-based FedRAMP Content (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP System Security Plans (SSP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Plans (SAP) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Security Assessment Results (SAR) (PDF)
  • [ ] the Guide to OSCAL-based FedRAMP Plan of Action and Milestones (POA&M) (PDF)
  • [ ] the FedRAMP SSP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAP OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP SAR OSCAL Template (JSON or XML Format)
  • [ ] the FedRAMP POA&M OSCAL Template (JSON or XML Format)
  • [ ] General/Overall
  • [X] Other

• Where, exactly? The SSP Appendix A Low FedRAMP Security Controls document for NIST Rev 5. SSP-Appendix-A-Low-FedRAMP-Security-Controls.docx

• What is your feedback? Under each control, our understanding is that the table entitled "What is the solution and how is it implemented?" contains which control parts are included in the low baseline, and the ones that only have an empty row instead of rows with part names mean that the base control is included. SA-4 is the only control to have a blank row in addition to rows with named parts. Our assumption is that this means both the base control and the parts in the table are included. Is this correct?

[volpet2014]

This issue is being worked with the document template folks at PMO and will be address by them forthcoming.