Address SSP points for 9+10+AC+IA raised in JAB Q&A sessions

[mogul]

In order to satisfy the needs of the JAB technical reviewers, we want comments in the latest version of the "Cloud.gov JAB Review Comments Workbook Master" referring to SSP sections 9+10+AC+IA left in the "active" state to be addressed via an updated SSP.

See Noah's meeting notes here and shared meeting notes here for additional detail.

This needs to be done by 11/29.

Latest SSP draft is here.

Note that IA-2 (11) is tracked at https://github.com/18F/cg-product/issues/431.

Acceptance Criteria

• [ ] We have a draft of our SSP in MAX.gov with these sections and families updated.
• [x] CIS is updated to reflect these changes.
• [ ] We've emailed our PMO to let them know we've done this.

[brittag]

• As part of this update, also separate out the phone numbers from page 14 and 15 into a separate attachment, so that the main part SSP document can be public.

[brittag]

We worked on AC feedback today and uploaded SSP 1.13.

[brittag]

I worked on more AC and IA items, and I uploaded SSP 1.14. I updated the CIS based on items changed so far in AC and IA.

Remaining items:

• [ ] 3 AC items need Atlas assistance for explaining ports and encryption.
• [ ] 7 IA items need Atlas assistance for explaining identifiers and SAML.
• [ ] 1 IA item needs review to see if we really satisfy the requirement.
• [ ] 1 IA item is blocked on GSA IT (https://github.com/18F/cg-product/issues/431).
• [ ] ~15 items for Sections 1-11 still need evaluation.

[brittag]

AC items are complete, and nearly all IA and 9-11 items are complete. Remaining incomplete items:

IA:

• Item 131 - we plan to update this item after we update our IA-2 (11) implementation, but our implementation is blocked by waiting for GSA IT right now (https://github.com/18F/cg-product/issues/431).
• Item 133 - I need further collaboration with our technical experts to figure out the right way to clarify IA-3.

1-11:

• To address comment 11, section 10.1.2.2. (Tooling Private Subnets) needs more in-depth updating about VPCs; I need to consult with our technical experts on this one.
• To address comment 18, I’ve filed an update for our diagram (https://github.com/18F/cg-diagrams/pull/35) but it hasn’t been merged yet, and I need to consult with our technical experts for additional SSP updates about VPCs.
• To address comments 761 and 763, I need to check with our 18F AO to figure out the right adjustment to the language.

I'm about to upload this SSP version (1.15) to MAX and email it to our PMO as a good chunk of progress for now.

[brittag]

Version 1.16, with all of those things resolved except comment 11, is uploaded to MAX.

[brittag]

Status: We updated the services table as part of this task too (since it's related to AC/IA); an updated draft is on MAX.gov and emailed to our PMO.

We made some progress on comment 11 research but are still working on it.

[brittag]

• [x] Also we separately noticed that AC-3 is really confusing; we should fix it.

[brittag]

We resolved comment 11; those Nessus notes are here. I updated AC-3. Those updates are in version 1.21.

We'll ship this update to our PMO along with other updates to other families, so I moved this to "awaiting acceptance".

[brittag]

Sending this today.