bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/fedramp/appendices-guide.md

@@ -1,209 +1,209 @@
-# FedRAMP SSP Appendices Guide (A–Q)
-
-All FedRAMP SSP appendices must use official FedRAMP templates where indicated.
-Templates: https://www.fedramp.gov/rev5/documents-templates/
-
----
-
-## Appendix A — Acronyms & Glossary
-**Required:** Yes | **Author:** CSP
-- List all acronyms used in the SSP
-- Define any system-specific or agency-specific terms
-- FedRAMP provides a standard glossary; supplement with system-specific terms
-- Keep synchronized with the SSP body — if a new term appears in Section 7, add it here
-
----
-
-## Appendix B — Related Laws & Regulations
-**Required:** Yes | **Author:** CSP (use FedRAMP template as base)
-- Enumerates applicable federal laws, Executive Orders, OMB memos, and standards
-- Core list includes: FISMA 2014, Privacy Act of 1974, E-Government Act (Section 208), FIPS 199, FIPS 200, NIST SP 800-53 Rev 5, OMB Circular A-130
-- Add agency-specific requirements if applicable (e.g., HIPAA, CJIS, IRS Publication 1075)
-- Review annually — regulatory landscape changes; new OMB guidance and executive orders may require additions
-
-**Common mistake:** Using the Rev 4 version of this appendix; ensure it reflects Rev 5 requirements and current OMB directives.
-
----
-
-## Appendix C — Security Policies & Procedures
-**Required:** Yes | **Author:** CSP
-- Attach or reference all CSP security policies and standard operating procedures
-- Must cover each NIST 800-53 Rev 5 control family that has policies and procedures controls (e.g., AC-1, AU-1, CA-1, CM-1, etc.)
-- Policies must be: approved by senior leadership, dated, versioned, and reviewed at defined intervals
-- Common approach: include a policy index table in the appendix body, with the actual policy documents attached or linked via evidence repository
-
-**Common finding:** Policies exist but are not dated or version-controlled; policies reference Rev 4 controls.
-
----
-
-## Appendix D — User Guide
-**Required:** Yes | **Author:** CSP
-- End-user guide for the cloud service
-- Describes: how to access the system, user responsibilities, what the system does, how to report security incidents
-- For SaaS offerings, this may be a customer-facing documentation excerpt
-- Must align with the Rules of Behavior (Appendix E)
-
----
-
-## Appendix E — Rules of Behavior (RoB)
-**Required:** Yes | **Author:** CSP (FedRAMP template available)
-- Signed by all users prior to access
-- Covers: acceptable use, data handling obligations, password requirements, incident reporting obligations, consequences of non-compliance
-- Must be re-signed annually or when updated
-- Keep signature records — auditors will ask for evidence of signed RoBs
-
-**Common finding:** RoB exists but no evidence of user signatures; RoB not updated after major policy changes.
-
----
-
-## Appendix F — IT Contingency Plan (ISCP)
-**Required:** Yes | **Author:** CSP (FedRAMP ISCP template — updated December 2024)
-- Use the FedRAMP Information System Contingency Plan (ISCP) template
-- Must include: system description, activation criteria, notification procedures, recovery procedures, reconstitution, testing records
-- RTO and RPO must be defined and achievable based on architecture
-- Must be tested at least annually — tabletop minimum; functional exercise preferred for High baseline
-- Append the most recent test results
-
-**Common finding:** Plan exists but has never been tested; RTO/RPO are aspirational and not validated by DR testing.
-
----
-
-## Appendix G — Configuration Management Plan (CMP)
-**Required:** Yes | **Author:** CSP
-- Describes how configuration baselines are established, maintained, and enforced
-- Must reference specific baseline standards used (CIS Benchmarks, DISA STIGs)
-- Documents the change control board (CCB) process and approval chain
-- Defines how configuration deviations are documented and approved
-- Links to the system inventory (IIW — Appendix K)
-
----
-
-## Appendix H — Incident Response Plan (IRP)
-**Required:** Yes | **Author:** CSP
-- Must follow NIST SP 800-61 Rev 2 lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Post-Incident
-- FedRAMP-specific reporting SLAs:
-  - Report to US-CERT within **1 hour** of incident discovery (high-priority incidents)
-  - Report to agency AO within **1 hour** for incidents affecting federal data
-- Include contact list: CSP IR team, agency AO contacts, US-CERT (CISA), FedRAMP PMO Security Inbox
-- Must include the FedRAMP Security Inbox address for PMO notifications
-- Must be tested at least annually (tabletop or functional exercise)
-
-**Common finding:** IRP does not include agency AO notification procedure; reporting timeframes do not match FedRAMP SLAs; no evidence of annual testing.
-
----
-
-## Appendix I — Control Implementation Summary (CIS) / Customer Responsibility Matrix (CRM)
-**Required:** Yes | **Author:** CSP (FedRAMP CIS/CRM template)
-- One of the most operationally important appendices for agency customers
-- **CIS tab**: Lists every control in the baseline and its implementation status (Fully Implemented / Partially Implemented / Planned / Not Applicable / Alternative)
-- **CRM tab**: For each shared/hybrid control, defines exactly what the CSP implements vs. what the customer/agency must implement
-- Agency customers use the CRM to understand their inherited security obligations
-- Must be kept current — a stale CRM is a common agency complaint and a finding during re-authorization
-
-**Common mistake:** CRM lists "Customer Responsibility" generically without specifying what the agency must actually do; shared controls marked as fully CSP-implemented when agencies have configuration responsibilities.
-
----
-
-## Appendix J — FIPS 199 Categorization
-**Required:** Yes | **Author:** CSP
-- Documents the formal FIPS 199 impact determination
-- Categorizes Confidentiality, Integrity, and Availability separately for each information type
-- Overall impact level = high-water mark (highest individual rating)
-- Must justify each categorization with the types of federal information the system processes
-- Ties directly to which FedRAMP baseline (Low / Moderate / High) applies
-
----
-
-## Appendix K — Integrated Inventory Workbook (IIW)
-**Required:** Yes | **Author:** CSP (FedRAMP IIW template — updated December 2024)
-- Complete inventory of every asset within the authorization boundary
-- Tabs typically include: hardware, software, services, databases, network components, virtual instances
-- Must be 100% accurate — auditors sample from IIW and will flag missing assets as findings
-- Updated continuously; submitted monthly during ConMon
-- Must include: asset name/ID, OS/version, IP address, function, patch level, FedRAMP status, POC
-
-**Common finding:** IIW is out of date; cloud-native ephemeral resources (auto-scaling instances, containers) not accounted for with appropriate dynamic inventory process.
-
----
-
-## Appendix L — Cryptographic Modules Table
-**Required:** Yes | **Author:** CSP
-- Lists every cryptographic module in use within the boundary
-- For each module: vendor, product name, version, FIPS 140-2/3 validation certificate number, use case (encryption at rest, in transit, key management, etc.)
-- All modules must have active FIPS 140-2 or 140-3 validation certificates (check NIST CMVP)
-- Identifies any non-FIPS algorithms still in use (must be remediated or deviation-approved)
-
-**Common finding:** Module versions have changed since last authorization and certificates are no longer valid; legacy algorithms (MD5, SHA-1, DES, RC4) found in use without deviation.
-
----
-
-## Appendix M — Continuous Monitoring Plan
-**Required:** Yes | **Author:** CSP
-- Documents the ongoing ConMon program
-- Must specify: scan frequency and tools, vulnerability management SLAs, POA&M update cadence, reporting schedule to agency AO, annual assessment approach
-- Scan requirements: OS/infrastructure monthly; web app monthly; database monthly; container images per CI/CD pipeline
-- References the Security Inbox requirement (effective January 2026)
-
----
-
-## Appendix N — Separation of Duties Matrix
-**Required:** Conditional (required when separation of duties is a compensating control or specifically required by agency) | **Author:** CSP
-- Documents which roles can and cannot be combined
-- Relevant when a small team might otherwise hold conflicting privileges
-- Ties to AC-5 (Separation of Duties) control implementation
-
----
-
-## Appendix O — Plan of Action & Milestones (POA&M)
-**Required:** Yes | **Author:** CSP (FedRAMP POA&M template)
-- See `references/poam-guide.md` for full field definitions and SLA table
-- Living document — updated monthly during ConMon
-- Submitted monthly to agency AO(s)
-- Every SAR finding must appear as a POA&M row
-
----
-
-## Appendix P — Supply Chain Risk Management Plan (SCRM Plan)
-**Required:** Yes (Rev 5) | **Author:** CSP
-- New requirement introduced with NIST SP 800-53 Rev 5 (SR control family)
-- Documents how the CSP manages supply chain risks for hardware, software, and services
-- Must address: supplier assessment process, SBOM tracking, open source component vulnerability management, critical supplier identification
-- Ties to SR-1 through SR-12 control implementations
-
-**Common finding:** SCRM Plan is generic and doesn't describe the CSP's specific suppliers or risk assessment methodology; SBOM process undefined.
-
----
-
-## Appendix Q — Privacy Impact Assessment (PIA)
-**Required:** If PII is in scope | **Author:** CSP
-- Required when the system collects, processes, stores, or transmits PII
-- Must follow the E-Government Act of 2002 Section 208 PIA requirements
-- Covers: what PII is collected, why, how it's protected, retention, access controls, sharing with third parties
-- Ties to PT control family (PII Processing & Transparency) — new in Rev 5
-- Agency AO reviews PIA as part of authorization decision when PII is involved
-
-**Common finding:** PIA omits specific PII data elements; PIA not updated when new PII types are added to the system.
-
----
-
-## Quick Reference: Appendix Checklist
-
-| App | Title | Required | Template |
-|-----|-------|----------|----------|
-| A | Acronyms & Glossary | Yes | CSP-authored |
-| B | Laws & Regulations | Yes | FedRAMP base + CSP additions |
-| C | Security Policies & Procedures | Yes | CSP-authored |
-| D | User Guide | Yes | CSP-authored |
-| E | Rules of Behavior | Yes | FedRAMP template |
-| F | IT Contingency Plan (ISCP) | Yes | FedRAMP ISCP template (Dec 2024) |
-| G | Configuration Management Plan | Yes | CSP-authored |
-| H | Incident Response Plan | Yes | CSP-authored |
-| I | CIS / CRM Workbook | Yes | FedRAMP template |
-| J | FIPS 199 Categorization | Yes | CSP-authored |
-| K | Integrated Inventory Workbook (IIW) | Yes | FedRAMP template (Dec 2024) |
-| L | Cryptographic Modules Table | Yes | CSP-authored |
-| M | Continuous Monitoring Plan | Yes | CSP-authored |
-| N | Separation of Duties Matrix | Conditional | CSP-authored |
-| O | POA&M | Yes | FedRAMP template |
-| P | Supply Chain Risk Management Plan | Yes (Rev 5) | CSP-authored |
-| Q | Privacy Impact Assessment (PIA) | If PII in scope | CSP-authored |
+# FedRAMP SSP Appendices Guide (A–Q)
+
+All FedRAMP SSP appendices must use official FedRAMP templates where indicated.
+Templates: https://www.fedramp.gov/rev5/documents-templates/
+
+---
+
+## Appendix A — Acronyms & Glossary
+**Required:** Yes | **Author:** CSP
+- List all acronyms used in the SSP
+- Define any system-specific or agency-specific terms
+- FedRAMP provides a standard glossary; supplement with system-specific terms
+- Keep synchronized with the SSP body — if a new term appears in Section 7, add it here
+
+---
+
+## Appendix B — Related Laws & Regulations
+**Required:** Yes | **Author:** CSP (use FedRAMP template as base)
+- Enumerates applicable federal laws, Executive Orders, OMB memos, and standards
+- Core list includes: FISMA 2014, Privacy Act of 1974, E-Government Act (Section 208), FIPS 199, FIPS 200, NIST SP 800-53 Rev 5, OMB Circular A-130
+- Add agency-specific requirements if applicable (e.g., HIPAA, CJIS, IRS Publication 1075)
+- Review annually — regulatory landscape changes; new OMB guidance and executive orders may require additions
+
+**Common mistake:** Using the Rev 4 version of this appendix; ensure it reflects Rev 5 requirements and current OMB directives.
+
+---
+
+## Appendix C — Security Policies & Procedures
+**Required:** Yes | **Author:** CSP
+- Attach or reference all CSP security policies and standard operating procedures
+- Must cover each NIST 800-53 Rev 5 control family that has policies and procedures controls (e.g., AC-1, AU-1, CA-1, CM-1, etc.)
+- Policies must be: approved by senior leadership, dated, versioned, and reviewed at defined intervals
+- Common approach: include a policy index table in the appendix body, with the actual policy documents attached or linked via evidence repository
+
+**Common finding:** Policies exist but are not dated or version-controlled; policies reference Rev 4 controls.
+
+---
+
+## Appendix D — User Guide
+**Required:** Yes | **Author:** CSP
+- End-user guide for the cloud service
+- Describes: how to access the system, user responsibilities, what the system does, how to report security incidents
+- For SaaS offerings, this may be a customer-facing documentation excerpt
+- Must align with the Rules of Behavior (Appendix E)
+
+---
+
+## Appendix E — Rules of Behavior (RoB)
+**Required:** Yes | **Author:** CSP (FedRAMP template available)
+- Signed by all users prior to access
+- Covers: acceptable use, data handling obligations, password requirements, incident reporting obligations, consequences of non-compliance
+- Must be re-signed annually or when updated
+- Keep signature records — auditors will ask for evidence of signed RoBs
+
+**Common finding:** RoB exists but no evidence of user signatures; RoB not updated after major policy changes.
+
+---
+
+## Appendix F — IT Contingency Plan (ISCP)
+**Required:** Yes | **Author:** CSP (FedRAMP ISCP template — updated December 2024)
+- Use the FedRAMP Information System Contingency Plan (ISCP) template
+- Must include: system description, activation criteria, notification procedures, recovery procedures, reconstitution, testing records
+- RTO and RPO must be defined and achievable based on architecture
+- Must be tested at least annually — tabletop minimum; functional exercise preferred for High baseline
+- Append the most recent test results
+
+**Common finding:** Plan exists but has never been tested; RTO/RPO are aspirational and not validated by DR testing.
+
+---
+
+## Appendix G — Configuration Management Plan (CMP)
+**Required:** Yes | **Author:** CSP
+- Describes how configuration baselines are established, maintained, and enforced
+- Must reference specific baseline standards used (CIS Benchmarks, DISA STIGs)
+- Documents the change control board (CCB) process and approval chain
+- Defines how configuration deviations are documented and approved
+- Links to the system inventory (IIW — Appendix K)
+
+---
+
+## Appendix H — Incident Response Plan (IRP)
+**Required:** Yes | **Author:** CSP
+- Must follow NIST SP 800-61 Rev 2 lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Post-Incident
+- FedRAMP-specific reporting SLAs:
+  - Report to US-CERT within **1 hour** of incident discovery (high-priority incidents)
+  - Report to agency AO within **1 hour** for incidents affecting federal data
+- Include contact list: CSP IR team, agency AO contacts, US-CERT (CISA), FedRAMP PMO Security Inbox
+- Must include the FedRAMP Security Inbox address for PMO notifications
+- Must be tested at least annually (tabletop or functional exercise)
+
+**Common finding:** IRP does not include agency AO notification procedure; reporting timeframes do not match FedRAMP SLAs; no evidence of annual testing.
+
+---
+
+## Appendix I — Control Implementation Summary (CIS) / Customer Responsibility Matrix (CRM)
+**Required:** Yes | **Author:** CSP (FedRAMP CIS/CRM template)
+- One of the most operationally important appendices for agency customers
+- **CIS tab**: Lists every control in the baseline and its implementation status (Fully Implemented / Partially Implemented / Planned / Not Applicable / Alternative)
+- **CRM tab**: For each shared/hybrid control, defines exactly what the CSP implements vs. what the customer/agency must implement
+- Agency customers use the CRM to understand their inherited security obligations
+- Must be kept current — a stale CRM is a common agency complaint and a finding during re-authorization
+
+**Common mistake:** CRM lists "Customer Responsibility" generically without specifying what the agency must actually do; shared controls marked as fully CSP-implemented when agencies have configuration responsibilities.
+
+---
+
+## Appendix J — FIPS 199 Categorization
+**Required:** Yes | **Author:** CSP
+- Documents the formal FIPS 199 impact determination
+- Categorizes Confidentiality, Integrity, and Availability separately for each information type
+- Overall impact level = high-water mark (highest individual rating)
+- Must justify each categorization with the types of federal information the system processes
+- Ties directly to which FedRAMP baseline (Low / Moderate / High) applies
+
+---
+
+## Appendix K — Integrated Inventory Workbook (IIW)
+**Required:** Yes | **Author:** CSP (FedRAMP IIW template — updated December 2024)
+- Complete inventory of every asset within the authorization boundary
+- Tabs typically include: hardware, software, services, databases, network components, virtual instances
+- Must be 100% accurate — auditors sample from IIW and will flag missing assets as findings
+- Updated continuously; submitted monthly during ConMon
+- Must include: asset name/ID, OS/version, IP address, function, patch level, FedRAMP status, POC
+
+**Common finding:** IIW is out of date; cloud-native ephemeral resources (auto-scaling instances, containers) not accounted for with appropriate dynamic inventory process.
+
+---
+
+## Appendix L — Cryptographic Modules Table
+**Required:** Yes | **Author:** CSP
+- Lists every cryptographic module in use within the boundary
+- For each module: vendor, product name, version, FIPS 140-2/3 validation certificate number, use case (encryption at rest, in transit, key management, etc.)
+- All modules must have active FIPS 140-2 or 140-3 validation certificates (check NIST CMVP)
+- Identifies any non-FIPS algorithms still in use (must be remediated or deviation-approved)
+
+**Common finding:** Module versions have changed since last authorization and certificates are no longer valid; legacy algorithms (MD5, SHA-1, DES, RC4) found in use without deviation.
+
+---
+
+## Appendix M — Continuous Monitoring Plan
+**Required:** Yes | **Author:** CSP
+- Documents the ongoing ConMon program
+- Must specify: scan frequency and tools, vulnerability management SLAs, POA&M update cadence, reporting schedule to agency AO, annual assessment approach
+- Scan requirements: OS/infrastructure monthly; web app monthly; database monthly; container images per CI/CD pipeline
+- References the Security Inbox requirement (effective January 2026)
+
+---
+
+## Appendix N — Separation of Duties Matrix
+**Required:** Conditional (required when separation of duties is a compensating control or specifically required by agency) | **Author:** CSP
+- Documents which roles can and cannot be combined
+- Relevant when a small team might otherwise hold conflicting privileges
+- Ties to AC-5 (Separation of Duties) control implementation
+
+---
+
+## Appendix O — Plan of Action & Milestones (POA&M)
+**Required:** Yes | **Author:** CSP (FedRAMP POA&M template)
+- See `references/poam-guide.md` for full field definitions and SLA table
+- Living document — updated monthly during ConMon
+- Submitted monthly to agency AO(s)
+- Every SAR finding must appear as a POA&M row
+
+---
+
+## Appendix P — Supply Chain Risk Management Plan (SCRM Plan)
+**Required:** Yes (Rev 5) | **Author:** CSP
+- New requirement introduced with NIST SP 800-53 Rev 5 (SR control family)
+- Documents how the CSP manages supply chain risks for hardware, software, and services
+- Must address: supplier assessment process, SBOM tracking, open source component vulnerability management, critical supplier identification
+- Ties to SR-1 through SR-12 control implementations
+
+**Common finding:** SCRM Plan is generic and doesn't describe the CSP's specific suppliers or risk assessment methodology; SBOM process undefined.
+
+---
+
+## Appendix Q — Privacy Impact Assessment (PIA)
+**Required:** If PII is in scope | **Author:** CSP
+- Required when the system collects, processes, stores, or transmits PII
+- Must follow the E-Government Act of 2002 Section 208 PIA requirements
+- Covers: what PII is collected, why, how it's protected, retention, access controls, sharing with third parties
+- Ties to PT control family (PII Processing & Transparency) — new in Rev 5
+- Agency AO reviews PIA as part of authorization decision when PII is involved
+
+**Common finding:** PIA omits specific PII data elements; PIA not updated when new PII types are added to the system.
+
+---
+
+## Quick Reference: Appendix Checklist
+
+| App | Title | Required | Template |
+|-----|-------|----------|----------|
+| A | Acronyms & Glossary | Yes | CSP-authored |
+| B | Laws & Regulations | Yes | FedRAMP base + CSP additions |
+| C | Security Policies & Procedures | Yes | CSP-authored |
+| D | User Guide | Yes | CSP-authored |
+| E | Rules of Behavior | Yes | FedRAMP template |
+| F | IT Contingency Plan (ISCP) | Yes | FedRAMP ISCP template (Dec 2024) |
+| G | Configuration Management Plan | Yes | CSP-authored |
+| H | Incident Response Plan | Yes | CSP-authored |
+| I | CIS / CRM Workbook | Yes | FedRAMP template |
+| J | FIPS 199 Categorization | Yes | CSP-authored |
+| K | Integrated Inventory Workbook (IIW) | Yes | FedRAMP template (Dec 2024) |
+| L | Cryptographic Modules Table | Yes | CSP-authored |
+| M | Continuous Monitoring Plan | Yes | CSP-authored |
+| N | Separation of Duties Matrix | Conditional | CSP-authored |
+| O | POA&M | Yes | FedRAMP template |
+| P | Supply Chain Risk Management Plan | Yes (Rev 5) | CSP-authored |
+| Q | Privacy Impact Assessment (PIA) | If PII in scope | CSP-authored |