bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/fedramp/poam-guide.md

@@ -1,93 +1,93 @@
-# POA&M Guide
-
-The Plan of Action & Milestones (POA&M) is SSP Appendix O. It documents all known
-security weaknesses and the CSP's plan to remediate them. The POA&M is a living
-document — updated monthly during continuous monitoring.
-
-> Always use the official FedRAMP POA&M template.
-
----
-
-## POA&M Row Fields (Required)
-
-| Field | Description |
-|---|---|
-| POA&M Item ID | Unique identifier (e.g., V-001, F-001) |
-| Controls | NIST 800-53 Rev 5 control ID(s) affected |
-| Weakness Name | Brief name of the finding |
-| Weakness Description | Detailed description of the gap or vulnerability |
-| Point of Contact | Person/team responsible for remediation |
-| Resources Required | Tools, budget, staff needed |
-| Overall Remediation Plan | How the weakness will be fixed |
-| Original Detection Date | When was this first identified? |
-| Scheduled Completion Date | Target remediation date (must meet SLA) |
-| Milestone Changes | Track date/description changes |
-| Status | Open / Closed / Risk Adjusted / Vendor Dependency |
-| Comments | Additional context |
-| Auto-Approve | Flag for auto-closures by 3PAO |
-| Deviation Request Approved | Yes/No — for DRs approved by AO |
-| Risk Rating (Original) | Critical / High / Moderate / Low |
-| Risk Adjustment | If risk-adjusted, new risk level and justification |
-| False Positive | Yes/No |
-| Operational Requirement | Yes/No (if deviation is operational necessity) |
-
----
-
-## FedRAMP Remediation SLAs
-
-| Risk Rating | Remediation Deadline |
-|---|---|
-| Critical | 30 calendar days |
-| High | 90 calendar days |
-| Moderate | 180 calendar days |
-| Low | 365 calendar days |
-
-Missing SLAs is one of the most common ConMon findings. Track carefully.
-
----
-
-## POA&M Item Types
-
-### Standard Finding (F-)
-- Identified by 3PAO during assessment or annual assessment
-- Must be remediated within SLA
-
-### Vendor Dependency (VD-)
-- Remediation depends on a third-party (OS vendor, SaaS tool, IaaS provider)
-- Must document: vendor name, tracking ID (CVE or vendor ticket), expected fix date
-- 3PAO validates VDs during annual assessment
-- AO must agree to accept the VD; CSP must have compensating controls
-
-### Deviation Request (DR-)
-Three subtypes:
-1. **False Positive (FP)**: Finding is not actually a vulnerability — provide evidence
-2. **Risk Adjustment (RA)**: Vulnerability exists but risk is lower due to mitigating factors — must quantify
-3. **Operational Requirement (OR)**: Vulnerability cannot be fixed without breaking functionality — must document business justification and compensating controls
-
-All DRs require agency AO approval before being marked as such in the POA&M.
-
----
-
-## POA&M Writing Tips
-
-1. **One finding, one row** — Do not bundle multiple vulnerabilities into a single POA&M item
-2. **Be specific about CVEs** — For vulnerability scan findings, always include CVE IDs
-3. **Milestone dates must be realistic** — Overpromising and missing milestones is a finding in itself
-4. **Closed items need evidence** — When closing an item, document the evidence of remediation (scan result, configuration screenshot, date)
-5. **Inventory sheet is required** — The POA&M template includes an inventory tab; keep it current
-6. **Match to SAR findings** — Every finding in the SAR must appear in the POA&M; reviewers cross-reference these
-
----
-
-## POA&M During Initial Authorization vs. ConMon
-
-**Initial Authorization:**
-- POA&M documents residual risks from the 3PAO assessment (SAR findings not remediated before ATO)
-- Agency AO reviews and accepts residual risk as part of granting ATO
-- Moderate/High risk items may block ATO if not remediated or deviation-approved
-
-**Continuous Monitoring:**
-- POA&M updated monthly
-- Submitted to agency AO(s) monthly
-- Open items must show active progress (milestone updates)
-- Stale POA&M items (no updates, missed milestones) can trigger suspension of ATO
+# POA&M Guide
+
+The Plan of Action & Milestones (POA&M) is SSP Appendix O. It documents all known
+security weaknesses and the CSP's plan to remediate them. The POA&M is a living
+document — updated monthly during continuous monitoring.
+
+> Always use the official FedRAMP POA&M template.
+
+---
+
+## POA&M Row Fields (Required)
+
+| Field | Description |
+|---|---|
+| POA&M Item ID | Unique identifier (e.g., V-001, F-001) |
+| Controls | NIST 800-53 Rev 5 control ID(s) affected |
+| Weakness Name | Brief name of the finding |
+| Weakness Description | Detailed description of the gap or vulnerability |
+| Point of Contact | Person/team responsible for remediation |
+| Resources Required | Tools, budget, staff needed |
+| Overall Remediation Plan | How the weakness will be fixed |
+| Original Detection Date | When was this first identified? |
+| Scheduled Completion Date | Target remediation date (must meet SLA) |
+| Milestone Changes | Track date/description changes |
+| Status | Open / Closed / Risk Adjusted / Vendor Dependency |
+| Comments | Additional context |
+| Auto-Approve | Flag for auto-closures by 3PAO |
+| Deviation Request Approved | Yes/No — for DRs approved by AO |
+| Risk Rating (Original) | Critical / High / Moderate / Low |
+| Risk Adjustment | If risk-adjusted, new risk level and justification |
+| False Positive | Yes/No |
+| Operational Requirement | Yes/No (if deviation is operational necessity) |
+
+---
+
+## FedRAMP Remediation SLAs
+
+| Risk Rating | Remediation Deadline |
+|---|---|
+| Critical | 30 calendar days |
+| High | 90 calendar days |
+| Moderate | 180 calendar days |
+| Low | 365 calendar days |
+
+Missing SLAs is one of the most common ConMon findings. Track carefully.
+
+---
+
+## POA&M Item Types
+
+### Standard Finding (F-)
+- Identified by 3PAO during assessment or annual assessment
+- Must be remediated within SLA
+
+### Vendor Dependency (VD-)
+- Remediation depends on a third-party (OS vendor, SaaS tool, IaaS provider)
+- Must document: vendor name, tracking ID (CVE or vendor ticket), expected fix date
+- 3PAO validates VDs during annual assessment
+- AO must agree to accept the VD; CSP must have compensating controls
+
+### Deviation Request (DR-)
+Three subtypes:
+1. **False Positive (FP)**: Finding is not actually a vulnerability — provide evidence
+2. **Risk Adjustment (RA)**: Vulnerability exists but risk is lower due to mitigating factors — must quantify
+3. **Operational Requirement (OR)**: Vulnerability cannot be fixed without breaking functionality — must document business justification and compensating controls
+
+All DRs require agency AO approval before being marked as such in the POA&M.
+
+---
+
+## POA&M Writing Tips
+
+1. **One finding, one row** — Do not bundle multiple vulnerabilities into a single POA&M item
+2. **Be specific about CVEs** — For vulnerability scan findings, always include CVE IDs
+3. **Milestone dates must be realistic** — Overpromising and missing milestones is a finding in itself
+4. **Closed items need evidence** — When closing an item, document the evidence of remediation (scan result, configuration screenshot, date)
+5. **Inventory sheet is required** — The POA&M template includes an inventory tab; keep it current
+6. **Match to SAR findings** — Every finding in the SAR must appear in the POA&M; reviewers cross-reference these
+
+---
+
+## POA&M During Initial Authorization vs. ConMon
+
+**Initial Authorization:**
+- POA&M documents residual risks from the 3PAO assessment (SAR findings not remediated before ATO)
+- Agency AO reviews and accepts residual risk as part of granting ATO
+- Moderate/High risk items may block ATO if not remediated or deviation-approved
+
+**Continuous Monitoring:**
+- POA&M updated monthly
+- Submitted to agency AO(s) monthly
+- Open items must show active progress (milestone updates)
+- Stale POA&M items (no updates, missed milestones) can trigger suspension of ATO

package/src/bmad-plus/packs/pack-shield/references/fedramp/readiness-checklist.md

@@ -1,134 +1,134 @@
-# FedRAMP Readiness Checklist
-
-Use this checklist when doing a readiness or gap assessment. Organize findings
-by category and flag each item as: ✅ Met | ⚠️ Partial | ❌ Not Met | N/A
-
----
-
-## 1. Boundary & System Documentation
-
-- [ ] Authorization boundary is formally defined and documented
-- [ ] Network architecture diagram exists and is current
-- [ ] Data flow diagrams show all data entering/leaving the boundary
-- [ ] System inventory (hardware, software, virtual assets) is complete
-- [ ] All external connections and services are documented
-- [ ] External services outside boundary are FedRAMP-authorized OR have documented compensating controls
-- [ ] System categorization (FIPS 199) is complete with Low/Moderate/High determination
-- [ ] Interconnection agreements (ISAs/MOUs) exist for all external connections
-
-## 2. Policies & Procedures
-
-- [ ] Information Security Policy exists and is approved
-- [ ] Acceptable Use Policy (Rules of Behavior) is documented and signed by users
-- [ ] Access Control Policy
-- [ ] Configuration Management Policy & Plan
-- [ ] Contingency Plan (CP) — written and tested within last 12 months
-- [ ] Incident Response Plan (IRP) — written and tested within last 12 months
-- [ ] Media Protection Policy
-- [ ] Personnel Security Policy
-- [ ] Physical Security Policy (or inherited from IaaS provider)
-- [ ] Privacy policy and PII handling procedures (Rev 5 requirement)
-- [ ] Supply Chain Risk Management policy (Rev 5 requirement)
-
-## 3. Access Control & Identity
-
-- [ ] Multi-factor authentication (MFA) enforced on all privileged accounts
-- [ ] MFA enforced on all remote access
-- [ ] Role-based access control (RBAC) implemented with documented roles
-- [ ] Least privilege principle applied and documented
-- [ ] Privileged access reviews performed at least annually
-- [ ] Account provisioning/de-provisioning process is defined and followed
-- [ ] Shared/service accounts are documented and controlled
-- [ ] PIV/CAC support in place or plan documented (for High baseline)
-- [ ] FIPS 140-2 or 140-3 validated authentication mechanisms in use
-
-## 4. Encryption
-
-- [ ] All federal data encrypted at rest using FIPS 140-2/3 validated modules
-- [ ] All federal data encrypted in transit (TLS 1.2+ minimum; 1.3 preferred)
-- [ ] Key management procedures documented
-- [ ] Non-FIPS algorithms (e.g., MD5, SHA-1, DES, RC4) eliminated from boundary
-- [ ] Cryptographic modules table (required SSP appendix) is complete
-
-## 5. Vulnerability Management
-
-- [ ] Automated vulnerability scanning in place (OS-level)
-- [ ] Web application scanning in place
-- [ ] Database scanning in place
-- [ ] Container image scanning in place (if containers are used)
-- [ ] Scan coverage includes 100% of in-boundary assets
-- [ ] Scan frequency meets FedRAMP requirements (OS: monthly; web app: monthly)
-- [ ] Remediation SLAs are defined and tracked: Critical 30d / High 90d / Moderate 180d / Low 365d
-- [ ] False positives have a documented deviation request (DR) process
-
-## 6. Audit & Logging
-
-- [ ] Centralized log aggregation in place (SIEM or equivalent)
-- [ ] Audit log retention meets FedRAMP requirement (90 days online; 1 year total)
-- [ ] All boundary components (servers, network devices, apps) sending logs
-- [ ] Log integrity protection in place
-- [ ] Log review process and alerting defined
-- [ ] Privileged user activity is logged and monitored
-
-## 7. Configuration Management
-
-- [ ] Secure baseline configurations defined for all component types
-- [ ] Configuration deviations documented and approved
-- [ ] Change management process is formal and documented
-- [ ] System and software inventory is maintained and current (CMDB or equivalent)
-- [ ] Patch management process defined with documented SLAs
-- [ ] CIS Benchmarks or DISA STIGs used as configuration baselines (recommended)
-
-## 8. Incident Response
-
-- [ ] IRP covers detection, analysis, containment, eradication, recovery
-- [ ] Incident reporting SLAs meet FedRAMP: US-CERT reporting within 1 hour of discovery
-- [ ] IRP tested (tabletop or functional exercise) within last 12 months
-- [ ] IR roles and contacts documented (including agency AO contacts)
-- [ ] Security Inbox maintained for urgent government directives (required Jan 5, 2026+)
-
-## 9. Contingency Planning
-
-- [ ] Business Continuity Plan (BCP) and/or Disaster Recovery Plan (DRP) documented
-- [ ] Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined
-- [ ] CP tested within last 12 months
-- [ ] Backup and restore procedures tested
-- [ ] Alternate processing site identified (for Moderate and High)
-
-## 10. Personnel Security
-
-- [ ] Background check process defined for personnel with access to federal data
-- [ ] Onboarding security training documented
-- [ ] Annual security awareness training tracked and documented
-- [ ] Privacy training included in annual training (Rev 5)
-- [ ] Termination procedures include immediate access revocation
-- [ ] Contractor/third-party personnel screening requirements defined
-
-## 11. Third-Party / Supply Chain (Rev 5)
-
-- [ ] Inventory of third-party software and services is maintained
-- [ ] Critical suppliers identified and assessed
-- [ ] Software Bill of Materials (SBOM) process in place or planned
-- [ ] Open source components tracked for known vulnerabilities
-- [ ] SR control family (Supply Chain Risk Management) requirements reviewed
-
-## 12. Privacy (Rev 5)
-
-- [ ] PII inventory documented (what PII is collected/processed/stored)
-- [ ] Privacy Impact Assessment (PIA) completed if PII is in scope
-- [ ] Privacy training included in AT-3 training program
-- [ ] PT control family requirements reviewed and mapped
-
-## 13. 3PAO Readiness
-
-- [ ] Selected a FedRAMP-recognized 3PAO (check FedRAMP Marketplace)
-- [ ] If 3PAO helped write SSP, a *different* 3PAO must do the assessment (A2LA R311)
-- [ ] Authorization boundary agreed upon with 3PAO before assessment begins
-- [ ] CSO is "frozen" from changes during assessment window
-- [ ] Evidence repository (e.g., GRC tool or SharePoint) organized and accessible to 3PAO
-
-## 14. OSCAL / Automation (Forward-Looking)
-
-- [ ] Aware of OSCAL mandate (September 2026 deadline)
-- [ ] Evaluated OSCAL-capable GRC tools or the FedRAMP automation GitHub repo
-- [ ] SSP data structured to facilitate OSCAL export
+# FedRAMP Readiness Checklist
+
+Use this checklist when doing a readiness or gap assessment. Organize findings
+by category and flag each item as: ✅ Met | ⚠️ Partial | ❌ Not Met | N/A
+
+---
+
+## 1. Boundary & System Documentation
+
+- [ ] Authorization boundary is formally defined and documented
+- [ ] Network architecture diagram exists and is current
+- [ ] Data flow diagrams show all data entering/leaving the boundary
+- [ ] System inventory (hardware, software, virtual assets) is complete
+- [ ] All external connections and services are documented
+- [ ] External services outside boundary are FedRAMP-authorized OR have documented compensating controls
+- [ ] System categorization (FIPS 199) is complete with Low/Moderate/High determination
+- [ ] Interconnection agreements (ISAs/MOUs) exist for all external connections
+
+## 2. Policies & Procedures
+
+- [ ] Information Security Policy exists and is approved
+- [ ] Acceptable Use Policy (Rules of Behavior) is documented and signed by users
+- [ ] Access Control Policy
+- [ ] Configuration Management Policy & Plan
+- [ ] Contingency Plan (CP) — written and tested within last 12 months
+- [ ] Incident Response Plan (IRP) — written and tested within last 12 months
+- [ ] Media Protection Policy
+- [ ] Personnel Security Policy
+- [ ] Physical Security Policy (or inherited from IaaS provider)
+- [ ] Privacy policy and PII handling procedures (Rev 5 requirement)
+- [ ] Supply Chain Risk Management policy (Rev 5 requirement)
+
+## 3. Access Control & Identity
+
+- [ ] Multi-factor authentication (MFA) enforced on all privileged accounts
+- [ ] MFA enforced on all remote access
+- [ ] Role-based access control (RBAC) implemented with documented roles
+- [ ] Least privilege principle applied and documented
+- [ ] Privileged access reviews performed at least annually
+- [ ] Account provisioning/de-provisioning process is defined and followed
+- [ ] Shared/service accounts are documented and controlled
+- [ ] PIV/CAC support in place or plan documented (for High baseline)
+- [ ] FIPS 140-2 or 140-3 validated authentication mechanisms in use
+
+## 4. Encryption
+
+- [ ] All federal data encrypted at rest using FIPS 140-2/3 validated modules
+- [ ] All federal data encrypted in transit (TLS 1.2+ minimum; 1.3 preferred)
+- [ ] Key management procedures documented
+- [ ] Non-FIPS algorithms (e.g., MD5, SHA-1, DES, RC4) eliminated from boundary
+- [ ] Cryptographic modules table (required SSP appendix) is complete
+
+## 5. Vulnerability Management
+
+- [ ] Automated vulnerability scanning in place (OS-level)
+- [ ] Web application scanning in place
+- [ ] Database scanning in place
+- [ ] Container image scanning in place (if containers are used)
+- [ ] Scan coverage includes 100% of in-boundary assets
+- [ ] Scan frequency meets FedRAMP requirements (OS: monthly; web app: monthly)
+- [ ] Remediation SLAs are defined and tracked: Critical 30d / High 90d / Moderate 180d / Low 365d
+- [ ] False positives have a documented deviation request (DR) process
+
+## 6. Audit & Logging
+
+- [ ] Centralized log aggregation in place (SIEM or equivalent)
+- [ ] Audit log retention meets FedRAMP requirement (90 days online; 1 year total)
+- [ ] All boundary components (servers, network devices, apps) sending logs
+- [ ] Log integrity protection in place
+- [ ] Log review process and alerting defined
+- [ ] Privileged user activity is logged and monitored
+
+## 7. Configuration Management
+
+- [ ] Secure baseline configurations defined for all component types
+- [ ] Configuration deviations documented and approved
+- [ ] Change management process is formal and documented
+- [ ] System and software inventory is maintained and current (CMDB or equivalent)
+- [ ] Patch management process defined with documented SLAs
+- [ ] CIS Benchmarks or DISA STIGs used as configuration baselines (recommended)
+
+## 8. Incident Response
+
+- [ ] IRP covers detection, analysis, containment, eradication, recovery
+- [ ] Incident reporting SLAs meet FedRAMP: US-CERT reporting within 1 hour of discovery
+- [ ] IRP tested (tabletop or functional exercise) within last 12 months
+- [ ] IR roles and contacts documented (including agency AO contacts)
+- [ ] Security Inbox maintained for urgent government directives (required Jan 5, 2026+)
+
+## 9. Contingency Planning
+
+- [ ] Business Continuity Plan (BCP) and/or Disaster Recovery Plan (DRP) documented
+- [ ] Recovery Time Objective (RTO) and Recovery Point Objective (RPO) defined
+- [ ] CP tested within last 12 months
+- [ ] Backup and restore procedures tested
+- [ ] Alternate processing site identified (for Moderate and High)
+
+## 10. Personnel Security
+
+- [ ] Background check process defined for personnel with access to federal data
+- [ ] Onboarding security training documented
+- [ ] Annual security awareness training tracked and documented
+- [ ] Privacy training included in annual training (Rev 5)
+- [ ] Termination procedures include immediate access revocation
+- [ ] Contractor/third-party personnel screening requirements defined
+
+## 11. Third-Party / Supply Chain (Rev 5)
+
+- [ ] Inventory of third-party software and services is maintained
+- [ ] Critical suppliers identified and assessed
+- [ ] Software Bill of Materials (SBOM) process in place or planned
+- [ ] Open source components tracked for known vulnerabilities
+- [ ] SR control family (Supply Chain Risk Management) requirements reviewed
+
+## 12. Privacy (Rev 5)
+
+- [ ] PII inventory documented (what PII is collected/processed/stored)
+- [ ] Privacy Impact Assessment (PIA) completed if PII is in scope
+- [ ] Privacy training included in AT-3 training program
+- [ ] PT control family requirements reviewed and mapped
+
+## 13. 3PAO Readiness
+
+- [ ] Selected a FedRAMP-recognized 3PAO (check FedRAMP Marketplace)
+- [ ] If 3PAO helped write SSP, a *different* 3PAO must do the assessment (A2LA R311)
+- [ ] Authorization boundary agreed upon with 3PAO before assessment begins
+- [ ] CSO is "frozen" from changes during assessment window
+- [ ] Evidence repository (e.g., GRC tool or SharePoint) organized and accessible to 3PAO
+
+## 14. OSCAL / Automation (Forward-Looking)
+
+- [ ] Aware of OSCAL mandate (September 2026 deadline)
+- [ ] Evaluated OSCAL-capable GRC tools or the FedRAMP automation GitHub repo
+- [ ] SSP data structured to facilitate OSCAL export

package/src/bmad-plus/packs/pack-shield/references/fedramp/sap-sar-guide.md

@@ -1,86 +1,86 @@
-# SAP & SAR Guide
-
-The Security Assessment Plan (SAP) and Security Assessment Report (SAR) are prepared
-by the Third-Party Assessment Organization (3PAO), not the CSP. However, CSPs are
-responsible for reviewing and approving both documents before submission.
-
-> SAP and SAR templates updated December 2024. Always use current templates.
-
----
-
-## Security Assessment Plan (SAP)
-
-The SAP defines the planned scope, methodology, and testing approach.
-
-### Key SAP Sections
-
-1. **System Overview** — Brief description of the CSO and authorization boundary
-2. **Assessment Scope** — Which controls will be tested and why (based on Control Selection Worksheet)
-3. **Assessment Team** — 3PAO lead assessor, team members, roles
-4. **Assessment Methods** — Interview, examine, test (per NIST 800-53A)
-5. **Test Case Procedures** — Detailed test steps for each in-scope control (uses FedRAMP test case workbook)
-6. **Schedule** — Assessment timeline, including freeze date for CSO changes
-7. **Reporting** — Expected SAR format and delivery timeline
-
-### Control Selection Process (CSP + 3PAO Joint)
-Controls selected for assessment are determined using the **Annual Assessment Controls Selection Worksheet**, which has four tabs:
-- **Rev 5 List of Controls** — All controls in the applicable baseline
-- **Conditional Controls** — Controls that apply based on specific implementations
-- **CSP-Specific Controls** — Selected by CSP based on system changes and ConMon activities
-- **Inherited Controls** — Controls inherited from leveraged FedRAMP systems
-
-All new or modified Rev 5 requirements must be tested. Other controls are selected based on:
-- System changes since last assessment
-- Open POA&M items
-- ConMon activities and anomalies
-- Three-year periodicity requirement (no control can go untested for 3+ years)
-
-### CSP Review Tips for the SAP
-- Verify the boundary described matches the SSP
-- Confirm control selection is complete — missing required controls will cause delays
-- Ensure test methods are appropriate for your environment
-- Review schedule and confirm CSO can be frozen during testing window
-- Confirm all CSP staff interviews are scheduled (ISSOs, engineers, ops)
-
----
-
-## Security Assessment Report (SAR)
-
-The SAR documents what the 3PAO actually found during testing.
-
-### Key SAR Sections
-
-1. **Executive Summary** — Overall risk posture, total findings by risk level
-2. **System Description** — Confirmed boundary and architecture
-3. **Assessment Results** — Per-control test results (Pass / Fail / Other than Satisfied)
-4. **Findings** — Detailed description of each identified weakness
-5. **Risk Exposure Table** — Aggregated risk view (recommended for agency customer review)
-6. **3PAO Recommendation** — Authorization recommended / not recommended
-
-### SAR Appendices
-
-| Appendix | Content |
-|---|---|
-| A | Infrastructure Scan Results |
-| B | Security Requirements Traceability Matrix (SRTM) — required for Low, Moderate, High |
-| C | Web Application Scan Results |
-| D | Database Scan Results |
-| E | Risk Exposure Table (RET) |
-| F | Penetration Test Results (for High; recommended for Moderate) |
-
-### CSP Review Tips for the SAR
-- **Cross-reference every finding with your SSP** — If a finding says a control is not implemented but your SSP describes an implementation, challenge the finding with evidence
-- **Review risk ratings** — If you believe a finding's risk level is too high given mitigating factors, discuss with 3PAO (supports a future DR/RA)
-- **Verify inherited control findings** — Gaps attributed to inherited controls may actually be the IaaS/PaaS provider's responsibility
-- **Debrief presentation** — CSP and 3PAO prepare and upload a SAR debrief for agency AO review before the debrief meeting
-- **Every SAR finding → POA&M row** — Begin building POA&M while reviewing SAR
-
----
-
-## 3PAO Selection Guidance
-
-- 3PAOs must be recognized by FedRAMP — check the FedRAMP Marketplace
-- **A2LA R311 restriction**: A 3PAO that provided advisory services (e.g., helped write the SSP) cannot perform the assessment for that same CSO for 2 years
-- Select a 3PAO with experience at your impact level (High is more specialized)
-- Request references from other CSPs at similar baseline levels
-- Clarify roles in writing: what does the CSP provide vs. what does the 3PAO produce?
+# SAP & SAR Guide
+
+The Security Assessment Plan (SAP) and Security Assessment Report (SAR) are prepared
+by the Third-Party Assessment Organization (3PAO), not the CSP. However, CSPs are
+responsible for reviewing and approving both documents before submission.
+
+> SAP and SAR templates updated December 2024. Always use current templates.
+
+---
+
+## Security Assessment Plan (SAP)
+
+The SAP defines the planned scope, methodology, and testing approach.
+
+### Key SAP Sections
+
+1. **System Overview** — Brief description of the CSO and authorization boundary
+2. **Assessment Scope** — Which controls will be tested and why (based on Control Selection Worksheet)
+3. **Assessment Team** — 3PAO lead assessor, team members, roles
+4. **Assessment Methods** — Interview, examine, test (per NIST 800-53A)
+5. **Test Case Procedures** — Detailed test steps for each in-scope control (uses FedRAMP test case workbook)
+6. **Schedule** — Assessment timeline, including freeze date for CSO changes
+7. **Reporting** — Expected SAR format and delivery timeline
+
+### Control Selection Process (CSP + 3PAO Joint)
+Controls selected for assessment are determined using the **Annual Assessment Controls Selection Worksheet**, which has four tabs:
+- **Rev 5 List of Controls** — All controls in the applicable baseline
+- **Conditional Controls** — Controls that apply based on specific implementations
+- **CSP-Specific Controls** — Selected by CSP based on system changes and ConMon activities
+- **Inherited Controls** — Controls inherited from leveraged FedRAMP systems
+
+All new or modified Rev 5 requirements must be tested. Other controls are selected based on:
+- System changes since last assessment
+- Open POA&M items
+- ConMon activities and anomalies
+- Three-year periodicity requirement (no control can go untested for 3+ years)
+
+### CSP Review Tips for the SAP
+- Verify the boundary described matches the SSP
+- Confirm control selection is complete — missing required controls will cause delays
+- Ensure test methods are appropriate for your environment
+- Review schedule and confirm CSO can be frozen during testing window
+- Confirm all CSP staff interviews are scheduled (ISSOs, engineers, ops)
+
+---
+
+## Security Assessment Report (SAR)
+
+The SAR documents what the 3PAO actually found during testing.
+
+### Key SAR Sections
+
+1. **Executive Summary** — Overall risk posture, total findings by risk level
+2. **System Description** — Confirmed boundary and architecture
+3. **Assessment Results** — Per-control test results (Pass / Fail / Other than Satisfied)
+4. **Findings** — Detailed description of each identified weakness
+5. **Risk Exposure Table** — Aggregated risk view (recommended for agency customer review)
+6. **3PAO Recommendation** — Authorization recommended / not recommended
+
+### SAR Appendices
+
+| Appendix | Content |
+|---|---|
+| A | Infrastructure Scan Results |
+| B | Security Requirements Traceability Matrix (SRTM) — required for Low, Moderate, High |
+| C | Web Application Scan Results |
+| D | Database Scan Results |
+| E | Risk Exposure Table (RET) |
+| F | Penetration Test Results (for High; recommended for Moderate) |
+
+### CSP Review Tips for the SAR
+- **Cross-reference every finding with your SSP** — If a finding says a control is not implemented but your SSP describes an implementation, challenge the finding with evidence
+- **Review risk ratings** — If you believe a finding's risk level is too high given mitigating factors, discuss with 3PAO (supports a future DR/RA)
+- **Verify inherited control findings** — Gaps attributed to inherited controls may actually be the IaaS/PaaS provider's responsibility
+- **Debrief presentation** — CSP and 3PAO prepare and upload a SAR debrief for agency AO review before the debrief meeting
+- **Every SAR finding → POA&M row** — Begin building POA&M while reviewing SAR
+
+---
+
+## 3PAO Selection Guidance
+
+- 3PAOs must be recognized by FedRAMP — check the FedRAMP Marketplace
+- **A2LA R311 restriction**: A 3PAO that provided advisory services (e.g., helped write the SSP) cannot perform the assessment for that same CSO for 2 years
+- Select a 3PAO with experience at your impact level (High is more specialized)
+- Request references from other CSPs at similar baseline levels
+- Clarify roles in writing: what does the CSP provide vs. what does the 3PAO produce?