# FedRAMP SSP Appendices Guide (A–Q) All FedRAMP SSP appendices must use official FedRAMP templates where indicated. Templates: https://www.fedramp.gov/rev5/documents-templates/ --- ## Appendix A — Acronyms & Glossary **Required:** Yes | **Author:** CSP - List all acronyms used in the SSP - Define any system-specific or agency-specific terms - FedRAMP provides a standard glossary; supplement with system-specific terms - Keep synchronized with the SSP body — if a new term appears in Section 7, add it here --- ## Appendix B — Related Laws & Regulations **Required:** Yes | **Author:** CSP (use FedRAMP template as base) - Enumerates applicable federal laws, Executive Orders, OMB memos, and standards - Core list includes: FISMA 2014, Privacy Act of 1974, E-Government Act (Section 208), FIPS 199, FIPS 200, NIST SP 800-53 Rev 5, OMB Circular A-130 - Add agency-specific requirements if applicable (e.g., HIPAA, CJIS, IRS Publication 1075) - Review annually — regulatory landscape changes; new OMB guidance and executive orders may require additions **Common mistake:** Using the Rev 4 version of this appendix; ensure it reflects Rev 5 requirements and current OMB directives. --- ## Appendix C — Security Policies & Procedures **Required:** Yes | **Author:** CSP - Attach or reference all CSP security policies and standard operating procedures - Must cover each NIST 800-53 Rev 5 control family that has policies and procedures controls (e.g., AC-1, AU-1, CA-1, CM-1, etc.) - Policies must be: approved by senior leadership, dated, versioned, and reviewed at defined intervals - Common approach: include a policy index table in the appendix body, with the actual policy documents attached or linked via evidence repository **Common finding:** Policies exist but are not dated or version-controlled; policies reference Rev 4 controls. --- ## Appendix D — User Guide **Required:** Yes | **Author:** CSP - End-user guide for the cloud service - Describes: how to access the system, user responsibilities, what the system does, how to report security incidents - For SaaS offerings, this may be a customer-facing documentation excerpt - Must align with the Rules of Behavior (Appendix E) --- ## Appendix E — Rules of Behavior (RoB) **Required:** Yes | **Author:** CSP (FedRAMP template available) - Signed by all users prior to access - Covers: acceptable use, data handling obligations, password requirements, incident reporting obligations, consequences of non-compliance - Must be re-signed annually or when updated - Keep signature records — auditors will ask for evidence of signed RoBs **Common finding:** RoB exists but no evidence of user signatures; RoB not updated after major policy changes. --- ## Appendix F — IT Contingency Plan (ISCP) **Required:** Yes | **Author:** CSP (FedRAMP ISCP template — updated December 2024) - Use the FedRAMP Information System Contingency Plan (ISCP) template - Must include: system description, activation criteria, notification procedures, recovery procedures, reconstitution, testing records - RTO and RPO must be defined and achievable based on architecture - Must be tested at least annually — tabletop minimum; functional exercise preferred for High baseline - Append the most recent test results **Common finding:** Plan exists but has never been tested; RTO/RPO are aspirational and not validated by DR testing. --- ## Appendix G — Configuration Management Plan (CMP) **Required:** Yes | **Author:** CSP - Describes how configuration baselines are established, maintained, and enforced - Must reference specific baseline standards used (CIS Benchmarks, DISA STIGs) - Documents the change control board (CCB) process and approval chain - Defines how configuration deviations are documented and approved - Links to the system inventory (IIW — Appendix K) --- ## Appendix H — Incident Response Plan (IRP) **Required:** Yes | **Author:** CSP - Must follow NIST SP 800-61 Rev 2 lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Post-Incident - FedRAMP-specific reporting SLAs: - Report to US-CERT within **1 hour** of incident discovery (high-priority incidents) - Report to agency AO within **1 hour** for incidents affecting federal data - Include contact list: CSP IR team, agency AO contacts, US-CERT (CISA), FedRAMP PMO Security Inbox - Must include the FedRAMP Security Inbox address for PMO notifications - Must be tested at least annually (tabletop or functional exercise) **Common finding:** IRP does not include agency AO notification procedure; reporting timeframes do not match FedRAMP SLAs; no evidence of annual testing. --- ## Appendix I — Control Implementation Summary (CIS) / Customer Responsibility Matrix (CRM) **Required:** Yes | **Author:** CSP (FedRAMP CIS/CRM template) - One of the most operationally important appendices for agency customers - **CIS tab**: Lists every control in the baseline and its implementation status (Fully Implemented / Partially Implemented / Planned / Not Applicable / Alternative) - **CRM tab**: For each shared/hybrid control, defines exactly what the CSP implements vs. what the customer/agency must implement - Agency customers use the CRM to understand their inherited security obligations - Must be kept current — a stale CRM is a common agency complaint and a finding during re-authorization **Common mistake:** CRM lists "Customer Responsibility" generically without specifying what the agency must actually do; shared controls marked as fully CSP-implemented when agencies have configuration responsibilities. --- ## Appendix J — FIPS 199 Categorization **Required:** Yes | **Author:** CSP - Documents the formal FIPS 199 impact determination - Categorizes Confidentiality, Integrity, and Availability separately for each information type - Overall impact level = high-water mark (highest individual rating) - Must justify each categorization with the types of federal information the system processes - Ties directly to which FedRAMP baseline (Low / Moderate / High) applies --- ## Appendix K — Integrated Inventory Workbook (IIW) **Required:** Yes | **Author:** CSP (FedRAMP IIW template — updated December 2024) - Complete inventory of every asset within the authorization boundary - Tabs typically include: hardware, software, services, databases, network components, virtual instances - Must be 100% accurate — auditors sample from IIW and will flag missing assets as findings - Updated continuously; submitted monthly during ConMon - Must include: asset name/ID, OS/version, IP address, function, patch level, FedRAMP status, POC **Common finding:** IIW is out of date; cloud-native ephemeral resources (auto-scaling instances, containers) not accounted for with appropriate dynamic inventory process. --- ## Appendix L — Cryptographic Modules Table **Required:** Yes | **Author:** CSP - Lists every cryptographic module in use within the boundary - For each module: vendor, product name, version, FIPS 140-2/3 validation certificate number, use case (encryption at rest, in transit, key management, etc.) - All modules must have active FIPS 140-2 or 140-3 validation certificates (check NIST CMVP) - Identifies any non-FIPS algorithms still in use (must be remediated or deviation-approved) **Common finding:** Module versions have changed since last authorization and certificates are no longer valid; legacy algorithms (MD5, SHA-1, DES, RC4) found in use without deviation. --- ## Appendix M — Continuous Monitoring Plan **Required:** Yes | **Author:** CSP - Documents the ongoing ConMon program - Must specify: scan frequency and tools, vulnerability management SLAs, POA&M update cadence, reporting schedule to agency AO, annual assessment approach - Scan requirements: OS/infrastructure monthly; web app monthly; database monthly; container images per CI/CD pipeline - References the Security Inbox requirement (effective January 2026) --- ## Appendix N — Separation of Duties Matrix **Required:** Conditional (required when separation of duties is a compensating control or specifically required by agency) | **Author:** CSP - Documents which roles can and cannot be combined - Relevant when a small team might otherwise hold conflicting privileges - Ties to AC-5 (Separation of Duties) control implementation --- ## Appendix O — Plan of Action & Milestones (POA&M) **Required:** Yes | **Author:** CSP (FedRAMP POA&M template) - See `references/poam-guide.md` for full field definitions and SLA table - Living document — updated monthly during ConMon - Submitted monthly to agency AO(s) - Every SAR finding must appear as a POA&M row --- ## Appendix P — Supply Chain Risk Management Plan (SCRM Plan) **Required:** Yes (Rev 5) | **Author:** CSP - New requirement introduced with NIST SP 800-53 Rev 5 (SR control family) - Documents how the CSP manages supply chain risks for hardware, software, and services - Must address: supplier assessment process, SBOM tracking, open source component vulnerability management, critical supplier identification - Ties to SR-1 through SR-12 control implementations **Common finding:** SCRM Plan is generic and doesn't describe the CSP's specific suppliers or risk assessment methodology; SBOM process undefined. --- ## Appendix Q — Privacy Impact Assessment (PIA) **Required:** If PII is in scope | **Author:** CSP - Required when the system collects, processes, stores, or transmits PII - Must follow the E-Government Act of 2002 Section 208 PIA requirements - Covers: what PII is collected, why, how it's protected, retention, access controls, sharing with third parties - Ties to PT control family (PII Processing & Transparency) — new in Rev 5 - Agency AO reviews PIA as part of authorization decision when PII is involved **Common finding:** PIA omits specific PII data elements; PIA not updated when new PII types are added to the system. --- ## Quick Reference: Appendix Checklist | App | Title | Required | Template | |-----|-------|----------|----------| | A | Acronyms & Glossary | Yes | CSP-authored | | B | Laws & Regulations | Yes | FedRAMP base + CSP additions | | C | Security Policies & Procedures | Yes | CSP-authored | | D | User Guide | Yes | CSP-authored | | E | Rules of Behavior | Yes | FedRAMP template | | F | IT Contingency Plan (ISCP) | Yes | FedRAMP ISCP template (Dec 2024) | | G | Configuration Management Plan | Yes | CSP-authored | | H | Incident Response Plan | Yes | CSP-authored | | I | CIS / CRM Workbook | Yes | FedRAMP template | | J | FIPS 199 Categorization | Yes | CSP-authored | | K | Integrated Inventory Workbook (IIW) | Yes | FedRAMP template (Dec 2024) | | L | Cryptographic Modules Table | Yes | CSP-authored | | M | Continuous Monitoring Plan | Yes | CSP-authored | | N | Separation of Duties Matrix | Conditional | CSP-authored | | O | POA&M | Yes | FedRAMP template | | P | Supply Chain Risk Management Plan | Yes (Rev 5) | CSP-authored | | Q | Privacy Impact Assessment (PIA) | If PII in scope | CSP-authored |