Tailoring a Moderate Baseline for a Cloud-Hosted Case Management System
An agency is moving a case-management system to a CSP's FedRAMP Moderate IaaS/PaaS offering. The CSP package lists 45 controls as inherited, 80 as hybrid, and 25 as customer-responsible. The mission owner wants to mark SC-8 (transmission confidentiality and integrity) as fully inherited because the CSP encrypts traffic inside its data centers. However, agency case workers access an on-premises legacy mainframe over an MPLS circuit using TLS 1.0, and a small on-premises enclave remains in the agency data center. The system contains law enforcement sensitive data. The AO asks whether the CSP's authorization can be relied on and what tailoring is needed before the SSP is submitted.
1. Evaluate the proposed SC-8 inheritance claim and identify what control implementation status and documentation you would require.
Read the worked answer
SC-8 cannot be marked fully inherited. The CSP may implement transmission protection inside its own boundary, but the agency-to-mainframe path and the on-premises enclave are outside that boundary. The correct treatment is hybrid or customer/system-specific for those data flows.
The SSP should show, per data flow:
- What the CSP encrypts and under which service.
- What the agency encrypts on the MPLS path and between users and the application.
- Where TLS 1.0 is used and why it is not compliant with the agency's cryptographic standard.
TLS 1.0 is a material weakness. The agency should select and implement SC-8(1) and SC-13 for the agency-controlled segments, and consider SC-23 where session authenticity matters. If upgrading is not immediately possible, document compensating controls, a POA&M with a milestone, and residual risk. The customer responsibility matrix and the CSP's assessment evidence should be referenced, but a FedRAMP package is evidence for the CSP's controls, not a transfer of the agency AO's authorization responsibility.
2. Can the agency mark the PE family not applicable because the data center is the CSP's? What about the on-premises enclave?
Read the worked answer
The PE family cannot be blanket-marked Not Applicable. For the cloud-resident portion, many physical and environmental controls may be inherited from the CSP and supported by the CSP's assessment evidence. That is different from N/A.
The on-premises enclave is agency-controlled space. Physical access, visitor control, power, fire suppression, and environmental controls still apply there, at least to the extent the enclave processes, stores, or transmits the system's data or supports its operation. So PE controls will be a mix of inherited and system-specific.
A defensible SSP entry states: which PE controls are inherited from the CSP, which apply to the agency enclave, which are hybrid, and why any specific control is genuinely N/A. N/A is appropriate only when no component in the authorization boundary is subject to that control. If the agency has any physical media, workstations, network equipment, or personnel access related to the system, those need to be considered.
3. The mission owner wants to defer the TLS 1.0 upgrade until next fiscal year. What selection and authorization options exist, and what would you recommend?
Read the worked answer
The agency can tailor and supplement the Moderate baseline, but it cannot simply accept TLS 1.0 without documented risk management. Options include:
- Upgrade or terminate TLS 1.0 at a gateway so the legacy mainframe path is protected with a current protocol.
- Isolate the MPLS path with network segmentation, restrictive access control lists, IPS, and enhanced monitoring as compensating controls.
- Add stronger authentication and logging on the legacy path.
- Open a POA&M with a dated milestone and an owner.
I would recommend not deferring without compensating controls. If the mission owner insists, the AO can consider an ATO with conditions that is time-bound and requires the upgrade or a verified mitigation, plus increased monitoring. A blanket deferral to next fiscal year is not defensible for law enforcement sensitive data on an obsolete protocol. If the residual risk exceeds the AO's tolerance, the AO should deny or restrict the authorization rather than let the mission owner self-accept the risk.