Secure Configuration Guide¶

Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:

1. Required: Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts that control enterprise access to the entire cloud service offering.
2. Required: Explanations of security-related settings that can be operated only by top-level administrative accounts and their security implications.
3. Recommended: Explanations of security-related settings that can be operated only by privileged accounts and their security implications.

Notes:

• These rules refer to this guidance as a Secure Configuration Guide but cloud service providers may make this guidance available in various appropriate forms that provide the best customer experience.
• This guidance should explain how top-level administrative accounts are named and referred to in the cloud service offering.

Terms: Cloud Service Offering, Privileged Account, Top-Level Administrative Account

Providers MUST include instructions in the FedRAMP Certification package that explain how to obtain and use the Secure Configuration Guide.

Note: These instructions may appear in a variety of ways; it is up to the provider to do so in the most appropriate and effective ways for their specific customer needs.

Terms: Certification Package

Providers SHOULD make the Secure Configuration Guide available publicly.

Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned.

Terms: Privileged Account, Top-Level Administrative Account

Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults.

Terms: Privileged Account, Top-Level Administrative Account

Providers SHOULD offer the capability to export all security settings in a machine-readable format.

Terms: Machine-Readable

Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability.

Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings.

Terms: Machine-Readable

Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time.

Terms: Privileged Account, Top-Level Administrative Account