FedRAMP Rev 5 P.5: P.5 Documenting controls in SSP Appendix A

Each control in the impact-level Appendix A template has a control requirement, a control summary information table and an implementation statement. Requirements beginning with the information system describe technical capabilities and those beginning with the organization describe processes, parameters are provider-defined or FedRAMP-defined and cannot be changed where FedRAMP assigns them, and additional FedRAMP requirements and guidance apply. The summary table names the responsible role without individual names, gives the actual parameter values, selects at least one implementation status with any planned or partially implemented portion assessed as other than satisfied, and states control origination, marking inherited controls with the leveraged system's name, FedRAMP ID and authorization date and describing what is inherited without describing the leveraged system's implementation. The implementation statement addresses every requirement and part with who, what, where, when, why and how in the current operational state, states whether the requirement is satisfied, may point to external documents for detail, carries a customer responsibility heading for customer-provided, customer-configured or shared controls, and must not restate the requirement, reference other controls or appendices in place of a narrative, copy statements between controls, or include marketing language; not applicable claims need a rationale, and a prohibited capability is documented through the prohibiting policy and preventive controls rather than marked not applicable.