SSP document remediations

[mogul]

In order to ensure our SSP is ready for JAB technical reviewers, we need to remediate the points raised by our 3PAO interviews.

(Note: Be careful to ensure that your changes are made in the right place to find their way back into the YAML! See in particular cloud-gov/cg-atlas#91.)

Acceptance Criteria

• IR: Incident Response Plan should include:
  • Frequency of testing/tabletop exercises (yearly)
  • Frequency of review of the IRP (yearly)
  • Who is notified, and how they are notified about IRP changes (Make an issue in GitHub and @-cloud-gov-team)
• PL: PL-1b reads “The 18F Program Office will review and update the current 18F Identification and authorization Policy at least every 3 years and any documented procedures at least annually.” when it should say “Security planning policy” instead.
• AU: AU-3 (1) should remove the section about BOSH CLI
• CP: Need to mark everything as planned controls.
• AT: Need to mark AT-1 and AT-2 as partially implemented since we don’t have a cloud.gov-specific training plan (Adam sez: Veris seems to think this is entirely covered by GSA training, which applies to all employees and contractors! Double-check and if so ignore this one.)
• AT: Add training on the IRP, CPP, CMP, etc. to the Onboarding Checklist
• MA/MP/PE: Need to change from N/A to Inherited from AWS GovCloud FedRAMP package and mark everything as Implemented.
• CM: Configuration Management
  • Replace all the references of Trello to GitHub
  • Replace “18F DevOps and SecOps” to “cloud.gov operators”
  • CM: CM-2 (3) Needs to read: “If there is any manual change on any part of the infrastructure Bosh and Terraform will correct the settings and revert back to the known state.”
  • CM: We should remove the reference to the number of VMs
  • CM: CM-2 (7) Needs to read: “Per Federal policy 18F employees are not allowed to take equipment outside of the United States without explicit permission.”
  • CM: CM-8: Add “Bosh continuously maintains inventory of all instances and configuration”

[dlapiduz]

@clovett3 can you pick these changes from cg-compliance?