itsecurityproceduralguidedevelopingaconfiguration-gsa.docVIP

Security Reviews for Minimal Impact Software as a Service SaaS Solutions GSA and Federal information security policies’ including OMB A-130 requires security authorizations for all FIPS 199 Low, Moderate, and High impact information systems consistent with Federal CA processes as documented in CIO IT Security Procedural Guide 06-30, Managing Enterprise Risk. Agencies are permitted to utilize commercial cloud computing services provided appropriate security controls are implemented, tested, and reviewed as part of the agency’s information security program and protected to the degree required