공공행정 커맨드 센터 16개 항목

Municipal Cybersecurity & StateRAMP Cloud Vendor Checklist

이 체크리스트는 영어로 제공됩니다.

Evaluates a local government's cybersecurity posture and the StateRAMP authorization status of cloud service providers handling government data.

StateRAMPNIST SP 800-53NIST CSFNIST SP 800-171

무료 PDF 또는 Word · 이메일을 입력하면 다운로드할 수 있습니다.

Governance & Framework

Has the jurisdiction adopted a recognized cybersecurity framework (e.g., NIST Cybersecurity Framework)? *
Is a written information security policy approved and periodically reviewed? *
Is a CISO or designated security official assigned responsibility for the program? *

StateRAMP Cloud Vendor Authorization

Do cloud service providers handling government data hold a StateRAMP Authorized or Ready status at the appropriate impact level? *
Was the required StateRAMP impact level (Low, Moderate, High) determined from the data categorization? *
Is the StateRAMP requirement written into the procurement and contract? *
Is the vendor's continuous monitoring status reviewed via the StateRAMP Authorized Product List? *

Access Control & Identity

Is multi-factor authentication enforced for remote and privileged access? *
Is least-privilege access reviewed and enforced for government systems? *
Are user accounts promptly disabled upon separation or role change? *

Protective Controls

Are systems patched on a defined vulnerability-management cycle? *
Are backups performed, tested, and stored offline/immutably to support ransomware recovery? *
Is security awareness training provided to all personnel at least annually? *

Detection & Incident Response

Is a documented incident response plan maintained and periodically exercised? *
Are cyber incidents reported to the required authorities (e.g., state fusion center, CISA, MS-ISAC)? *
Is logging and monitoring in place to detect unauthorized activity? *

Municipal Cybersecurity & StateRAMP Cloud Vendor Checklist 체크리스트 전체 다운로드

인쇄하기 좋은 PDF 또는 편집 가능한 Word 문서로 무료로 받으세요.