FedRAMP High

Develop and disseminate access control policy and procedures; review at least annually (FedRAMP parameter); update following defined events.

• Control implementation statement for AC-1 citing the system mission and inheritance from common controls
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated

Limit concurrent sessions per account to FedRAMP-defined number (3 for privileged, 2 for non-privileged).

• Session limit config

• Unlimited concurrent sessions

Prevent further access by initiating device lock after 15 minutes inactivity (FedRAMP) or upon user request.

• Control implementation statement for AC-11 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Device Lock | Pattern-hiding Displays. Conceal, via the device lock, information previously visible on the display with a publicly viewable image

• Lock screen image configuration
• Screenshots showing pattern-hiding
• MDM payload

• Lock shows live data
• Configuration drift
• No screenshot evidence

Automatically terminate user session after FedRAMP-defined conditions (idle timeout, trigger events).

• Control implementation statement for AC-12 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Identify and document actions allowed without identification or authentication.

• Control implementation statement for AC-14 citing the system mission and inheritance from common controls
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Establish usage restrictions, configuration requirements, and authorize remote access prior to allowing.

• Control implementation statement for AC-17 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability

Employ automated mechanisms to monitor and control remote access.

• VPN logs
• Remote session monitoring

• No remote session logging

Implement cryptographic mechanisms to protect remote access sessions; FIPS-validated.

• FIPS 140 module list
• TLS config

• Non-FIPS ciphers enabled

Route remote accesses through FedRAMP-defined number of managed network access control points.

• Network ingress diagram
• TIC compliance

• Split tunneling allowed

Authorize execution of privileged commands and access to security-relevant information via remote access only for defined needs.

• Bastion logs
• Approved command list

• No bastion enforcement

Establish configuration requirements, usage restrictions, authorize wireless access.

• Control implementation statement for AC-18 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability

Protect wireless access using authentication and encryption (WPA2/3 Enterprise minimum).

• WPA3 config
• RADIUS records

• PSK in use

Wireless Access | Disable Wireless Networking. Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment

• MDM policy

• Bluetooth/Wi-Fi enabled by default

Identify users authorized to independently configure wireless; restrict others.

• MDM lockdown

• Users add networks freely

Select antenna and transmission power to reduce signal leakage outside boundary.

• Site survey
• RF heatmap

• No RF leakage assessment

Establish configuration requirements and usage restrictions for mobile devices.

• Control implementation statement for AC-19 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated

Employ full device or container-based encryption on mobile devices.

• Encryption attestation

• Personal containers unencrypted

Manage accounts; review at least monthly for privileged, every six months for non-privileged (FedRAMP); notify within FedRAMP-defined timeframes on changes.

• Control implementation statement for AC-2 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Support account management via automated mechanisms; required at HIGH baseline.

• IDP configuration
• Workflow automation evidence
• SCIM provisioning logs

• Manual ticket-only provisioning
• No automated deprovisioning

Enforce circumstances and usage conditions on account use (time of day, location, etc.).

• Conditional access policies
• Geo-fencing rules

• No usage condition enforcement

Monitor accounts for atypical use; report anomalies to defined personnel.

• UEBA reports
• Anomaly alerts

• No behavior baseline

Disable accounts of users posing significant risk within FedRAMP-defined timeframe (1 hour).

• Insider threat workflow
• 1-hour disable evidence

• No coordination with HR/legal

Automatically disable temporary and emergency accounts within FedRAMP-defined timeframe (no longer than 24 hours).

• Temp account expiry logs
• Automation script
• JIT access records

• No automated expiry
• Emergency accounts persist

Disable accounts within FedRAMP-defined timeframe when no longer required, terminated, or inactive (35 days inactive).

• Inactivity disable logs
• HR-IAM integration
• 35-day report

• Inactive accounts active over 35 days

Automatically audit account creation, modification, enabling, disabling, removal; notify defined personnel.

• Account change audit logs
• Alerting rules

• No alerts on account changes

Require users to log out when inactivity exceeds FedRAMP-defined period (15 minutes for non-mobile, 30 for mobile).

• Session timeout config
• Policy baseline

• Timeout over 15 minutes

Establish and administer privileged accounts per role-based scheme; monitor role assignments; revoke when no longer needed.

• Privileged role catalog
• PAM logs
• Revocation records

• Standing admin access
• No PAM deployment

Only permit shared/group accounts when meeting FedRAMP-defined conditions; document and approve.

• Shared account inventory
• Approval records

• Shared accounts undocumented

Establish terms and conditions for use of external systems; prohibit unless authorized.

• Control implementation statement for AC-20 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Permit use of external systems only after verifying security/privacy controls or approved connection agreement.

• Interconnection agreements
• Vendor assessments

• Missing ISA

Restrict use of organization-controlled portable storage on external systems.

• USB control policy
• DLP rules

• USB unrestricted

Enable authorized users to determine whether access authorizations match sharing restrictions.

• Sharing policy
• Classification labels

• No sharing review process

Designate users authorized to post; train them; review content quarterly for nonpublic information.

• Control implementation statement for AC-22 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA

Enforce approved authorizations for logical access in accordance with policy.

• Control implementation statement for AC-3 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Enforce approved information flow control policies between connected systems and within the system.

• Control implementation statement for AC-4 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Separate information flows logically or physically using FedRAMP-defined mechanisms.

• VLAN/VRF design
• Tenant isolation evidence

• Shared broadcast domain

Prevent encrypted information from bypassing flow control mechanisms; required at HIGH.

• TLS inspection config
• SSL break-and-inspect policy

• Encrypted bypass paths

Identify and document duties requiring separation; define access authorizations to support.

• Control implementation statement for AC-5 citing the system mission and inheritance from common controls
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Employ least privilege; allow only authorized access necessary to accomplish assigned tasks.

• Control implementation statement for AC-6 citing the system mission and inheritance from common controls
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA

Authorize access for FedRAMP-defined personnel to security functions and security-relevant information.

• Security admin role list
• Approval records

• Undocumented sec-admin access

Prevent non-privileged users from executing privileged functions.

• LPE prevention controls
• EDR config

• Setuid binaries unaudited

Require privileged users to use non-privileged accounts for nonsecurity functions.

• Dual-account policy
• Browse-as-user evidence

• Admins browse with admin

Authorize network access to privileged commands only for FedRAMP-defined needs; document rationale.

• Bastion/jump-host config
• Approved command list

• Direct admin from internet

Restrict privileged accounts to FedRAMP-defined personnel or roles.

• Privileged role list
• Quarterly review

• No periodic review

Review privileges at least quarterly (FedRAMP) and reassign or remove as needed.

• Quarterly privilege review
• Remediation tickets

• Annual-only review

Prevent specified software from executing at higher privilege levels than necessary.

• App allowlist
• Privilege escalation logs

• Tools run as SYSTEM/root

Log execution of privileged functions.

• Sudo logs
• PAM session recording

• No PAM session logs

Enforce limit of 3 consecutive invalid logon attempts within 15 minutes (FedRAMP); lock for 30 min or until released.

• Control implementation statement for AC-7 citing the system mission and inheritance from common controls
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Display approved system use notification/banner before granting access; FedRAMP requires specific language.

• Login banner screenshot
• Banner text

• Missing FedRAMP banner language

Develop, disseminate, and review awareness and training policy and procedures at least annually.

• Control implementation statement for AT-1 citing the system mission and inheritance from common controls
• Insider threat awareness briefing materials
• Training records retained in the learning management system
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Provide security awareness training within FedRAMP-defined timeframe of onboarding, on system change, and at least annually thereafter.

• Control implementation statement for AT-2 citing the system mission and inheritance from common controls
• Training records retained in the learning management system
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching

Include insider threat recognition and reporting in awareness training.

• Insider threat module

• Module absent

Include social engineering and social mining recognition in training.

• Phishing simulation results

• No phishing tests

Provide role-based security training to personnel with significant security responsibilities before authorizing access and annually.

• Control implementation statement for AT-3 citing the system mission and inheritance from common controls
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers
• Phishing simulation results with click and reporting rates
• Insider threat awareness briefing materials

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Document and monitor security training; retain records for FedRAMP-defined period (5 years).

• Control implementation statement for AT-4 citing the system mission and inheritance from common controls
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers
• Phishing simulation results with click and reporting rates
• Insider threat awareness briefing materials

• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Develop and review audit/accountability policy annually.

• Control implementation statement for AU-1 citing the system mission and inheritance from common controls
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Audit log retention shorter than the policy mandated period
• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation

Provide irrefutable evidence that an entity performed an action; HIGH baseline.

• Digital signature on logs
• Action attribution

• No non-repudiation mechanism

Retain audit records for at least one year (FedRAMP minimum) with 90 days immediately accessible online.

• Control implementation statement for AU-11 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Provide audit record generation capability on all system components specified in AU-2.

• Control implementation statement for AU-12 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Compile audit records into system-wide audit trail that is time-correlated within FedRAMP tolerance.

• Time-correlation evidence

• Clock drift

Permit authorized individuals to change audit logging selectively for FedRAMP-defined events within defined time thresholds.

• Audit config change records

• No change tracking

Identify event types selected for logging including FedRAMP minimum list; review and update at least annually.

• Control implementation statement for AU-2 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Audit log retention shorter than the policy mandated period
• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Audit records must contain: type, when, where, source, outcome, identity associated.

• Control implementation statement for AU-3 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Generate audit records containing FedRAMP-defined additional information (session, host, full text of executed commands).

• Enriched log sample

• Command text not captured

Allocate audit log storage capacity to accommodate FedRAMP-defined retention period.

• Control implementation statement for AU-4 citing the system mission and inheritance from common controls
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Alert defined personnel on audit failure within FedRAMP timeframe; take defined action (overwrite oldest, shutdown, stop processing).

• Control implementation statement for AU-5 citing the system mission and inheritance from common controls
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Provide warning within FedRAMP-defined time period when storage capacity reaches 75 percent.

• 75% alert config

• No threshold warning

Provide alert within real time when FedRAMP-defined audit failure events occur.

• Real-time alerting evidence

• Batch-only alerting

Review and analyze audit records at least weekly (FedRAMP); report findings to defined personnel.

• Control implementation statement for AU-6 citing the system mission and inheritance from common controls
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Integrate audit review with automated mechanisms (SIEM).

• SIEM screenshot

• No SIEM

Analyze and correlate audit records across different repositories.

• SIEM correlation rules

• Siloed logs

Centralized review and analysis of audit records across system components; required at HIGH.

• Central log architecture

• Per-host logs only

Integrate analysis of audit records with analysis of vulnerability scanning, performance data, network monitoring; HIGH only.

• Integrated analytics platform

• No integration

Correlate logical audit records with physical access records.

• Badge-system integration

• Physical access not correlated

Specify permitted actions for users, roles, processes associated with reviewing audit records.

• Audit reviewer role list

• No defined reviewer roles

Provide capability for audit record reduction and on-demand report generation.

• Control implementation statement for AU-7 citing the system mission and inheritance from common controls
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Process audit records for events of interest based on defined criteria.

• SIEM use cases

• No detection rules

Use internal system clocks; record timestamps with FedRAMP-defined granularity (1 second), UTC or known offset.

• Control implementation statement for AU-8 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Protect audit information and tools from unauthorized access, modification, deletion.

• Control implementation statement for AU-9 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Store audit records on separate physical system/component at least weekly (FedRAMP).

• Off-host log shipping
• Replication evidence

• Local-only logs

Cryptographically protect integrity of audit information; HIGH only.

• Log signing/hashing config

• No log integrity

Authorize access to audit functionality only to subset of privileged users.

• SIEM role list

• All admins see all logs

Develop and review assessment/authorization policy at least annually.

• Control implementation statement for CA-1 citing the system mission and inheritance from common controls
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Authorization boundary description does not match the asset inventory
• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership

Assess controls annually (FedRAMP); third-party assessor (3PAO) required; produce SAR.

• Control implementation statement for CA-2 citing the system mission and inheritance from common controls
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• Authorization boundary description does not match the asset inventory
• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Employ independent assessors; FedRAMP-accredited 3PAO required.

• 3PAO accreditation
• Independence statement

• Non-accredited assessor

Conduct specialized assessments (announced/unannounced, in-depth, malicious user, penetration testing) at FedRAMP defined frequency.

• Specialized assessment plan

• No malicious user testing

Control Assessments | Leveraging Results from External Organizations. Leverage the results of control assessments performed by [Assignment: organization-defined external organization] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements]

• Leverage decision memo

• No reciprocity documentation

Approve and manage exchange of information with external systems using ISA, MOU, contract; review annually.

• Control implementation statement for CA-3 citing the system mission and inheritance from common controls
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Verify that individuals or systems transferring data between interconnecting systems hold the requisite authorizations, meaning write permissions or privileges, before accepting such data.

• Interconnection security agreements naming the parties authorised to transfer data
• Authorisation records for the systems and individuals permitted to write across each interconnection
• Evidence that write permission is checked before data is accepted

• Interconnection agreements exist but nothing checks that the transferring party is authorised
• Authorisations never re-reviewed after the interconnection goes live

Develop POAM; update at least monthly (FedRAMP); track remediation timelines (HIGH 30 days, MOD 90).

• Control implementation statement for CA-5 citing the system mission and inheritance from common controls
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence

• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Senior official authorizes system; reauthorize every three years or upon significant change.

• Control implementation statement for CA-6 citing the system mission and inheritance from common controls
• Authorization to operate memorandum signed by the authorizing official
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval
• Authorization boundary description does not match the asset inventory

Establish continuous monitoring strategy with FedRAMP-defined metrics, monitoring frequencies, ongoing assessments.

• Control implementation statement for CA-7 citing the system mission and inheritance from common controls
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval

Employ independent assessors for ongoing monitoring; FedRAMP 3PAO annual.

• 3PAO ConMon engagement

• No independent ConMon

Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring

• Risk monitoring procedure
• Risk register
• Change-driven re-assessments

• Risk monitoring siloed
• No change triggers
• Register stale

Conduct penetration testing annually on FedRAMP-defined systems and components.

• Control implementation statement for CA-8 citing the system mission and inheritance from common controls
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval
• Authorization boundary description does not match the asset inventory

Penetration Testing | Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or team to perform penetration testing on the system or system components

• Independent firm SOW

• Internal team only

Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]

• Red team report

• No red team activity

Authorize internal connections of components to system; document interface characteristics.

• Control implementation statement for CA-9 citing the system mission and inheritance from common controls
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval
• Authorization boundary description does not match the asset inventory

Develop and review configuration management policy annually.

• Control implementation statement for CM-1 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Asset inventory missing cloud workloads and ephemeral resources
• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review

Use software in accordance with contracts and copyright laws; track licenses; document peer-to-peer file sharing controls.

• Control implementation statement for CM-10 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Establish policies governing installation of software by users; enforce; monitor compliance.

• Control implementation statement for CM-11 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Information Location. a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access

• Data location map

• No data inventory

Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational

• DLP/discovery tool

• No data discovery

Prevent the installation of FedRAMP-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

• Code-signing policy naming the approved certificate authorities
• Configuration showing signature enforcement at install time
• Exception register for unsigned components with compensating controls

• Signature checking enforced on servers but not on build agents or container images
• Approved certificate list not maintained, so revoked signers still pass

Develop and maintain baseline configurations; review and update annually (FedRAMP) and when required.

• Control implementation statement for CM-2 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Asset inventory missing cloud workloads and ephemeral resources
• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Maintain baseline currency via automated mechanisms.

• CMDB auto-discovery

• Manual CMDB

Retain FedRAMP-defined number of previous baseline configurations (3) to support rollback.

• Snapshot history

• No rollback capability

Issue systems/devices with FedRAMP-defined security safeguards to individuals traveling to high-risk locations.

• Travel laptop policy

• No travel device program

Determine, document, and approve changes; track, review, audit; CAB or equivalent; analyze security impact.

• Control implementation statement for CM-3 citing the system mission and inheritance from common controls
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Use automated mechanisms to document, notify approvers, and prohibit changes until approved.

• Workflow tool config

• Manual approval emails

Test, validate, and document changes before implementing on operational system.

• Test plan
• Validation results

• No pre-prod testing

Require security and privacy representatives on change board for FedRAMP-defined configuration changes.

• CAB roster

• No security on CAB

Ensure cryptographic mechanisms providing FedRAMP-defined safeguards are under configuration management.

• Crypto inventory

• Untracked crypto

Analyze changes to determine potential security/privacy impacts.

• Control implementation statement for CM-4 citing the system mission and inheritance from common controls
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Analyze changes in separate test environment before implementation; HIGH baseline.

• Test environment diagram

• No separate test environment

Impact Analyses | Verification of Controls. After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements

• Post-change verification reports
• Control testing results
• Tickets linking change to verification

• No post-change testing
• Verification not documented
• Controls drift after change

Define, document, approve, enforce physical and logical access restrictions for changes.

• Control implementation statement for CM-5 citing the system mission and inheritance from common controls
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Access Restrictions for Change | Automated Access Enforcement and Audit Records. (a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions

• Deploy logs

• No deploy audit trail

Access Restrictions for Change | Privilege Limitation for Production and Operation. (a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment:

• Documented list of privileges that permit change to system components and system related information in the production or operational environment
• Identification of the accounts and roles holding those privileges, extracted from the production environment itself
• Configuration evidence that developers and other non-operational roles cannot change production components
• User privilege review records at the defined frequency, showing privileges reviewed and reevaluated
• Records of privileges removed or reduced as a result of a review

• Break glass and deployment service accounts excluded from the review, though they carry the strongest change privilege
• Review confirms the list is unchanged rather than reevaluating whether each privilege is still justified
• Change privilege limited in the application while underlying platform, container or infrastructure as code paths remain open

Establish/document configuration settings using checklists; CIS/USGCB/DISA STIG when available; HIGH baseline.

• Control implementation statement for CM-6 citing the system mission and inheritance from common controls
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Manage, apply, and verify configuration settings via automated mechanisms; HIGH only.

• IaC pipelines
• Compliance scanner

• Manual config

Take FedRAMP-defined actions in response to unauthorized changes; HIGH only.

• Drift response procedure

• No drift remediation

Configure system to provide only essential capabilities; prohibit unnecessary functions, services, ports, protocols.

• Control implementation statement for CM-7 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Review system functions, ports, protocols, services at least monthly (FedRAMP); disable as unnecessary.

• Monthly review records

• Annual-only review

Prevent program execution according to FedRAMP-defined policies (rules of behavior).

• App control policy

• No application control

Identify and maintain authorized software list; employ allowlist; review at least annually; HIGH requirement.

• Allowlist policy
• Annual review

• No allowlisting

Develop and document inventory of system components; review and update at least monthly (FedRAMP).

• Control implementation statement for CM-8 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Update inventory as part of component installations, removals, updates.

• Installation workflow

• Manual inventory

Maintain inventory via automated mechanisms; HIGH baseline.

• Auto-discovery tool

• Spreadsheet-based CMDB

Employ automated mechanisms to detect unauthorized components at FedRAMP-defined frequency; HIGH only continuous.

• NAC alerts
• Rogue device reports

• No rogue detection

Include in inventory information about owner, position, role responsible for component; HIGH only.

• Owner field in CMDB

• No accountability assigned

Develop, document, implement configuration management plan addressing roles, processes, items under CM, identification scheme.

• Control implementation statement for CM-9 citing the system mission and inheritance from common controls
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Develop and review contingency planning policy at least annually.

• Control implementation statement for CP-1 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load

Provide for recovery and reconstitution of system to known state within RTO.

• Control implementation statement for CP-10 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

System Recovery and Reconstitution | Transaction Recovery. Implement transaction recovery for systems that are transaction-based

• DB transaction logs

• No transaction replay

Provide capability to restore system components within FedRAMP-defined time period from configuration-controlled and integrity-protected information; HIGH only.

• Restore drill metrics

• Untimed restore

Develop contingency plan; review and update annually (FedRAMP); coordinate with related plans.

• Control implementation statement for CP-2 citing the system mission and inheritance from common controls
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners

Coordinate contingency plan with related plans (BCP, DRP, COOP, IRP).

• Coordination matrix

• Siloed plans

Conduct capacity planning so necessary capacity exists during contingency operations; HIGH baseline.

• Capacity model

• No capacity for failover

Plan for resumption of mission/business functions within FedRAMP-defined time period after contingency plan activation.

• RTO documentation

• RTO undefined

Plan for continuation of essential mission/business functions with little or no loss of operational continuity; HIGH only.

• Hot-site capability

• No continuous capability

Contingency Plan | Identify Critical Assets. Identify critical system assets supporting [Selection: all; essential] mission and business functions

• BIA criticality map

• No criticality tiers

Provide contingency training to users assigned roles; within FedRAMP timeframe of role assignment and at least annually.

• Control implementation statement for CP-3 citing the system mission and inheritance from common controls
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Incorporate simulated events into contingency training to facilitate effective response; HIGH only.

• Tabletop exercise

• No simulations

Test contingency plan at least annually (FedRAMP) using FedRAMP-defined tests; review test results.

• Control implementation statement for CP-4 citing the system mission and inheritance from common controls
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load

Coordinate contingency plan testing with related plan testing.

• Joint test plan

• Independent testing only

Test contingency plan at alternate processing site; HIGH baseline.

• Failover test results

• Never failed over

Establish alternate storage site with agreements to permit storage and retrieval of system backup information.

• Control implementation statement for CP-6 citing the system mission and inheritance from common controls
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Alternate Storage Site | Separation from Primary Site. Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats

• Geographic separation evidence

• Same metro zone

Configure alternate storage site to facilitate recovery operations in accordance with RTO/RPO; HIGH only.

• RTO/RPO documentation

• No RTO/RPO

Alternate Storage Site | Accessibility. Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions

• Accessibility analysis

• No analysis

Establish alternate processing site with agreements for resumption of operations within FedRAMP-defined RTO.

• Control implementation statement for CP-7 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes
• Backups taken but restore tests never performed end to end

Alternate Processing Site | Separation from Primary Site. Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats

• Geographic separation

• Same region

Alternate Processing Site | Accessibility. Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions

• Accessibility plan

• No plan

Alternate Processing Site | Priority of Service. Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives)

• SLA priority clause

• No priority clauses

Prepare alternate processing site so it is ready to be used as the operational site; HIGH only.

• Hot-site readiness check

• Cold site only

Establish alternate telecommunications services with agreements to permit resumption of system operations.

• Control implementation statement for CP-8 citing the system mission and inheritance from common controls
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Telecommunications Services | Priority of Service Provisions. (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Service Priority

• TSP enrollment

• No TSP

Telecommunications Services | Single Points of Failure. Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services

• Diverse routing

• SPOFs unmitigated

Obtain alternate telecommunications services from providers separated from primary providers; HIGH only.

• Carrier diversity

• Same carrier diff product

Require primary and alternate telecommunications providers to have contingency plans; review them; HIGH only.

• Carrier BCP review

• No carrier BCP visibility

Conduct backups of user-level, system-level, and security-related documentation; FedRAMP-defined frequency (daily incremental, weekly full).

• Control implementation statement for CP-9 citing the system mission and inheritance from common controls
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes
• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems

Test backup information annually to verify reliability and integrity.

• Restore test results

• Backups never restored

Use sample of backup information to restore selected system functions as part of testing; HIGH only.

• Partial restore evidence

• No sample restores

Store backup copies of critical software in separate facility or fire-rated container not collocated with operational software.

• Offsite backup evidence

• Backups onsite only

Transfer system backup information to alternate storage site at FedRAMP-defined rate (daily incremental, weekly full); HIGH only.

• Replication schedule

• Weekly only replication

System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]

• Backup encryption config

• Unencrypted backups

Develop and review identification and authentication policy at least annually.

• Control implementation statement for IA-1 citing the system mission and inheritance from common controls
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Default vendor credentials remain on appliances and IoT devices
• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change

Require re-authentication when FedRAMP-defined circumstances occur (role change, privilege change, time period elapsed).

• Control implementation statement for IA-11 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Identity Proofing. a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a

• Control implementation statement for IA-12 citing the system mission and inheritance from common controls
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Identity Proofing | Identity Evidence. Require evidence of individual identification be presented to the registration authority

• Evidence collection records

• Weak proofing evidence

Identity Proofing | Identity Evidence Validation and Verification. Require that the presented identity evidence be validated and verified through [Assignment: organizational defined methods of validation and verification]

• Validation procedure

• Self-attested only

Require in-person identity verification for IAL3 (HIGH privileged).

• In-person proofing record

• Remote-only proofing

Identity Proofing | Address Confirmation. Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record

• Address confirmation records

• No address confirmation

Uniquely identify and authenticate organizational users and associate identity with processes acting on behalf of users.

• Control implementation statement for IA-2 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Default vendor credentials remain on appliances and IoT devices
• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Implement MFA for access to privileged accounts; phishing-resistant per FedRAMP.

• FIDO2/PIV config

• SMS OTP only

Accept and electronically verify Personal Identity Verification credentials.

• PIV reader config

• No PIV support

Implement MFA for non-privileged accounts; phishing-resistant per FedRAMP.

• MFA coverage report

• Exemptions persist

Identification and Authentication (organizational Users) | Individual Authentication with Group Authentication. When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources

• Group account handling

• Direct group login

Identification and Authentication (organizational Users) | Access to Accounts , separate Device. Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that:

• Hardware token policy

• Same-device push only

Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

• Nonce/timestamp auth

• Replayable tokens

Uniquely identify and authenticate devices before establishing connection.

• Control implementation statement for IA-3 citing the system mission and inheritance from common controls
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Manage identifiers; uniquely identify; prevent reuse for FedRAMP-defined period.

• Control implementation statement for IA-4 citing the system mission and inheritance from common controls
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Identifier Management | Identify User Status. Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status]

• Identifier schema

• No status markers

Manage authenticators; verify identity prior to issuing; establish initial content; protect.

• Control implementation statement for IA-5 citing the system mission and inheritance from common controls
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Enforce password complexity per NIST SP 800-63B; minimum 12 characters (FedRAMP); compare against breach lists.

• Password policy
• Breach check integration

• No breach checking

Prohibit the use of cached authenticators after a FedRAMP-defined time period.

• Configuration setting the cached credential lifetime
• Exported policy or screenshots showing the enforced expiry
• Test evidence that a cached authenticator is refused after the period

• Cached credential expiry left at the operating system default
• Mobile and offline endpoints excluded from the setting

Enforce authorized use of public key-based authentication; validate certificates; map identity to account.

• PKI policy
• CRL/OCSP config

• No revocation checking

Protect authenticators commensurate with security category of information they protect.

• Authenticator handling SOP

• Tokens in cleartext

Authenticator Management | No Embedded Unencrypted Static Authenticators. Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage

• Secret scanning results
• Vault adoption

• Hardcoded creds

Implement security safeguards to manage risk of compromise due to individuals having accounts on multiple systems; HIGH only.

• SSO consolidation evidence

• Separate creds per system

Obscure authentication feedback during authentication process.

• Control implementation statement for IA-6 citing the system mission and inheritance from common controls
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals
• Default vendor credentials remain on appliances and IoT devices

Implement authentication to cryptographic modules meeting FIPS 140 (FedRAMP requires FIPS-validated).

• Control implementation statement for IA-7 citing the system mission and inheritance from common controls
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Uniquely identify and authenticate non-organizational users (e.g., federal customers).

• Control implementation statement for IA-8 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals
• Default vendor credentials remain on appliances and IoT devices

Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies. Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies

• Cross-agency PIV trust

• Internal PIV only

Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators. (a) Accept only external authenticators that are NIST-compliant; and (b) Document and maintain a list of accepted external authenticators

• FICAM-approved IDP list

• Non-FICAM IDP

Identification and Authentication (non-organizational Users) | Use of Defined Profiles. Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles]

• Profile documentation

• No profile mapping

Requires an incident response policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.

• Control implementation statement for IR-1 citing the system mission and inheritance from common controls
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Requires incident response training for system users consistent with their assigned roles, within a defined period of assuming the role and periodically thereafter.

• Control implementation statement for IR-2 citing the system mission and inheritance from common controls
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting

Incorporate simulated events into IR training; HIGH only.

• Tabletop records

• No simulations

Provide thorough and realistic IR training via automated mechanisms; HIGH only.

• Cyber range evidence

• No simulation environment

Requires the incident response capability to be tested at a defined frequency using defined tests, to determine its effectiveness, and the results documented.

• Control implementation statement for IR-3 citing the system mission and inheritance from common controls
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Incident Response Testing | Coordination with Related Plans. Coordinate incident response testing with organizational elements responsible for related plans

• Joint test plan

• Isolated tests

Implement IR capability for preparation, detection/analysis, containment, eradication, recovery.

• Control implementation statement for IR-4 citing the system mission and inheritance from common controls
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Support incident handling via automated mechanisms.

• SOAR playbooks

• Manual-only handling

Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization within a FedRAMP-defined time period.

• Incident response team charter with named roles and deployment commitments
• On-call roster and escalation tree
• Records of deployment or remote engagement inside the committed period

• Team is a distribution list rather than named accountable roles
• No deployment time commitment defined, so it is never measured

Include FedRAMP-defined types of dynamic reconfiguration for FedRAMP-defined system components as part of the incident response capability.

• Incident response plan section naming the components that can be dynamically reconfigured
• Runbooks for isolation, rule changes or rerouting during an incident
• Exercise records showing dynamic reconfiguration actually performed

• Capability exists technically but is not written into the incident response plan
• Never exercised, so the achievable change window is unknown

Correlate incident information and individual incident responses for organization-wide perspective; HIGH only.

• Cross-incident analytics

• No correlation across incidents

Implement incident handling capability for insider threats.

• Insider threat program

• No insider program

Track and document incidents.

• Control implementation statement for IR-5 citing the system mission and inheritance from common controls
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines

Track incidents and collect/analyze incident information via automated mechanisms; HIGH only.

• SIEM/SOAR integration

• Manual incident logs

Require personnel to report incidents to organizational authorities within FedRAMP timeframe; report to FedRAMP PMO and US-CERT.

• Control implementation statement for IR-6 citing the system mission and inheritance from common controls
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Report incidents via automated mechanisms.

• Automated reporting workflow

• Manual email reports

Incident Reporting | Supply Chain Coordination. Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components

• Supplier notification log

• No supplier coordination

Provide IR support resource (help desk, support group) for incident handling assistance.

• Control implementation statement for IR-7 citing the system mission and inheritance from common controls
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines
• Third party incident responder retainer expired

Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]

• Knowledge base

• No automated KB

Develop and implement IRP; review and update annually; distribute.

• Control implementation statement for IR-8 citing the system mission and inheritance from common controls
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines

Information Spillage Response. Respond to information spills by: a. Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information involved in the system contamination; c. Alerting

• Spill response procedure

• No spill procedure

Information Spillage Response | Training. Provide information spillage response training [Assignment: organization-defined frequency]

• Spill training records

• No spill training

Information Spillage Response | Post-spill Operations. Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment:

• Post-spill procedure

• Personnel locked out

Information Spillage Response | Exposure to Unauthorized Personnel. Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls]

• Exposure handling SOP

• No safeguards

Develop and review maintenance policy at least annually.

• Control implementation statement for MA-1 citing the system mission and inheritance from common controls
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses

• Emergency maintenance performed without retrospective documentation
• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access

Schedule, document, review records of maintenance, repair, replacement of components.

• Control implementation statement for MA-2 citing the system mission and inheritance from common controls
• Remote maintenance session logs with MFA and supervision evidence
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Schedule, conduct, document maintenance via automated mechanisms; HIGH only.

• Auto-patching evidence

• Manual patch logs

Maintenance Tools. a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: organization-defined frequency]

• Control implementation statement for MA-3 citing the system mission and inheritance from common controls
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication

Maintenance Tools | Inspect Tools. Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications

• Tool inspection records

• No inspections

Maintenance Tools | Inspect Media. Check media containing diagnostic and test programs for malicious code before the media are used in the system

• Media scan logs

• No media scanning

Maintenance Tools | Prevent Unauthorized Removal. Prevent the removal of maintenance equipment containing organizational information by: (a) Verifying that there is no organizational information contained on the equipment; (b) Sanitizing or destroying the equipment;

• Removal procedure

• No removal control

Approve and monitor nonlocal maintenance activities; use strong authentication.

• Control implementation statement for MA-4 citing the system mission and inheritance from common controls
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Require nonlocal maintenance services be performed from component with comparable security; sanitize before/after; HIGH only.

• Sanitization records

• No sanitization

Establish process for authorizing maintenance personnel; maintain list of authorized personnel; supervise unauthorized.

• Control implementation statement for MA-5 citing the system mission and inheritance from common controls
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence

• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Maintenance Personnel | Individuals Without Appropriate Access. The organization: (a) Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements: (1)

• Escort procedure

• Unescorted vendors

Timely Maintenance. Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure

• Support contracts

• No SLA

Develop and review media protection policy at least annually.

• Control implementation statement for MP-1 citing the system mission and inheritance from common controls
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Backup tapes shipped without tamper evident packaging
• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Restrict access to FedRAMP-defined types of digital and non-digital media to authorized personnel.

• Control implementation statement for MP-2 citing the system mission and inheritance from common controls
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Mark system media indicating distribution limitations, handling caveats, security markings.

• Control implementation statement for MP-3 citing the system mission and inheritance from common controls
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory

Physically control and securely store FedRAMP-defined types of media within FedRAMP-defined controlled areas.

• Control implementation statement for MP-4 citing the system mission and inheritance from common controls
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Protect and control media during transport outside controlled areas; maintain accountability; document activities; restrict transport to authorized personnel.

• Control implementation statement for MP-5 citing the system mission and inheritance from common controls
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory
• Backup tapes shipped without tamper evident packaging

Sanitize media prior to disposal, release, or reuse using FedRAMP-defined methods (NIST SP 800-88).

• Control implementation statement for MP-6 citing the system mission and inheritance from common controls
• Media transport chain of custody logs
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory

Review, approve, track, document, verify media sanitization and disposal actions.

• Disposal records

• No verification step

Test sanitization equipment and procedures at FedRAMP-defined frequency to ensure intended operation.

• Equipment test

• No equipment tests

Apply nondestructive sanitization techniques to portable storage devices prior to connecting to system under FedRAMP-defined circumstances.

• Pre-connect wipe procedure

• No pre-use sanitization

Restrict or prohibit use of FedRAMP-defined types of media on FedRAMP-defined systems using safeguards.

• Control implementation statement for MP-7 citing the system mission and inheritance from common controls
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory
• Backup tapes shipped without tamper evident packaging

Develop and review physical/environmental policy at least annually.

• Control implementation statement for PE-1 citing the system mission and inheritance from common controls
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Emergency Shutoff. a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations; b. Place emergency shutoff switches or devices in [Assignment: organization-defined location by system

• Control implementation statement for PE-10 citing the system mission and inheritance from common controls
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Emergency Power. Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power

• Control implementation statement for PE-11 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Provide alternate power that is self-contained and not reliant on external sources; HIGH only.

• Generator config

• No generator

Employ and maintain automatic emergency lighting activating on power outage covering emergency exits.

• Control implementation statement for PE-12 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Employ and maintain fire suppression and detection devices independent of energy source.

• Control implementation statement for PE-13 citing the system mission and inheritance from common controls
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Fire Protection | Detection Systems. Automatic Activation and Notification. Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a

• Alarm escalation

• No escalation list

Fire Protection | Suppression Systems. Automatic Activation and Notification. (a) Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders]; and (b) Employ an

• Automatic suppression

• Manual only

Maintain temperature and humidity within FedRAMP-defined acceptable levels; monitor at FedRAMP frequency.

• Control implementation statement for PE-14 citing the system mission and inheritance from common controls
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to FedRAMP-defined personnel or roles.

• Environmental monitoring configuration showing the alarm thresholds
• Alarm routing list naming the recipients
• Alarm test records and sample notifications

• Monitoring present but alarms route to an unmonitored mailbox
• Inherited from the data centre provider with no customer responsibility matrix entry evidencing it

Water Damage Protection. Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel

• Control implementation statement for PE-15 citing the system mission and inheritance from common controls
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Detect leaks and alert FedRAMP-defined personnel via automated mechanisms; HIGH only.

• Auto leak sensors

• Manual checks

Authorize and control system components entering/exiting facility; maintain records.

• Inventory in/out logs

• No records

Determine alternate work sites; employ FedRAMP-defined controls at alternate sites; assess effectiveness.

• Control implementation statement for PE-17 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Position system components to minimize damage from physical/environmental hazards and unauthorized access; HIGH only.

• Rack layout

• High-risk placement

Develop, approve, maintain list of individuals with authorized facility access; review at least quarterly (FedRAMP).

• Control implementation statement for PE-2 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures

Enforce physical access at entry/exit points; verify authorizations; control ingress/egress; maintain audit logs.

• Control implementation statement for PE-3 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Enforce physical access authorizations to system in addition to physical access controls for facility; HIGH only.

• Secondary access controls

• Facility-only controls

Access Control for Transmission. Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls]

• Control implementation statement for PE-4 citing the system mission and inheritance from common controls
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Access Control for Output Devices. Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output

• Control implementation statement for PE-5 citing the system mission and inheritance from common controls
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Monitor physical access to facility; review access logs at least weekly (FedRAMP); coordinate review with IR.

• Control implementation statement for PE-6 citing the system mission and inheritance from common controls
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment. Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment

• CCTV deployment

• No surveillance

Monitor physical access to system in addition to facility access at FedRAMP-defined components; HIGH only.

• Cage/rack camera

• Only facility monitored

Maintain visitor access records for FedRAMP-defined period (1 year); review records monthly (FedRAMP).

• Control implementation statement for PE-8 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Maintain and review visitor access records via automated mechanisms; HIGH only.

• Visitor mgmt system

• Paper log

Power Equipment and Cabling. Protect power equipment and power cabling for the system from damage and destruction

• Control implementation statement for PE-9 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Develop and review planning policy at least annually.

• Control implementation statement for PL-1 citing the system mission and inheritance from common controls
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel

• Planning artefacts lack version history and approval signatures
• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes

Baseline Selection. Select a control baseline for the system

• Control implementation statement for PL-10 citing the system mission and inheritance from common controls
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

• Control implementation statement for PL-11 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies

Develop SSP that aligns with FedRAMP template; review and update annually.

• Control implementation statement for PL-2 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• Planning artefacts lack version history and approval signatures
• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually

Establish and provide rules describing user responsibilities; receive signed acknowledgement.

• Control implementation statement for PL-4 citing the system mission and inheritance from common controls
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies

Rules of Behavior | Social Media and External Site/application Usage Restrictions. Include in the rules of behavior, restrictions on: (a) Use of social media, social networking sites, and external sites/applications; (b) Posting organizational information

• Social media clause

• Generic RoB

Develop, document, maintain security/privacy architectures; review annually.

• Control implementation statement for PL-8 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies
• Planning artefacts lack version history and approval signatures

Develop and review personnel security policy at least annually.

• Control implementation statement for PS-1 citing the system mission and inheritance from common controls
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Background checks not re run when employees move to higher risk roles
• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Assign risk designation to positions; review and update at least every three years.

• Control implementation statement for PS-2 citing the system mission and inheritance from common controls
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Screen individuals prior to authorizing access; rescreen at FedRAMP frequency per position risk; US citizenship may apply.

• Control implementation statement for PS-3 citing the system mission and inheritance from common controls
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change

Personnel Screening | Information Requiring Special Protective Measures. Verify that individuals accessing a system processing, storing, or transmitting information requiring special protection: (a) Have valid access authorizations that are demonstrated by assigned official government

• Special access agreements

• No special handling

Disable access and revoke authenticators within FedRAMP-defined time (same day); conduct exit interview; retrieve property.

• Control implementation statement for PS-4 citing the system mission and inheritance from common controls
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Use automated mechanisms to notify defined personnel upon termination and disable access; HIGH only.

• HR-IAM integration

• Manual offboarding

Review/confirm ongoing operational need for access when personnel transfer; modify access; notify within FedRAMP timeframe.

• Control implementation statement for PS-5 citing the system mission and inheritance from common controls
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Develop access agreements; review and update annually; require signature before access.

• Control implementation statement for PS-6 citing the system mission and inheritance from common controls
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change

Establish personnel security requirements for external providers; require providers to notify within FedRAMP timeframe of personnel changes.

• Control implementation statement for PS-7 citing the system mission and inheritance from common controls
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Employ formal sanctions for personnel failing to comply with security/privacy policies; notify defined personnel within FedRAMP timeframe.

• Control implementation statement for PS-8 citing the system mission and inheritance from common controls
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions

• Control implementation statement for PS-9 citing the system mission and inheritance from common controls
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles
• Termination access removal exceeds documented SLA

Develop and review risk assessment policy at least annually.

• Control implementation statement for RA-1 citing the system mission and inheritance from common controls
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads

Categorize system per FIPS 199; document; review and update annually.

• Control implementation statement for RA-2 citing the system mission and inheritance from common controls
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications

Conduct risk assessment annually (FedRAMP); document; review and update.

• Control implementation statement for RA-3 citing the system mission and inheritance from common controls
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners

• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections

Risk Assessment | Supply Chain Risk Assessment. (a) Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services]; and (b) Update the supply chain risk assessment [Assignment: organization-defined frequency], when

• SCRM assessment

• No SCRM

Scan for vulnerabilities monthly (FedRAMP); OS/network weekly, web app monthly, database monthly; remediate within FedRAMP timeframes (HIGH critical 15d, high 30d).

• Control implementation statement for RA-5 citing the system mission and inheritance from common controls
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence

• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections

Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components

• VDP page
• Triage SOP

• No VDP

Update vulnerability list prior to scan, when new vulnerabilities identified, or at FedRAMP frequency.

• Scanner update schedule

• Stale signatures

Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage

• The documented definition of breadth and depth of vulnerability scanning coverage, stating which components and which vulnerability classes are in scope
• Scanner configuration showing the target scope and the checks enabled, matched against that definition
• Scan results demonstrating the defined breadth was actually reached, with an accounted list of assets not scanned
• Reconciliation of scan targets against the system component inventory
• Evidence of authenticated scanning where depth requires it, and the credentials scope used

• Breadth and depth asserted from the tool default rather than defined by the organisation, which is exactly what this enhancement requires
• Scan coverage never reconciled against the asset inventory, so unscanned hosts are invisible
• Unauthenticated scanning presented as satisfying depth, missing configuration and patch level findings

Determine what information about system is discoverable and take corrective actions; HIGH only.

• OSINT analysis

• No external recon

Implement privileged access authorization to FedRAMP-defined components for vulnerability scanning.

• Authenticated scan config

• Unauthenticated scans only

Review historic audit logs to determine if a vulnerability identified in a FedRAMP-defined system has been previously exploited within a FedRAMP-defined time period.

• Procedure linking a new vulnerability finding to a retrospective log review
• Log retention evidence covering the defined lookback period
• Completed retrospective reviews with their conclusions

• Log retention shorter than the lookback period the procedure claims
• Retrospective review done only after a major incident rather than as routine

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so identified risk is treated rather than only recorded.

• Control implementation statement for RA-7 citing the system mission and inheritance from common controls
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections
• High severity vulnerabilities exceed remediation SLA without risk acceptance

Criticality Analysis. Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle]

• Control implementation statement for RA-9 citing the system mission and inheritance from common controls
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners

• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections
• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date

Requires a system and services acquisition policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.

• Control implementation statement for SA-1 citing the system mission and inheritance from common controls
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review

Require developer to perform CM during development, implementation, operation; document/track changes; implement only approved changes.

• Control implementation statement for SA-10 citing the system mission and inheritance from common controls
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed

Require developer to test at FedRAMP-defined depth and coverage; document; correct flaws.

• Control implementation statement for SA-11 citing the system mission and inheritance from common controls
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

Developer Testing and Evaluation | Static Code Analysis. Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of

• SAST results

• No SAST

Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses. Require the developer of the system, system component, or system service to perform threat modeling and vulnerability analyses during development and the subsequent testing

• Threat models

• No threat modeling

Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

• Control implementation statement for SA-15 citing the system mission and inheritance from common controls
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams

Development Process, Standards, and Tools | Criticality Analysis. Require the developer of the system, system component, or system service to perform a criticality analysis: (a) At the following decision points in the system development

• Contract or solicitation clause requiring the developer to perform criticality analysis
• The developer's criticality analysis output identifying critical components and functions
• Evidence the analysis was performed at the defined decision points in the development life cycle
• Evidence the analysis was performed at the defined level of detail or decomposition
• Organisational review of the developer's analysis and the actions taken on its findings

• Analysis delivered once at design with no repeat at the later decision points the requirement names
• Decomposition stopped at the subsystem level, so the critical component inside it is never identified
• Developer output accepted with no organisational review, so criticality findings drive no acquisition decision

Require developer to provide training on correct use and operation of security/privacy functions; HIGH only.

• Vendor training

• No training

Require developer to produce design specification and security architecture; HIGH only.

• Security architecture

• No architecture

Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; determine, document and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.

• Mission and business process planning documentation recording the high-level information security and privacy requirements determined for the system or system service
• Capital planning and investment control submission or business case showing the resources determined, documented and allocated to protect the system or system service
• Programming and budgeting documentation showing a discrete line item for information security and privacy
• Approved budget or spend plan carrying that line item, with its approval record
• System security and privacy plan section recording the allocated resources and the basis for the amount
• Records of review of the allocation when requirements or the system change across the system development life cycle

• Security and privacy requirements determined after the acquisition decision rather than during mission and business process planning
• Security funding absorbed into a general IT or infrastructure line, so no discrete information security and privacy item exists to evidence
• Resources named in a plan but never traced through to an approved budget or capital planning submission
• Privacy resourcing omitted while security resourcing is documented, although the control covers both
• Line item established once at authorization and not maintained through sustainment and supply chain activity

Require developer of FedRAMP-defined components to have personnel access authorizations and screening; HIGH only.

• Developer screening

• No screening

Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

• Control implementation statement for SA-22 citing the system mission and inheritance from common controls
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

Manage system using SDLC incorporating security/privacy considerations.

• Control implementation statement for SA-3 citing the system mission and inheritance from common controls
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed

Include security/privacy requirements in contracts; FedRAMP-defined assurance requirements.

• Control implementation statement for SA-4 citing the system mission and inheritance from common controls
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix

Acquisition Process | Functional Properties of Controls. Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented

• Control descriptions

• Generic vendor docs

Employ only information technology products on FIPS 201-approved products list for PIV capability.

• APL evidence

• Non-APL products

Acquisition Process | Design and Implementation Information for Controls. Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or

• Design docs

• No design info

Require developer to deliver system with security configurations preconfigured.

• Secure defaults

• Insecure defaults

Acquisition Process | Functions, Ports, Protocols, and Services in Use. Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use

• PPS list

• Undocumented PPS

Obtain administrator and user documentation; protect; distribute to FedRAMP-defined personnel.

• Control implementation statement for SA-5 citing the system mission and inheritance from common controls
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix

Apply FedRAMP-defined systems security and privacy engineering principles in development.

• Control implementation statement for SA-8 citing the system mission and inheritance from common controls
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams

Require providers of external system services to comply with security/privacy requirements; document oversight roles.

• Control implementation statement for SA-9 citing the system mission and inheritance from common controls
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

External System Services | Risk Assessments and Organizational Approvals. (a) Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and (b) Verify that the acquisition or outsourcing

• Pre-acquisition RA

• No pre-procurement RA

Require providers to identify functions, ports, protocols, services required for external services.

• PPS documentation

• Undocumented

External System Services | Processing, Storage, and Service Location. Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or

• US-only attestation

• Foreign data residency

Develop and review system/comms protection policy at least annually.

• Control implementation statement for SC-1 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries

Terminate network connection at end of session or after FedRAMP-defined inactivity period (no longer than 30 minutes).

• Control implementation statement for SC-10 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).

• Control implementation statement for SC-12 citing the system mission and inheritance from common controls
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Maintain availability of information in event of loss of cryptographic keys via key escrow or recovery; HIGH only.

• Key recovery procedure

• No escrow

Implement FedRAMP-defined cryptographic uses and approved cryptography (FIPS 140 validated).

• Control implementation statement for SC-13 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Prohibit remote activation of collaborative computing devices (cameras, mics) without explicit user indication; provide explicit notification.

• Control implementation statement for SC-15 citing the system mission and inheritance from common controls
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect

Issue public key certificates under FedRAMP-defined policy or obtain from approved service providers.

• Control implementation statement for SC-17 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect

Define acceptable and unacceptable mobile code; authorize use; monitor.

• Mobile code policy

• No policy

Separate user functionality from system management functionality.

• Control implementation statement for SC-2 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Provide artifacts for additional data origin authentication and integrity verification (DNSSEC) for child zones; FedRAMP requires DNSSEC.

• Control implementation statement for SC-20 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Request and perform data origin authentication and data integrity verification on name/address resolution responses; DNSSEC validation.

• Control implementation statement for SC-21 citing the system mission and inheritance from common controls
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Ensure DNS systems are fault-tolerant and implement role separation.

• Control implementation statement for SC-22 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Protect authenticity of communications sessions.

• Control implementation statement for SC-23 citing the system mission and inheritance from common controls
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Fail to FedRAMP-defined known secure state for FedRAMP-defined failures; preserve FedRAMP-defined information in failure; HIGH only.

• Failure mode docs

• Undefined failure state

Protect confidentiality and integrity of FedRAMP-defined information at rest.

• Control implementation statement for SC-28 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries

Implement cryptographic mechanisms to prevent unauthorized disclosure/modification of FedRAMP-defined information on FedRAMP-defined components; FIPS-validated.

• At-rest encryption attestation

• Backups unencrypted

Isolate security functions from non-security functions; HIGH only.

• Process isolation evidence

• No isolation

Maintain separate execution domain for each executing system process.

• Control implementation statement for SC-39 citing the system mission and inheritance from common controls
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Prevent unauthorized and unintended information transfer via shared system resources.

• Control implementation statement for SC-4 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

System Time Synchronization. Synchronize system clocks within and between systems and system components

• NTP topology

• Clock drift

System Time Synchronization | Synchronization with Authoritative Time Source. (a) Compare the internal system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source]; and (b) Synchronize the internal system clocks to the authoritative

• NTP authoritative source

• Public NTP only

Protect against or limit effects of DoS attacks using FedRAMP-defined safeguards.

• Control implementation statement for SC-5 citing the system mission and inheritance from common controls
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Monitor/control communications at external boundary and key internal boundaries; implement subnetworks for publicly accessible components.

• Control implementation statement for SC-7 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Prevent exfiltration of information; conduct exfiltration tests at FedRAMP-defined frequency; HIGH only.

• DLP config
• Exfil test

• No DLP

Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components]

• Host firewall config

• Host firewall off

Boundary Protection | Fail Secure. Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device

• Fail-closed config

• Fail open

Provide capability to dynamically isolate FedRAMP-defined system components.

• Quarantine playbook

• No quarantine capability

Employ boundary protection mechanisms to separate FedRAMP-defined components supporting FedRAMP-defined missions; HIGH only.

• Mission-based segmentation

• No mission segregation

Limit number of external network connections to system; TIC-aligned.

• TIC/managed connections

• Multiple uncontrolled gateways

Implement managed interface for each external telecommunications service; establish traffic flow policy; protect confidentiality and integrity; document exceptions; review at least annually.

• Telecom interface inventory

• Unmanaged services

Deny network communications by default; allow by exception.

• Default deny rule

• Permissive rules

Prevent split tunneling for remote devices unless securely provisioned.

• VPN client policy

• Split tunneling enabled

Route internal traffic to FedRAMP-defined external networks through authenticated proxies.

• Proxy config

• Direct egress

Protect confidentiality and integrity of transmitted information using cryptographic mechanisms.

• Control implementation statement for SC-8 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Implement FIPS-validated cryptographic mechanisms to prevent unauthorized disclosure and detect changes during transmission.

• FIPS 140 cert numbers
• TLS scan

• TLS 1.0/1.1 enabled

Develop and review system/information integrity policy at least annually.

• Control implementation statement for SI-1 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Input validation handled inconsistently across microservices
• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception

Check validity of FedRAMP-defined information inputs.

• Control implementation statement for SI-10 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Generate error messages providing necessary info without revealing sensitive info; reveal only to authorized.

• Error handling review

• Stack traces exposed

Manage and retain information consistent with applicable laws, regulations, policies, standards.

• Control implementation statement for SI-12 citing the system mission and inheritance from common controls
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

Implement FedRAMP-defined safeguards to protect memory from unauthorized code execution (DEP, ASLR).

• Control implementation statement for SI-16 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments
• Input validation handled inconsistently across microservices

Identify, report, and correct system flaws; remediate within FedRAMP-defined timeframes (HIGH critical 15d, high 30d).

• Control implementation statement for SI-2 citing the system mission and inheritance from common controls
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Input validation handled inconsistently across microservices
• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Determine status of flaw remediation via automated mechanisms at FedRAMP-defined frequency (at least monthly).

• Patch status dashboard

• Manual reporting

Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined

• MTTR metrics

• No MTTR tracking

Implement signature-based and non-signature-based malicious code protection; configure to scan endpoints and entry/exit points.

• Control implementation statement for SI-3 citing the system mission and inheritance from common controls
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Monitor system to detect attacks; identify unauthorized use; deploy monitoring devices at boundaries and key internal points.

• Control implementation statement for SI-4 citing the system mission and inheritance from common controls
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots
• Input validation standards and code review checklist
• Security monitoring alert tuning records

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

System Monitoring | System-wide Intrusion Detection System. Connect and configure individual intrusion detection tools into a system-wide intrusion detection system

• IDS architecture

• Siloed IDS

Provide capability to render visible information in encrypted communications traffic to FedRAMP-defined system monitoring tools.

• TLS inspection config

• Encrypted blind spots

Analyze outbound traffic for anomalies indicating exfiltration or compromise.

• NDR/anomaly tool

• No baseline

Alert FedRAMP-defined personnel using automated mechanisms when FedRAMP-defined events occur; HIGH only.

• Auto-alerting config

• Manual alerts

Employ wireless intrusion detection to identify rogue wireless devices and detect attack attempts; HIGH only.

• WIDS deployment

• No WIDS

System Monitoring | Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employed throughout the system

• SIEM correlation

• Siloed monitoring

System Monitoring | Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points

• DNS tunneling detection

• No covert channel detection

Implement FedRAMP-defined additional monitoring of individuals identified as posing increased risk; HIGH only.

• Heightened monitoring SOP

• No risk-based monitoring

Employ automated tools to support near-real-time analysis of events.

• SIEM correlation

• Batch analysis only

Implement FedRAMP-defined additional monitoring of privileged users; HIGH only.

• Privileged session recording

• No PAM recording

Detect network services not authorized; audit or alert FedRAMP-defined personnel.

• Port scan baseline

• No unauthorized service detection

System Monitoring | Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms]

• EDR coverage

• EDR gaps

Determine criteria for unusual or unauthorized activity; monitor inbound/outbound communications.

• Egress monitoring

• No egress monitoring

Alert FedRAMP-defined personnel when indications of compromise/potential compromise occur.

• Alert rules
• On-call rotation

• No on-call

Receive alerts/advisories/directives from FedRAMP-defined external organizations (US-CERT, CISA); generate internal; disseminate.

• Control implementation statement for SI-5 citing the system mission and inheritance from common controls
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots
• Input validation standards and code review checklist
• Security monitoring alert tuning records

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Broadcast security alerts and advisories throughout organization via automated mechanisms; HIGH only.

• Distribution platform

• Manual broadcasts

Security and Privacy Function Verification. a. Verify the correct operation of [Assignment: organization-defined security and privacy functions]; b. Perform the verification of the functions specified in SI-6a [Selection (one or more): [Assignment: organization-defined system

• Function verification logs

• No verification

Employ integrity verification tools to detect unauthorized changes to software, firmware, information; HIGH only.

• Control implementation statement for SI-7 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

Perform integrity checks of software, firmware, information at FedRAMP-defined frequency or trigger events.

• Integrity check schedule

• Infrequent checks

Implement cryptographic mechanisms to authenticate FedRAMP-defined software or firmware components prior to installation.

• List of components subject to cryptographic authentication
• Pipeline or configuration step performing signature verification before install
• Records of components rejected for failing authentication

• Verification applied to vendor packages but not to internally built artefacts
• No record kept of verification failures

Employ automated tools to provide notification of integrity violations to FedRAMP-defined personnel; HIGH only.

• FIM alerts

• No alerting

Automatically shut down, restart, or implement FedRAMP-defined safeguards when integrity violations discovered; HIGH only.

• Auto-response config

• Manual response only

Incorporate detection of FedRAMP-defined unauthorized changes into IR capability.

• IR playbook for FIM

• FIM not in IR

Employ spam protection at entry/exit points; update spam protection mechanisms when new releases available.

• Email gateway config

• No spam protection

Spam Protection | Automatic Updates. Automatically update spam protection mechanisms [Assignment: organization-defined frequency]

• Auto-update config

• Manual updates

Develop, document, disseminate, and review supply chain risk management policy and procedures at defined frequency.

• Control implementation statement for SR-1 citing the system mission and inheritance from common controls
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Vendor risk tier ratings static despite changes in service scope
• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work

Inspect systems or components at defined frequency or upon indications of tampering to detect compromise.

• Control implementation statement for SR-10 citing the system mission and inheritance from common controls
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Implement anti-counterfeit policy and procedures to detect and prevent counterfeit components.

• Control implementation statement for SR-11 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work

Component Authenticity | Anti-counterfeit Training. Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware)

• Training curriculum
• Training records
• LMS records

• No role-based training

Component Authenticity | Configuration Control for Component Service and Repair. Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system

• Repair handling procedure
• Asset transit logs
• Asset tracker

• No revalidation after repair

Dispose of data, documentation, tools, or system components using defined techniques and methods.

• Control implementation statement for SR-12 citing the system mission and inheritance from common controls
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components
• Vendor risk tier ratings static despite changes in service scope

Develop a C-SCRM plan for managing supply chain risks for systems, components, and services; review and update at defined frequency.

• Control implementation statement for SR-2 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Vendor risk tier ratings static despite changes in service scope
• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification

Supply Chain Risk Management Plan | Establish SCRM Team. Establish a supply chain risk management team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: organization-defined

• Team charter
• Roster
• Meeting minutes
• Collaboration site

• No legal or procurement reps

Establish processes to identify, protect, detect, respond, and recover across the supply chain lifecycle.

• Control implementation statement for SR-3 citing the system mission and inheritance from common controls
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Employ acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.

• Control implementation statement for SR-5 citing the system mission and inheritance from common controls
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Assess and review the supply chain risk posture of suppliers at defined frequency and after significant events.

• Control implementation statement for SR-6 citing the system mission and inheritance from common controls
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Establish agreements with suppliers for notification of supply chain compromises and relevant changes.

• Control implementation statement for SR-8 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Implement tamper resistance and detection for systems, components, and devices.

• Tamper procedures
• Inspection logs
• Tamper-evident packaging

• No tamper seal verification

Apply tamper resistance and detection at multiple stages of the system development lifecycle.

• SDLC integration plan
• Stage gate records
• CI and CD controls

• Only physical, no build-time controls