NIST SP 800-53 Rev 5 MODERATE

Develop and disseminate access control policy and procedures; review at least annually (FedRAMP parameter); update following defined events.

• Control implementation statement for AC-1 citing the system mission and inheritance from common controls
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated

Prevent further access by initiating device lock after 15 minutes inactivity (FedRAMP) or upon user request.

• Control implementation statement for AC-11 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Device Lock | Pattern-hiding Displays. Conceal, via the device lock, information previously visible on the display with a publicly viewable image

• Lock screen image configuration
• Screenshots showing pattern-hiding
• MDM payload

• Lock shows live data
• Configuration drift
• No screenshot evidence

Automatically terminate user session after FedRAMP-defined conditions (idle timeout, trigger events).

• Control implementation statement for AC-12 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Identify and document actions allowed without identification or authentication.

• Control implementation statement for AC-14 citing the system mission and inheritance from common controls
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Establish usage restrictions, configuration requirements, and authorize remote access prior to allowing.

• Control implementation statement for AC-17 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability

Employ automated mechanisms to monitor and control remote access.

• VPN logs
• Remote session monitoring

• No remote session logging

Implement cryptographic mechanisms to protect remote access sessions; FIPS-validated.

• FIPS 140 module list
• TLS config

• Non-FIPS ciphers enabled

Route remote accesses through FedRAMP-defined number of managed network access control points.

• Network ingress diagram
• TIC compliance

• Split tunneling allowed

Authorize execution of privileged commands and access to security-relevant information via remote access only for defined needs.

• Bastion logs
• Approved command list

• No bastion enforcement

Establish configuration requirements, usage restrictions, authorize wireless access.

• Control implementation statement for AC-18 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability

Protect wireless access using authentication and encryption (WPA2/3 Enterprise minimum).

• WPA3 config
• RADIUS records

• PSK in use

Wireless Access | Disable Wireless Networking. Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment

• MDM policy

• Bluetooth/Wi-Fi enabled by default

Establish configuration requirements and usage restrictions for mobile devices.

• Control implementation statement for AC-19 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated

Employ full device or container-based encryption on mobile devices.

• Encryption attestation

• Personal containers unencrypted

Manage accounts; review at least monthly for privileged, every six months for non-privileged (FedRAMP); notify within FedRAMP-defined timeframes on changes.

• Control implementation statement for AC-2 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Stale accounts retained for terminated personnel beyond the 24 hour SLA
• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Support account management via automated mechanisms; required at HIGH baseline.

• IDP configuration
• Workflow automation evidence
• SCIM provisioning logs

• Manual ticket-only provisioning
• No automated deprovisioning

Disable accounts of users posing significant risk within FedRAMP-defined timeframe (1 hour).

• Insider threat workflow
• 1-hour disable evidence

• No coordination with HR/legal

Automatically disable temporary and emergency accounts within FedRAMP-defined timeframe (no longer than 24 hours).

• Temp account expiry logs
• Automation script
• JIT access records

• No automated expiry
• Emergency accounts persist

Disable accounts within FedRAMP-defined timeframe when no longer required, terminated, or inactive (35 days inactive).

• Inactivity disable logs
• HR-IAM integration
• 35-day report

• Inactive accounts active over 35 days

Automatically audit account creation, modification, enabling, disabling, removal; notify defined personnel.

• Account change audit logs
• Alerting rules

• No alerts on account changes

Require users to log out when inactivity exceeds FedRAMP-defined period (15 minutes for non-mobile, 30 for mobile).

• Session timeout config
• Policy baseline

• Timeout over 15 minutes

Establish terms and conditions for use of external systems; prohibit unless authorized.

• Control implementation statement for AC-20 citing the system mission and inheritance from common controls
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Permit use of external systems only after verifying security/privacy controls or approved connection agreement.

• Interconnection agreements
• Vendor assessments

• Missing ISA

Restrict use of organization-controlled portable storage on external systems.

• USB control policy
• DLP rules

• USB unrestricted

Enable authorized users to determine whether access authorizations match sharing restrictions.

• Sharing policy
• Classification labels

• No sharing review process

Designate users authorized to post; train them; review content quarterly for nonpublic information.

• Control implementation statement for AC-22 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA

Enforce approved authorizations for logical access in accordance with policy.

• Control implementation statement for AC-3 citing the system mission and inheritance from common controls
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Enforce approved information flow control policies between connected systems and within the system.

• Control implementation statement for AC-4 citing the system mission and inheritance from common controls
• Role-based access matrix mapped to job functions and data classifications
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Identify and document duties requiring separation; define access authorizations to support.

• Control implementation statement for AC-5 citing the system mission and inheritance from common controls
• Account provisioning and deprovisioning workflow tickets with manager approvals
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR

• Privileged accounts shared across administrators without individual accountability
• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control

Employ least privilege; allow only authorized access necessary to accomplish assigned tasks.

• Control implementation statement for AC-6 citing the system mission and inheritance from common controls
• Quarterly privileged access review attestations
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification
• Stale accounts retained for terminated personnel beyond the 24 hour SLA

Authorize access for FedRAMP-defined personnel to security functions and security-relevant information.

• Security admin role list
• Approval records

• Undocumented sec-admin access

Prevent non-privileged users from executing privileged functions.

• LPE prevention controls
• EDR config

• Setuid binaries unaudited

Require privileged users to use non-privileged accounts for nonsecurity functions.

• Dual-account policy
• Browse-as-user evidence

• Admins browse with admin

Restrict privileged accounts to FedRAMP-defined personnel or roles.

• Privileged role list
• Quarterly review

• No periodic review

Review privileges at least quarterly (FedRAMP) and reassign or remove as needed.

• Quarterly privilege review
• Remediation tickets

• Annual-only review

Log execution of privileged functions.

• Sudo logs
• PAM session recording

• No PAM session logs

Enforce limit of 3 consecutive invalid logon attempts within 15 minutes (FedRAMP); lock for 30 min or until released.

• Control implementation statement for AC-7 citing the system mission and inheritance from common controls
• System access request forms with business justification
• Joiner mover leaver workflow evidence integrated with HR
• Access control policy approved by the information security officer
• Role-based access matrix mapped to job functions and data classifications

• Access reviews performed but exceptions never remediated
• Role definitions drift from documented matrix without change control
• Service accounts excluded from periodic recertification

Display approved system use notification/banner before granting access; FedRAMP requires specific language.

• Login banner screenshot
• Banner text

• Missing FedRAMP banner language

Develop, disseminate, and review awareness and training policy and procedures at least annually.

• Control implementation statement for AT-1 citing the system mission and inheritance from common controls
• Insider threat awareness briefing materials
• Training records retained in the learning management system
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Provide security awareness training within FedRAMP-defined timeframe of onboarding, on system change, and at least annually thereafter.

• Control implementation statement for AT-2 citing the system mission and inheritance from common controls
• Training records retained in the learning management system
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching

Include insider threat recognition and reporting in awareness training.

• Insider threat module

• Module absent

Include social engineering and social mining recognition in training.

• Phishing simulation results

• No phishing tests

Provide role-based security training to personnel with significant security responsibilities before authorizing access and annually.

• Control implementation statement for AT-3 citing the system mission and inheritance from common controls
• Attestation records signed at onboarding and annually
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers
• Phishing simulation results with click and reporting rates
• Insider threat awareness briefing materials

• Contractors and third parties not enrolled in mandatory training
• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Document and monitor security training; retain records for FedRAMP-defined period (5 years).

• Control implementation statement for AT-4 citing the system mission and inheritance from common controls
• Annual security awareness training curriculum and completion roster
• Role based training plan for privileged users and developers
• Phishing simulation results with click and reporting rates
• Insider threat awareness briefing materials

• Role based training not refreshed when job duties change
• Phishing failures not followed by remedial coaching
• Training content not reviewed annually for current threat trends

Develop and review audit/accountability policy annually.

• Control implementation statement for AU-1 citing the system mission and inheritance from common controls
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Audit log retention shorter than the policy mandated period
• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation

Retain audit records for at least one year (FedRAMP minimum) with 90 days immediately accessible online.

• Control implementation statement for AU-11 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Provide audit record generation capability on all system components specified in AU-2.

• Control implementation statement for AU-12 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Identify event types selected for logging including FedRAMP minimum list; review and update at least annually.

• Control implementation statement for AU-2 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Audit log retention shorter than the policy mandated period
• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Audit records must contain: type, when, where, source, outcome, identity associated.

• Control implementation statement for AU-3 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Generate audit records containing FedRAMP-defined additional information (session, host, full text of executed commands).

• Enriched log sample

• Command text not captured

Allocate audit log storage capacity to accommodate FedRAMP-defined retention period.

• Control implementation statement for AU-4 citing the system mission and inheritance from common controls
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Alert defined personnel on audit failure within FedRAMP timeframe; take defined action (overwrite oldest, shutdown, stop processing).

• Control implementation statement for AU-5 citing the system mission and inheritance from common controls
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing

• Reviewers acknowledge alerts but do not document investigation outcomes
• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review

Review and analyze audit records at least weekly (FedRAMP); report findings to defined personnel.

• Control implementation statement for AU-6 citing the system mission and inheritance from common controls
• Log review procedures with assigned analyst owners
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Integrate audit review with automated mechanisms (SIEM).

• SIEM screenshot

• No SIEM

Analyze and correlate audit records across different repositories.

• SIEM correlation rules

• Siloed logs

Provide capability for audit record reduction and on-demand report generation.

• Control implementation statement for AU-7 citing the system mission and inheritance from common controls
• Time synchronisation evidence across logging endpoints
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage

Process audit records for events of interest based on defined criteria.

• SIEM use cases

• No detection rules

Use internal system clocks; record timestamps with FedRAMP-defined granularity (1 second), UTC or known offset.

• Control implementation statement for AU-8 citing the system mission and inheritance from common controls
• Audit log integrity controls including write once storage or hashing
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Clock drift across hosts breaks event correlation
• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Protect audit information and tools from unauthorized access, modification, deletion.

• Control implementation statement for AU-9 citing the system mission and inheritance from common controls
• Audit and accountability policy with retention periods defined
• List of auditable events and log source inventory
• SIEM ingestion configuration showing all in scope systems
• Log review procedures with assigned analyst owners

• Privileged user activity not isolated for independent review
• Critical log sources missing from the SIEM with no detection coverage
• Audit log retention shorter than the policy mandated period

Authorize access to audit functionality only to subset of privileged users.

• SIEM role list

• All admins see all logs

Develop and review assessment/authorization policy at least annually.

• Control implementation statement for CA-1 citing the system mission and inheritance from common controls
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Authorization boundary description does not match the asset inventory
• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership

Assess controls annually (FedRAMP); third-party assessor (3PAO) required; produce SAR.

• Control implementation statement for CA-2 citing the system mission and inheritance from common controls
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• Authorization boundary description does not match the asset inventory
• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Employ independent assessors; FedRAMP-accredited 3PAO required.

• 3PAO accreditation
• Independence statement

• Non-accredited assessor

Approve and manage exchange of information with external systems using ISA, MOU, contract; review annually.

• Control implementation statement for CA-3 citing the system mission and inheritance from common controls
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Develop POAM; update at least monthly (FedRAMP); track remediation timelines (HIGH 30 days, MOD 90).

• Control implementation statement for CA-5 citing the system mission and inheritance from common controls
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence

• POAM items past due without justification or risk acceptance
• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls

Senior official authorizes system; reauthorize every three years or upon significant change.

• Control implementation statement for CA-6 citing the system mission and inheritance from common controls
• Authorization to operate memorandum signed by the authorizing official
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval
• Authorization boundary description does not match the asset inventory

Establish continuous monitoring strategy with FedRAMP-defined metrics, monitoring frequencies, ongoing assessments.

• Control implementation statement for CA-7 citing the system mission and inheritance from common controls
• Continuous monitoring strategy with metric definitions
• Independent assessor statement of independence
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates

• Continuous monitoring metrics collected but not reported to leadership
• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval

Employ independent assessors for ongoing monitoring; FedRAMP 3PAO annual.

• 3PAO ConMon engagement

• No independent ConMon

Continuous Monitoring | Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring

• Risk monitoring procedure
• Risk register
• Change-driven re-assessments

• Risk monitoring siloed
• No change triggers
• Register stale

Authorize internal connections of components to system; document interface characteristics.

• Control implementation statement for CA-9 citing the system mission and inheritance from common controls
• System security plan covering the authorization boundary
• Control assessment report with tester names and dates
• Plan of action and milestones tracking open findings
• Authorization to operate memorandum signed by the authorizing official

• Assessment scope omits inherited cloud provider controls
• Reauthorization scheduled past the policy required interval
• Authorization boundary description does not match the asset inventory

Develop and review configuration management policy annually.

• Control implementation statement for CM-1 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Asset inventory missing cloud workloads and ephemeral resources
• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review

Use software in accordance with contracts and copyright laws; track licenses; document peer-to-peer file sharing controls.

• Control implementation statement for CM-10 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Establish policies governing installation of software by users; enforce; monitor compliance.

• Control implementation statement for CM-11 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Information Location. a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access

• Data location map

• No data inventory

Information Location | Automated Tools to Support Information Location. Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational

• DLP/discovery tool

• No data discovery

Develop and maintain baseline configurations; review and update annually (FedRAMP) and when required.

• Control implementation statement for CM-2 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Asset inventory missing cloud workloads and ephemeral resources
• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Maintain baseline currency via automated mechanisms.

• CMDB auto-discovery

• Manual CMDB

Retain FedRAMP-defined number of previous baseline configurations (3) to support rollback.

• Snapshot history

• No rollback capability

Issue systems/devices with FedRAMP-defined security safeguards to individuals traveling to high-risk locations.

• Travel laptop policy

• No travel device program

Determine, document, and approve changes; track, review, audit; CAB or equivalent; analyze security impact.

• Control implementation statement for CM-3 citing the system mission and inheritance from common controls
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Test, validate, and document changes before implementing on operational system.

• Test plan
• Validation results

• No pre-prod testing

Require security and privacy representatives on change board for FedRAMP-defined configuration changes.

• CAB roster

• No security on CAB

Analyze changes to determine potential security/privacy impacts.

• Control implementation statement for CM-4 citing the system mission and inheritance from common controls
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Impact Analyses | Verification of Controls. After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements

• Post-change verification reports
• Control testing results
• Tickets linking change to verification

• No post-change testing
• Verification not documented
• Controls drift after change

Define, document, approve, enforce physical and logical access restrictions for changes.

• Control implementation statement for CM-5 citing the system mission and inheritance from common controls
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals

• Baselines exist on paper but production hosts drift without alerting
• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling

Establish/document configuration settings using checklists; CIS/USGCB/DISA STIG when available; HIGH baseline.

• Control implementation statement for CM-6 citing the system mission and inheritance from common controls
• Configuration drift detection reports from the CMDB or tooling
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Configure system to provide only essential capabilities; prohibit unnecessary functions, services, ports, protocols.

• Control implementation statement for CM-7 citing the system mission and inheritance from common controls
• Software inventory generated from authoritative discovery tooling
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually

Review system functions, ports, protocols, services at least monthly (FedRAMP); disable as unnecessary.

• Monthly review records

• Annual-only review

Prevent program execution according to FedRAMP-defined policies (rules of behavior).

• App control policy

• No application control

Identify and maintain authorized software list; employ allowlist; review at least annually; HIGH requirement.

• Allowlist policy
• Annual review

• No allowlisting

Develop and document inventory of system components; review and update at least monthly (FedRAMP).

• Control implementation statement for CM-8 citing the system mission and inheritance from common controls
• Emergency change records with retroactive approvals
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Emergency changes bypass CAB and lack retrospective review
• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Update inventory as part of component installations, removals, updates.

• Installation workflow

• Manual inventory

Employ automated mechanisms to detect unauthorized components at FedRAMP-defined frequency; HIGH only continuous.

• NAC alerts
• Rogue device reports

• No rogue detection

Develop, document, implement configuration management plan addressing roles, processes, items under CM, identification scheme.

• Control implementation statement for CM-9 citing the system mission and inheritance from common controls
• Configuration management policy and change control procedure
• Approved baseline configurations for each platform family
• Change advisory board minutes with risk assessments
• Configuration drift detection reports from the CMDB or tooling

• Unauthorised software present on endpoints not flagged by tooling
• Hardening benchmarks applied at build but not re evaluated annually
• Asset inventory missing cloud workloads and ephemeral resources

Develop and review contingency planning policy at least annually.

• Control implementation statement for CP-1 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load

Provide for recovery and reconstitution of system to known state within RTO.

• Control implementation statement for CP-10 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

System Recovery and Reconstitution | Transaction Recovery. Implement transaction recovery for systems that are transaction-based

• DB transaction logs

• No transaction replay

Develop contingency plan; review and update annually (FedRAMP); coordinate with related plans.

• Control implementation statement for CP-2 citing the system mission and inheritance from common controls
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners

Coordinate contingency plan with related plans (BCP, DRP, COOP, IRP).

• Coordination matrix

• Siloed plans

Plan for resumption of mission/business functions within FedRAMP-defined time period after contingency plan activation.

• RTO documentation

• RTO undefined

Contingency Plan | Identify Critical Assets. Identify critical system assets supporting [Selection: all; essential] mission and business functions

• BIA criticality map

• No criticality tiers

Provide contingency training to users assigned roles; within FedRAMP timeframe of role assignment and at least annually.

• Control implementation statement for CP-3 citing the system mission and inheritance from common controls
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Test contingency plan at least annually (FedRAMP) using FedRAMP-defined tests; review test results.

• Control implementation statement for CP-4 citing the system mission and inheritance from common controls
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• RTO and RPO targets undefined for tier two systems
• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load

Coordinate contingency plan testing with related plan testing.

• Joint test plan

• Independent testing only

Establish alternate storage site with agreements to permit storage and retrieval of system backup information.

• Control implementation statement for CP-6 citing the system mission and inheritance from common controls
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Alternate Storage Site | Separation from Primary Site. Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats

• Geographic separation evidence

• Same metro zone

Alternate Storage Site | Accessibility. Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions

• Accessibility analysis

• No analysis

Establish alternate processing site with agreements for resumption of operations within FedRAMP-defined RTO.

• Control implementation statement for CP-7 citing the system mission and inheritance from common controls
• Backup schedule, retention, and offsite or immutable copy evidence
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes
• Backups taken but restore tests never performed end to end

Alternate Processing Site | Separation from Primary Site. Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats

• Geographic separation

• Same region

Alternate Processing Site | Accessibility. Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions

• Accessibility plan

• No plan

Alternate Processing Site | Priority of Service. Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives)

• SLA priority clause

• No priority clauses

Establish alternate telecommunications services with agreements to permit resumption of system operations.

• Control implementation statement for CP-8 citing the system mission and inheritance from common controls
• Annual tabletop and full failover test reports
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems

• Tabletop exercises lack participation from business owners
• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes

Telecommunications Services | Priority of Service Provisions. (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Service Priority

• TSP enrollment

• No TSP

Telecommunications Services | Single Points of Failure. Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services

• Diverse routing

• SPOFs unmitigated

Conduct backups of user-level, system-level, and security-related documentation; FedRAMP-defined frequency (daily incremental, weekly full).

• Control implementation statement for CP-9 citing the system mission and inheritance from common controls
• Alternate processing site contract and capacity attestation
• Restoration test logs with success criteria signed off
• Business impact analysis identifying critical systems
• Contingency plan with recovery time and recovery point objectives
• Backup schedule, retention, and offsite or immutable copy evidence

• Alternate site capacity not validated against current load
• Plan not updated after major architecture changes
• Backups taken but restore tests never performed end to end
• RTO and RPO targets undefined for tier two systems

Test backup information annually to verify reliability and integrity.

• Restore test results

• Backups never restored

System Backup | Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information]

• Backup encryption config

• Unencrypted backups

Develop and review identification and authentication policy at least annually.

• Control implementation statement for IA-1 citing the system mission and inheritance from common controls
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Default vendor credentials remain on appliances and IoT devices
• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change

Require re-authentication when FedRAMP-defined circumstances occur (role change, privilege change, time period elapsed).

• Control implementation statement for IA-11 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Identity Proofing. a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a

• Control implementation statement for IA-12 citing the system mission and inheritance from common controls
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Uniquely identify and authenticate organizational users and associate identity with processes acting on behalf of users.

• Control implementation statement for IA-2 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Default vendor credentials remain on appliances and IoT devices
• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Uniquely identify and authenticate devices before establishing connection.

• Control implementation statement for IA-3 citing the system mission and inheritance from common controls
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Manage identifiers; uniquely identify; prevent reuse for FedRAMP-defined period.

• Control implementation statement for IA-4 citing the system mission and inheritance from common controls
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Manage authenticators; verify identity prior to issuing; establish initial content; protect.

• Control implementation statement for IA-5 citing the system mission and inheritance from common controls
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation

• Password complexity enforced but reuse not blocked across systems
• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls

Obscure authentication feedback during authentication process.

• Control implementation statement for IA-6 citing the system mission and inheritance from common controls
• Service account credential vault inventory and rotation logs
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals
• Default vendor credentials remain on appliances and IoT devices

Implement authentication to cryptographic modules meeting FIPS 140 (FedRAMP requires FIPS-validated).

• Control implementation statement for IA-7 citing the system mission and inheritance from common controls
• Identity proofing records for high assurance accounts
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals

Uniquely identify and authenticate non-organizational users (e.g., federal customers).

• Control implementation statement for IA-8 citing the system mission and inheritance from common controls
• Authenticator lifecycle procedure including reset and revocation
• Identification and authentication policy
• MFA enrolment report for all privileged and remote users
• Password policy configuration export from the identity provider
• Service account credential vault inventory and rotation logs

• Federation trust relationships not reviewed when partnerships change
• MFA exceptions granted indefinitely without compensating controls
• Shared accounts authenticate without traceability to individuals
• Default vendor credentials remain on appliances and IoT devices

Requires an incident response policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.

• Control implementation statement for IR-1 citing the system mission and inheritance from common controls
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Requires incident response training for system users consistent with their assigned roles, within a defined period of assuming the role and periodically thereafter.

• Control implementation statement for IR-2 citing the system mission and inheritance from common controls
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting

Requires the incident response capability to be tested at a defined frequency using defined tests, to determine its effectiveness, and the results documented.

• Control implementation statement for IR-3 citing the system mission and inheritance from common controls
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned

• Third party incident responder retainer expired
• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Implement IR capability for preparation, detection/analysis, containment, eradication, recovery.

• Control implementation statement for IR-4 citing the system mission and inheritance from common controls
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Track and document incidents.

• Control implementation statement for IR-5 citing the system mission and inheritance from common controls
• Incident response team roster with on call rotation
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines

Require personnel to report incidents to organizational authorities within FedRAMP timeframe; report to FedRAMP PMO and US-CERT.

• Control implementation statement for IR-6 citing the system mission and inheritance from common controls
• Tabletop and live exercise after action reports
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines

• Detection coverage gaps allow incidents to be discovered externally
• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure

Provide IR support resource (help desk, support group) for incident handling assistance.

• Control implementation statement for IR-7 citing the system mission and inheritance from common controls
• Incident ticket samples covering detection, containment, and lessons learned
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines
• Third party incident responder retainer expired

Develop and implement IRP; review and update annually; distribute.

• Control implementation statement for IR-8 citing the system mission and inheritance from common controls
• Forensic toolkit readiness checklist and chain of custody templates
• Regulatory notification procedure with jurisdiction specific timelines
• Incident response plan with severity definitions and escalation paths
• Incident response team roster with on call rotation

• Severity criteria inconsistent across teams leading to under reporting
• Lessons learned captured but corrective actions not tracked to closure
• Notification timelines miss jurisdictional regulatory deadlines

Develop and review maintenance policy at least annually.

• Control implementation statement for MA-1 citing the system mission and inheritance from common controls
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses

• Emergency maintenance performed without retrospective documentation
• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access

Schedule, document, review records of maintenance, repair, replacement of components.

• Control implementation statement for MA-2 citing the system mission and inheritance from common controls
• Remote maintenance session logs with MFA and supervision evidence
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Maintenance Tools. a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approved system maintenance tools [Assignment: organization-defined frequency]

• Control implementation statement for MA-3 citing the system mission and inheritance from common controls
• Tool sanitisation records for media leaving the facility
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication

Approve and monitor nonlocal maintenance activities; use strong authentication.

• Control implementation statement for MA-4 citing the system mission and inheritance from common controls
• Vendor maintenance agreements with security clauses
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence

• Maintenance vendors lack signed confidentiality and security clauses
• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Establish process for authorizing maintenance personnel; maintain list of authorized personnel; supervise unauthorized.

• Control implementation statement for MA-5 citing the system mission and inheritance from common controls
• System maintenance policy and approved maintenance windows
• Maintenance ticket records with approvals and post change verification
• Maintenance personnel access list with background check status
• Remote maintenance session logs with MFA and supervision evidence

• Vendor engineers granted standing access rather than session based access
• Remote maintenance sessions unmonitored after initial authentication
• Maintenance tools not sanitised before removal from secure areas

Timely Maintenance. Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure

• Support contracts

• No SLA

Develop and review media protection policy at least annually.

• Control implementation statement for MP-1 citing the system mission and inheritance from common controls
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Backup tapes shipped without tamper evident packaging
• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Restrict access to FedRAMP-defined types of digital and non-digital media to authorized personnel.

• Control implementation statement for MP-2 citing the system mission and inheritance from common controls
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Mark system media indicating distribution limitations, handling caveats, security markings.

• Control implementation statement for MP-3 citing the system mission and inheritance from common controls
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory

Physically control and securely store FedRAMP-defined types of media within FedRAMP-defined controlled areas.

• Control implementation statement for MP-4 citing the system mission and inheritance from common controls
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices

• Media classification labels missing on physical assets
• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption

Protect and control media during transport outside controlled areas; maintain accountability; document activities; restrict transport to authorized personnel.

• Control implementation statement for MP-5 citing the system mission and inheritance from common controls
• Removable media usage policy and DLP enforcement evidence
• Media transport chain of custody logs
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory
• Backup tapes shipped without tamper evident packaging

Sanitize media prior to disposal, release, or reuse using FedRAMP-defined methods (NIST SP 800-88).

• Control implementation statement for MP-6 citing the system mission and inheritance from common controls
• Media transport chain of custody logs
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory

Restrict or prohibit use of FedRAMP-defined types of media on FedRAMP-defined systems using safeguards.

• Control implementation statement for MP-7 citing the system mission and inheritance from common controls
• Encryption configuration for portable storage devices
• Media protection policy covering electronic and physical media
• Media inventory and labelling scheme by data classification
• Sanitisation and destruction certificates from approved disposal vendor
• Removable media usage policy and DLP enforcement evidence

• Decommissioned drives stored unencrypted while awaiting destruction
• USB usage permitted without DLP inspection or encryption
• Destruction certificates lack serial numbers tying back to inventory
• Backup tapes shipped without tamper evident packaging

Develop and review physical/environmental policy at least annually.

• Control implementation statement for PE-1 citing the system mission and inheritance from common controls
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Emergency Shutoff. a. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations; b. Place emergency shutoff switches or devices in [Assignment: organization-defined location by system

• Control implementation statement for PE-10 citing the system mission and inheritance from common controls
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Emergency Power. Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power

• Control implementation statement for PE-11 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Employ and maintain automatic emergency lighting activating on power outage covering emergency exits.

• Control implementation statement for PE-12 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Employ and maintain fire suppression and detection devices independent of energy source.

• Control implementation statement for PE-13 citing the system mission and inheritance from common controls
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Maintain temperature and humidity within FedRAMP-defined acceptable levels; monitor at FedRAMP frequency.

• Control implementation statement for PE-14 citing the system mission and inheritance from common controls
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Water Damage Protection. Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel

• Control implementation statement for PE-15 citing the system mission and inheritance from common controls
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Authorize and control system components entering/exiting facility; maintain records.

• Inventory in/out logs

• No records

Determine alternate work sites; employ FedRAMP-defined controls at alternate sites; assess effectiveness.

• Control implementation statement for PE-17 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Develop, approve, maintain list of individuals with authorized facility access; review at least quarterly (FedRAMP).

• Control implementation statement for PE-2 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures

Enforce physical access at entry/exit points; verify authorizations; control ingress/egress; maintain audit logs.

• Control implementation statement for PE-3 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Visitor logs incomplete or escort sign offs missing
• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Access Control for Transmission. Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls]

• Control implementation statement for PE-4 citing the system mission and inheritance from common controls
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Access Control for Output Devices. Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output

• Control implementation statement for PE-5 citing the system mission and inheritance from common controls
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Monitor physical access to facility; review access logs at least weekly (FedRAMP); coordinate review with IR.

• Control implementation statement for PE-6 citing the system mission and inheritance from common controls
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records

• Environmental sensor alerts route to unmonitored mailboxes
• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas

Maintain visitor access records for FedRAMP-defined period (1 year); review records monthly (FedRAMP).

• Control implementation statement for PE-8 citing the system mission and inheritance from common controls
• Environmental monitoring readings for temperature, humidity, and water leak sensors
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs

Power Equipment and Cabling. Protect power equipment and power cabling for the system from damage and destruction

• Control implementation statement for PE-9 citing the system mission and inheritance from common controls
• Fire suppression and UPS maintenance records
• Physical security policy and facility risk assessment
• Badge access system audit log and door alarm reports
• Visitor sign in records with escort assignment
• CCTV retention configuration and footage spot check evidence

• Server room doors propped open during cooling failures
• CCTV coverage gaps at loading docks and equipment delivery areas
• Tailgating observed without challenge during walkthroughs
• Visitor logs incomplete or escort sign offs missing

Develop and review planning policy at least annually.

• Control implementation statement for PL-1 citing the system mission and inheritance from common controls
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel

• Planning artefacts lack version history and approval signatures
• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes

Baseline Selection. Select a control baseline for the system

• Control implementation statement for PL-10 citing the system mission and inheritance from common controls
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually

Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

• Control implementation statement for PL-11 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies

Develop SSP that aligns with FedRAMP template; review and update annually.

• Control implementation statement for PL-2 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• Planning artefacts lack version history and approval signatures
• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually

Establish and provide rules describing user responsibilities; receive signed acknowledgement.

• Control implementation statement for PL-4 citing the system mission and inheritance from common controls
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance
• Concept of operations describing system mission and data flows
• Privacy and security integration documentation

• Privacy considerations addressed separately from security planning
• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies

Develop, document, maintain security/privacy architectures; review annually.

• Control implementation statement for PL-8 citing the system mission and inheritance from common controls
• Privacy and security integration documentation
• System security plan with control allocation matrix
• Rules of behaviour signed by users including privileged personnel
• Information security architecture diagrams current within twelve months
• Security planning meeting minutes with stakeholder attendance

• System security plan not refreshed after material system changes
• Rules of behaviour acknowledged once but not refreshed annually
• Architecture diagrams missing third party and SaaS dependencies
• Planning artefacts lack version history and approval signatures

Develop and disseminate an organization-wide information security program plan. Review, update, and protect from unauthorized disclosure.

• Program plan document
• Approval
• Distribution list

• Plan stale or generic

Manage the security and privacy state of systems through assessment and authorization processes.

• ATO letters
• Continuous authorization records

• Authorization stale

Define mission and business processes with consideration for information security and privacy.

• Process map
• Privacy and security touchpoints documented

• Privacy considered only at the end

Implement an insider threat program including cross-functional teams and information sharing.

• Insider threat charter
• Team roster
• Indicator catalog
• Case management process

• No HR/Legal/IT working group

Establish a security and privacy workforce development and improvement program.

• Role definitions
• Skills matrix
• Training plan

• No role-based pathway

Plan, implement and maintain processes for testing, training and monitoring across the program.

• Annual T&T schedule
• Monitoring program documentation

• Testing siloed by system

Establish and institutionalize contact with selected groups and associations.

• ISAC memberships
• Conference participation log

• No threat-sharing memberships

Implement a threat awareness program with cross-organization information-sharing capability.

• Threat bulletins
• Distribution lists
• TIP integration

• TI not actioned

Establish policy and procedures to ensure CUI is protected on external systems.

• CUI policy
• Contract flow-down language
• External system assessment evidence

• No CUI clauses in contracts

Develop and disseminate an organization-wide privacy program plan that includes program objectives, structure, roles, and governance.

• Privacy program plan
• Governance structure
• Review cadence

• No privacy program plan distinct from security

Appoint a senior agency official for privacy with the mission and resources to manage privacy.

• SAOP appointment memo
• Privacy role description

• No SAOP

Appoint a senior agency information security officer with mission, resources, authority to manage the program.

• Appointment memo
• Role description
• Reporting line documentation

• Role split between functions
• No charter

Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program.

• Privacy webpage URL
• Content review log

• Privacy notices out of date

Develop and maintain an accurate accounting of disclosures of personally identifiable information.

• Disclosure register
• Request handling SOP

• No disclosure register

Develop and document policies and procedures for ensuring PII quality.

• PII quality SOP
• Data correction workflow

• No correction workflow

Establish a data governance body consisting of defined roles with defined responsibilities.

• DGB charter
• Member roster
• Meeting minutes

• DGB exists in name only

Establish a data integrity board to oversee data sharing and matching agreements.

• DIB charter
• Approved data sharing agreements

• No oversight of data matching

Develop, document, and implement policies and procedures that address the use of PII for internal testing, training, and research.

• PII minimization policy
• Anonymization SOP
• Test environment review

• Production data copied to test

Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices.

• Complaint intake form
• SLA
• Resolution log

• No tracked SLA

Develop and disseminate privacy reports to oversight bodies and other constituents at defined frequency.

• Privacy report template
• Distribution log

• No external privacy reporting

Identify and document assumptions, constraints, priorities and trade-offs that affect risk decisions.

• Risk framing document
• Trade-off log

• Framing assumptions undocumented

Appoint a senior accountable official for risk management and establish a risk executive function.

• Appointment memo
• Risk Executive Function charter

• No risk executive function

Include resources needed to implement the security and privacy programs and document exceptions to funding.

• Annual security budget
• Exception register

• Budget not tracked separately

Develop an organization-wide strategy for managing supply chain risks.

• SCRM strategy
• Tier 1/2 supplier risk assessment process

• No SCRM strategy

Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs.

• ConMon strategy
• Metric catalog
• Reporting cadence

• No formal ConMon strategy

Analyze defined systems or system components, including hardware and software, to determine their intended purpose, and that they perform only that purpose.

• Component purpose register
• Verification activity records

• No purposing analysis

Implement a process to ensure POA&Ms for the security and privacy programs and associated systems are developed and maintained.

• POA&M template
• Aging report
• Closure evidence

• POA&Ms stale
• No aging metric

Develop and update an inventory of organizational systems.

• System register
• Owner mapping
• Update cadence

• Shadow IT not captured

Develop, monitor, and report on the results of information security and privacy measures of performance.

• KPI/KRI dashboard
• Reporting cadence
• Board pack samples

• Metrics not tied to outcomes

Develop an enterprise architecture integrating security and privacy considerations.

• EA model
• Security and privacy integration narrative

• EA not maintained

Address information security and privacy issues in the development of a critical infrastructure and key resources protection plan.

• CI/KR plan with security and privacy sections

• No CI mapping for the organization

Develop a comprehensive strategy to manage risk including threat, vulnerability, impact, likelihood and risk tolerance.

• Risk management strategy
• Risk appetite statement
• Methodology document

• Appetite not approved at board level

Develop and review personnel security policy at least annually.

• Control implementation statement for PS-1 citing the system mission and inheritance from common controls
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Background checks not re run when employees move to higher risk roles
• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Assign risk designation to positions; review and update at least every three years.

• Control implementation statement for PS-2 citing the system mission and inheritance from common controls
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Screen individuals prior to authorizing access; rescreen at FedRAMP frequency per position risk; US citizenship may apply.

• Control implementation statement for PS-3 citing the system mission and inheritance from common controls
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change

Disable access and revoke authenticators within FedRAMP-defined time (same day); conduct exit interview; retrieve property.

• Control implementation statement for PS-4 citing the system mission and inheritance from common controls
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Termination access removal exceeds documented SLA
• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling

Review/confirm ongoing operational need for access when personnel transfer; modify access; notify within FedRAMP timeframe.

• Control implementation statement for PS-5 citing the system mission and inheritance from common controls
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Develop access agreements; review and update annually; require signature before access.

• Control implementation statement for PS-6 citing the system mission and inheritance from common controls
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change

Establish personnel security requirements for external providers; require providers to notify within FedRAMP timeframe of personnel changes.

• Control implementation statement for PS-7 citing the system mission and inheritance from common controls
• Acknowledgement of access agreements signed at hire
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Sanctions applied informally without HR documentation
• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Employ formal sanctions for personnel failing to comply with security/privacy policies; notify defined personnel within FedRAMP timeframe.

• Control implementation statement for PS-8 citing the system mission and inheritance from common controls
• Personnel security policy and position risk designation matrix
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history

• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles

Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descriptions

• Control implementation statement for PS-9 citing the system mission and inheritance from common controls
• Background screening completion records by role tier
• Termination and transfer access removal evidence within SLA
• Sanctions policy with documented application history
• Third party personnel screening attestations
• Acknowledgement of access agreements signed at hire

• Contractor screening relies on vendor attestation without sampling
• Position risk designations not reviewed when responsibilities change
• Background checks not re run when employees move to higher risk roles
• Termination access removal exceeds documented SLA

Develop, document, disseminate PII processing and transparency policy and procedures.

• PT policy
• Procedures
• Owner memo
• Review record

• No privacy-specific policy

Determine and document the authority that permits processing of PII; restrict processing to that authority.

• Authority register per processing activity
• Mapping to lawful basis

• No authority assessment
• Vague lawful basis

Identify and document the purposes for processing PII. Describe purposes in notices, restrict processing to identified purposes.

• Purpose register
• Notice text mapping
• Audit of processing against purpose

• Purposes drift after launch

Implement tools or mechanisms for individuals to consent to the processing of their PII prior to its collection that facilitate informed decisions.

• Consent UX
• Granular preference centre
• Audit trail of consents

• Bundled consent
• No withdrawal mechanism

Provide notice to individuals about the processing of PII.

• Privacy notice
• Last reviewed date
• Distribution channels

• Notice misaligned with actual processing

For systems that process information about US citizens or lawful permanent residents that meets Privacy Act criteria, publish SORN.

• Published SORN
• Review record

• No SORN for in-scope systems

Apply additional controls to special categories of PII (SSN, biometric, health). HIGH baseline applies in privacy scope.

• Sensitive PII inventory
• Additional controls register
• SSN minimization plan

• SSN used as primary key
• Health PII commingled

Comply with Privacy Act computer matching requirements when systems engage in computer matching.

• Matching agreements
• Notice publication

• No matching agreements

Develop and review risk assessment policy at least annually.

• Control implementation statement for RA-1 citing the system mission and inheritance from common controls
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads

Categorize system per FIPS 199; document; review and update annually.

• Control implementation statement for RA-2 citing the system mission and inheritance from common controls
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications

Conduct risk assessment annually (FedRAMP); document; review and update.

• Control implementation statement for RA-3 citing the system mission and inheritance from common controls
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners

• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections

Scan for vulnerabilities monthly (FedRAMP); OS/network weekly, web app monthly, database monthly; remediate within FedRAMP timeframes (HIGH critical 15d, high 30d).

• Control implementation statement for RA-5 citing the system mission and inheritance from common controls
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence

• Risk register entries lack named owner or due date
• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so identified risk is treated rather than only recorded.

• Control implementation statement for RA-7 citing the system mission and inheritance from common controls
• Risk register with likelihood, impact, and treatment owners
• Vulnerability scan reports for internal, external, and authenticated scopes
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives

• Penetration tests scope narrow and exclude key applications
• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections
• High severity vulnerabilities exceed remediation SLA without risk acceptance

Criticality Analysis. Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development life cycle]

• Control implementation statement for RA-9 citing the system mission and inheritance from common controls
• Penetration test report with retest evidence
• Threat intelligence feed subscriptions and triage workflow
• Risk acceptance memos signed by accountable executives
• Risk assessment methodology approved by leadership
• Risk register with likelihood, impact, and treatment owners

• Scan coverage gaps for containerised and ephemeral workloads
• Threat intelligence consumed but not operationalised into detections
• High severity vulnerabilities exceed remediation SLA without risk acceptance
• Risk register entries lack named owner or due date

Requires a system and services acquisition policy and supporting procedures to be developed, documented, disseminated, reviewed and updated on a defined cycle.

• Control implementation statement for SA-1 citing the system mission and inheritance from common controls
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review

Require developer to perform CM during development, implementation, operation; document/track changes; implement only approved changes.

• Control implementation statement for SA-10 citing the system mission and inheritance from common controls
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed

Require developer to test at FedRAMP-defined depth and coverage; document; correct flaws.

• Control implementation statement for SA-11 citing the system mission and inheritance from common controls
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

• Control implementation statement for SA-15 citing the system mission and inheritance from common controls
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams

Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; determine, document and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.

• Mission and business process planning documentation recording the high-level information security and privacy requirements determined for the system or system service
• Capital planning and investment control submission or business case showing the resources determined, documented and allocated to protect the system or system service
• Programming and budgeting documentation showing a discrete line item for information security and privacy
• Approved budget or spend plan carrying that line item, with its approval record
• System security and privacy plan section recording the allocated resources and the basis for the amount
• Records of review of the allocation when requirements or the system change across the system development life cycle

• Security and privacy requirements determined after the acquisition decision rather than during mission and business process planning
• Security funding absorbed into a general IT or infrastructure line, so no discrete information security and privacy item exists to evidence
• Resources named in a plan but never traced through to an approved budget or capital planning submission
• Privacy resourcing omitted while security resourcing is documented, although the control covers both
• Line item established once at authorization and not maintained through sustainment and supply chain activity

Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support

• Control implementation statement for SA-22 citing the system mission and inheritance from common controls
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

Manage system using SDLC incorporating security/privacy considerations.

• Control implementation statement for SA-3 citing the system mission and inheritance from common controls
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed

Include security/privacy requirements in contracts; FedRAMP-defined assurance requirements.

• Control implementation statement for SA-4 citing the system mission and inheritance from common controls
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Threat modelling performed inconsistently across product teams
• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix

Obtain administrator and user documentation; protect; distribute to FedRAMP-defined personnel.

• Control implementation statement for SA-5 citing the system mission and inheritance from common controls
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures
• Threat modelling and design review evidence for major releases
• Static and dynamic code analysis reports with finding remediation

• Open source components used without SBOM or licence review
• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix

Apply FedRAMP-defined systems security and privacy engineering principles in development.

• Control implementation statement for SA-8 citing the system mission and inheritance from common controls
• Static and dynamic code analysis reports with finding remediation
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys
• Threat modelling performed inconsistently across product teams

Require providers of external system services to comply with security/privacy requirements; document oversight roles.

• Control implementation statement for SA-9 citing the system mission and inheritance from common controls
• Vendor security questionnaires and SOC reports retained
• Software bill of materials for in scope products
• Acquisition policy with security clauses for contracts
• Secure software development lifecycle procedures

• Vendor SOC reports collected but exceptions not analysed
• Code scan findings closed without verification of fix
• Security requirements absent from procurement templates for low value buys

Develop and review system/comms protection policy at least annually.

• Control implementation statement for SC-1 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries

Terminate network connection at end of session or after FedRAMP-defined inactivity period (no longer than 30 minutes).

• Control implementation statement for SC-10 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).

• Control implementation statement for SC-12 citing the system mission and inheritance from common controls
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Implement FedRAMP-defined cryptographic uses and approved cryptography (FIPS 140 validated).

• Control implementation statement for SC-13 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Prohibit remote activation of collaborative computing devices (cameras, mics) without explicit user indication; provide explicit notification.

• Control implementation statement for SC-15 citing the system mission and inheritance from common controls
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect

Issue public key certificates under FedRAMP-defined policy or obtain from approved service providers.

• Control implementation statement for SC-17 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect

Define acceptable and unacceptable mobile code; authorize use; monitor.

• Mobile code policy

• No policy

Separate user functionality from system management functionality.

• Control implementation statement for SC-2 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Provide artifacts for additional data origin authentication and integrity verification (DNSSEC) for child zones; FedRAMP requires DNSSEC.

• Control implementation statement for SC-20 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Request and perform data origin authentication and data integrity verification on name/address resolution responses; DNSSEC validation.

• Control implementation statement for SC-21 citing the system mission and inheritance from common controls
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Ensure DNS systems are fault-tolerant and implement role separation.

• Control implementation statement for SC-22 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Protect authenticity of communications sessions.

• Control implementation statement for SC-23 citing the system mission and inheritance from common controls
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Protect confidentiality and integrity of FedRAMP-defined information at rest.

• Control implementation statement for SC-28 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries

Maintain separate execution domain for each executing system process.

• Control implementation statement for SC-39 citing the system mission and inheritance from common controls
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Flat networks expose sensitive workloads without segmentation
• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Prevent unauthorized and unintended information transfer via shared system resources.

• Control implementation statement for SC-4 citing the system mission and inheritance from common controls
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Protect against or limit effects of DoS attacks using FedRAMP-defined safeguards.

• Control implementation statement for SC-5 citing the system mission and inheritance from common controls
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results

• Cryptographic keys stored alongside the data they protect
• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones

Monitor/control communications at external boundary and key internal boundaries; implement subnetworks for publicly accessible components.

• Control implementation statement for SC-7 citing the system mission and inheritance from common controls
• Network segmentation diagrams with VLAN and zone mapping
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services

Protect confidentiality and integrity of transmitted information using cryptographic mechanisms.

• Control implementation statement for SC-8 citing the system mission and inheritance from common controls
• Denial of service protection configuration and capacity test results
• Boundary protection architecture with firewall and proxy rule documentation
• Cryptographic standards specifying approved algorithms and key lengths
• Key management procedures including rotation and escrow
• TLS configuration scan results across in scope endpoints

• Firewall rule base contains stale allow any entries
• Internal traffic between services unencrypted within trusted zones
• Legacy TLS versions remain enabled on external services
• Flat networks expose sensitive workloads without segmentation

Develop and review system/information integrity policy at least annually.

• Control implementation statement for SI-1 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Input validation handled inconsistently across microservices
• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception

Check validity of FedRAMP-defined information inputs.

• Control implementation statement for SI-10 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Generate error messages providing necessary info without revealing sensitive info; reveal only to authorized.

• Error handling review

• Stack traces exposed

Manage and retain information consistent with applicable laws, regulations, policies, standards.

• Control implementation statement for SI-12 citing the system mission and inheritance from common controls
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

Implement FedRAMP-defined safeguards to protect memory from unauthorized code execution (DEP, ASLR).

• Control implementation statement for SI-16 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments
• Input validation handled inconsistently across microservices

Identify, report, and correct system flaws; remediate within FedRAMP-defined timeframes (HIGH critical 15d, high 30d).

• Control implementation statement for SI-2 citing the system mission and inheritance from common controls
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Input validation handled inconsistently across microservices
• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Implement signature-based and non-signature-based malicious code protection; configure to scan endpoints and entry/exit points.

• Control implementation statement for SI-3 citing the system mission and inheritance from common controls
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Monitor system to detect attacks; identify unauthorized use; deploy monitoring devices at boundaries and key internal points.

• Control implementation statement for SI-4 citing the system mission and inheritance from common controls
• Patch deployment reports across server, endpoint, and network estates
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots
• Input validation standards and code review checklist
• Security monitoring alert tuning records

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

Receive alerts/advisories/directives from FedRAMP-defined external organizations (US-CERT, CISA); generate internal; disseminate.

• Control implementation statement for SI-5 citing the system mission and inheritance from common controls
• Endpoint detection and response coverage report
• Vulnerability remediation tickets with verification screenshots
• Input validation standards and code review checklist
• Security monitoring alert tuning records

• Alert backlog exceeds analyst capacity leading to triage delays
• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems

Employ integrity verification tools to detect unauthorized changes to software, firmware, information; HIGH only.

• Control implementation statement for SI-7 citing the system mission and inheritance from common controls
• Input validation standards and code review checklist
• Security monitoring alert tuning records
• Patch management policy with severity based SLAs
• Patch deployment reports across server, endpoint, and network estates

• Critical patches deployed beyond the policy SLA without exception
• EDR coverage gaps on legacy operating systems
• Anti malware signatures not updated on isolated network segments

Employ spam protection at entry/exit points; update spam protection mechanisms when new releases available.

• Email gateway config

• No spam protection

Develop, document, disseminate, and review supply chain risk management policy and procedures at defined frequency.

• Control implementation statement for SR-1 citing the system mission and inheritance from common controls
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Vendor risk tier ratings static despite changes in service scope
• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work

Inspect systems or components at defined frequency or upon indications of tampering to detect compromise.

• Control implementation statement for SR-10 citing the system mission and inheritance from common controls
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Implement anti-counterfeit policy and procedures to detect and prevent counterfeit components.

• Control implementation statement for SR-11 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work

Dispose of data, documentation, tools, or system components using defined techniques and methods.

• Control implementation statement for SR-12 citing the system mission and inheritance from common controls
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components
• Vendor risk tier ratings static despite changes in service scope

Develop a C-SCRM plan for managing supply chain risks for systems, components, and services; review and update at defined frequency.

• Control implementation statement for SR-2 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Vendor risk tier ratings static despite changes in service scope
• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification

Establish processes to identify, protect, detect, respond, and recover across the supply chain lifecycle.

• Control implementation statement for SR-3 citing the system mission and inheritance from common controls
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Employ acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks.

• Control implementation statement for SR-5 citing the system mission and inheritance from common controls
• Supplier incident notification clauses and exercise records
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers

• Counterfeit detection procedures absent for hardware refresh cycles
• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Assess and review the supply chain risk posture of suppliers at defined frequency and after significant events.

• Control implementation statement for SR-6 citing the system mission and inheritance from common controls
• Supply chain risk management policy and program charter
• Tiered vendor inventory with criticality scoring
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components

Establish agreements with suppliers for notification of supply chain compromises and relevant changes.

• Control implementation statement for SR-8 citing the system mission and inheritance from common controls
• Component authenticity verification evidence for hardware purchases
• Continuous monitoring scorecards for critical suppliers
• Contractual flow down of security requirements to subcontractors
• Supplier incident notification clauses and exercise records

• Supplier incidents discovered through news rather than contractual notification
• Flow down clauses present in master agreements but missing from statements of work
• Sub tier suppliers not identified for critical components