CollectAWS overlay v3.0.0, pipeline overlay v0.8.0

Draw a controlcontrolOne numbered security requirement — AC-02, “account management” — from NIST SP 800-53, the catalogue FedRAMP draws its baselines from. family or a control id and this narrows to the AWS and pipeline calls that fetch its evidence, with one script for the whole scope. Every reciperecipeThis product’s unit of collection, and its own coinage: an authored command, plus what one pass of it proves and how often to re-run it. carries the command, the cadencecadenceHow often the rules require a piece of evidence to be refreshed. The clock on an obligation, not the command that satisfies it., and the indicators and controls a pass proves. The readings below count the whole Rev5 baselinebaselineThe set of controls one impact level requires. FedRAMP Rev5 publishes three, and which one binds you is the whole question of scope. union: what a recipe reaches, what only a Key Security IndicatorKey Security Indicator (KSI)FedRAMP 20x’s unit of assurance: a question asked of the running system — “is MFA enforced?” — that a machine can answer, grouped into themes. reaches, and what is narrativenarrativeNo AWS or pipeline API answers this — it is a document you write. — a document somebody writes rather than a command anybody runs.