Control index

94/409 fetchable across every Rev5 baseline

- KSI onlyAC-01 — Policy and Procedures
- recipe · 1 recipeAC-02 — Account Management
- KSI onlyAC-02 (01) — Automated System Account Management
- recipe · 1 recipeAC-02 (02) — Automated Temporary and Emergency Account Management
- recipe · 1 recipeAC-02 (03) — Disable Accounts
- recipe · 1 recipeAC-02 (04) — Automated Audit Actions
- KSI onlyAC-02 (05) — Inactivity Logout
- orphanAC-02 (07) — Privileged User Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (09) — Restrictions on Use of Shared and Group Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (11) — Usage Conditions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (12) — Account Monitoring for Atypical Usage — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-02 (13) — Disable Accounts for High-risk Individuals
- recipe · 2 recipesAC-03 — Access Enforcement
- KSI onlyAC-04 — Information Flow Enforcement
- orphanAC-04 (04) — Flow Control of Encrypted Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-04 (21) — Physical or Logical Separation of Information Flows — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-05 — Separation of Duties
- recipe · 2 recipesAC-06 — Least Privilege
- recipe · 1 recipeAC-06 (01) — Authorize Access to Security Functions
- KSI onlyAC-06 (02) — Non-privileged Access for Nonsecurity Functions
- orphanAC-06 (03) — Network Access to Privileged Commands — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-06 (05) — Privileged Accounts
- recipe · 1 recipeAC-06 (07) — Review of User Privileges
- orphanAC-06 (08) — Privilege Levels for Code Execution — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-06 (09) — Log Use of Privileged Functions
- KSI onlyAC-06 (10) — Prohibit Non-privileged Users from Executing Privileged Functions
- recipe · 1 recipeAC-07 — Unsuccessful Logon Attempts
- orphanAC-08 — System Use Notification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-10 — Concurrent Session Control — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 — Device Lock — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 (01) — Pattern-hiding Displays — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-12 — Session Termination
- KSI onlyAC-14 — Permitted Actions Without Identification or Authentication
- recipe · 1 recipeAC-17 — Remote Access
- recipe · 1 recipeAC-17 (01) — Monitoring and Control
- recipe · 1 recipeAC-17 (02) — Protection of Confidentiality and Integrity Using Encryption
- recipe · 1 recipeAC-17 (03) — Managed Access Control Points
- orphanAC-17 (04) — Privileged Commands and Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 — Wireless Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-18 (01) — Authentication and Encryption
- KSI onlyAC-18 (03) — Disable Wireless Networking
- orphanAC-18 (04) — Restrict Configurations by Users — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 (05) — Antennas and Transmission Power Levels — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 — Access Control for Mobile Devices — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 (05) — Full Device or Container-based Encryption — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-20 — Use of External Systems
- KSI onlyAC-20 (01) — Limits on Authorized Use
- orphanAC-20 (02) — Portable Storage Devices — Restricted Use — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-21 — Information Sharing — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-22 — Publicly Accessible Content — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyAC-02 (06) — Dynamic Privilege Management
- All AC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

AC-17 (03) Managed Access Control Pointsac-17.3

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches AC-17 (03), and none is rated full — the output narrows the question, a human judgement closes it.

AWS Client VPN · AWS Config · Amazon EC2 · AWS Systems Manager Session Manager1 recipe · 5 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for AC-17 (03). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable insteadweeklycli
remote-access-authorization-and-monitoringAWS Systems Manager Session Manager · AWS Client VPN · AWS Config · Amazon EC2
The commands split cleanly across the control family, and the gap in the middle is the one to be honest about. AC-17(1) — automated monitoring and control of remote access — is what session history and connection logs deliver, with two documented blind spots. Session Manager does not log sessions that connect through port forwarding or SSH, because SSH encrypts the session data inside the TLS connection and Session Manager is only the tunnel; an operator who port-forwards leaves a session record with no command content behind it. And describe-sessions reaches back 30 days only, so anything longer is an S3 or CloudWatch Logs query against the destinations named in the preferences document, not an SSM call. Client VPN retention is shorter still — terminated connections drop out of the API after 60 minutes, which makes the log group named in ConnectionLogOptions the only durable record, and Username is populated only for Active Directory authentication, so certificate-authenticated users are identified by CommonName or not at all. AC-17(2) is the strongest link in GovCloud, where the endpoints are FIPS 140-3 modules by construction; the Session Manager equivalent is kmsKeyId in the preferences document, and it is empty unless you set it, so an empty kmsKeyId is a finding rather than a default. AC-17(3) — routing remote access through managed network access control points — is the one nothing here proves. Session Manager and a Client VPN endpoint are managed access points, and ec2-instance-no-public-ip is the closest negative check, but that rule applies only to IPv4 and only to AWS::EC2::Instance: an IPv6-reachable instance, a load balancer fronting SSH, or a third-party jump host is invisible to it. Read the result as 'no EC2 instance carries a public IPv4 address', which is a useful sentence and not the control. AC-17 itself — the documented usage restrictions, configuration requirements and per-type authorization — is a record you write, and this telemetry only shows whether the estate matches it. One warning to carry into the evidence package: Session Manager logs the commands entered and their output, so a credential typed into a session lands in the log group you are about to hand an assessor.

What NIST requires of AC-17 (03)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Route remote accesses through authorized and managed network access control points.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (5)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act