Control index

94/409 fetchable across every Rev5 baseline

- KSI onlyAC-01 — Policy and Procedures
- recipe · 1 recipeAC-02 — Account Management
- KSI onlyAC-02 (01) — Automated System Account Management
- recipe · 1 recipeAC-02 (02) — Automated Temporary and Emergency Account Management
- recipe · 1 recipeAC-02 (03) — Disable Accounts
- recipe · 1 recipeAC-02 (04) — Automated Audit Actions
- KSI onlyAC-02 (05) — Inactivity Logout
- orphanAC-02 (07) — Privileged User Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (09) — Restrictions on Use of Shared and Group Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (11) — Usage Conditions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (12) — Account Monitoring for Atypical Usage — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-02 (13) — Disable Accounts for High-risk Individuals
- recipe · 2 recipesAC-03 — Access Enforcement
- KSI onlyAC-04 — Information Flow Enforcement
- orphanAC-04 (04) — Flow Control of Encrypted Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-04 (21) — Physical or Logical Separation of Information Flows — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-05 — Separation of Duties
- recipe · 2 recipesAC-06 — Least Privilege
- recipe · 1 recipeAC-06 (01) — Authorize Access to Security Functions
- KSI onlyAC-06 (02) — Non-privileged Access for Nonsecurity Functions
- orphanAC-06 (03) — Network Access to Privileged Commands — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-06 (05) — Privileged Accounts
- recipe · 1 recipeAC-06 (07) — Review of User Privileges
- orphanAC-06 (08) — Privilege Levels for Code Execution — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-06 (09) — Log Use of Privileged Functions
- KSI onlyAC-06 (10) — Prohibit Non-privileged Users from Executing Privileged Functions
- recipe · 1 recipeAC-07 — Unsuccessful Logon Attempts
- orphanAC-08 — System Use Notification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-10 — Concurrent Session Control — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 — Device Lock — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 (01) — Pattern-hiding Displays — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-12 — Session Termination
- KSI onlyAC-14 — Permitted Actions Without Identification or Authentication
- recipe · 1 recipeAC-17 — Remote Access
- recipe · 1 recipeAC-17 (01) — Monitoring and Control
- recipe · 1 recipeAC-17 (02) — Protection of Confidentiality and Integrity Using Encryption
- recipe · 1 recipeAC-17 (03) — Managed Access Control Points
- orphanAC-17 (04) — Privileged Commands and Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 — Wireless Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-18 (01) — Authentication and Encryption
- KSI onlyAC-18 (03) — Disable Wireless Networking
- orphanAC-18 (04) — Restrict Configurations by Users — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 (05) — Antennas and Transmission Power Levels — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 — Access Control for Mobile Devices — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 (05) — Full Device or Container-based Encryption — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-20 — Use of External Systems
- KSI onlyAC-20 (01) — Limits on Authorized Use
- orphanAC-20 (02) — Portable Storage Devices — Restricted Use — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-21 — Information Sharing — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-22 — Publicly Accessible Content — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyAC-02 (06) — Dynamic Privilege Management
- All AC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

AC-02 (04) Automated Audit Actionsac-2.4

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches AC-02 (04), and none is rated full — the output narrows the question, a human judgement closes it.

AWS CloudTrail · Amazon GuardDuty · AWS IAM1 recipe · 4 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for AC-02 (04). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialGuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principalcontinuouscli
guardduty-suspicious-iam-activity-responseGuardDuty · CloudTrail · IAM
Detection is pure telemetry; the response (which key/user to disable, whether it was malicious vs. authorized) requires incident-responder judgement, so this is partial. Evidence = finding + a linked responsive CloudTrail event within the IR SLA. cloudtrail lookup-events covers the last 90 days; use the finding type relevant to your workload.

What NIST requires of AC-02 (04)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Automatically audit account creation, modification, enabling, disabling, and removal actions.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baselineannual assessment

Class C readiness

Class Dour reading: Rev5 High

in baselineannual assessment

Class D readiness

KSI indicators reaching this control (4)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act