Control index

94/409 fetchable across every Rev5 baseline

- KSI onlyAC-01 — Policy and Procedures
- recipe · 1 recipeAC-02 — Account Management
- KSI onlyAC-02 (01) — Automated System Account Management
- recipe · 1 recipeAC-02 (02) — Automated Temporary and Emergency Account Management
- recipe · 1 recipeAC-02 (03) — Disable Accounts
- recipe · 1 recipeAC-02 (04) — Automated Audit Actions
- KSI onlyAC-02 (05) — Inactivity Logout
- orphanAC-02 (07) — Privileged User Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (09) — Restrictions on Use of Shared and Group Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (11) — Usage Conditions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (12) — Account Monitoring for Atypical Usage — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-02 (13) — Disable Accounts for High-risk Individuals
- recipe · 2 recipesAC-03 — Access Enforcement
- KSI onlyAC-04 — Information Flow Enforcement
- orphanAC-04 (04) — Flow Control of Encrypted Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-04 (21) — Physical or Logical Separation of Information Flows — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-05 — Separation of Duties
- recipe · 2 recipesAC-06 — Least Privilege
- recipe · 1 recipeAC-06 (01) — Authorize Access to Security Functions
- KSI onlyAC-06 (02) — Non-privileged Access for Nonsecurity Functions
- orphanAC-06 (03) — Network Access to Privileged Commands — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-06 (05) — Privileged Accounts
- recipe · 1 recipeAC-06 (07) — Review of User Privileges
- orphanAC-06 (08) — Privilege Levels for Code Execution — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-06 (09) — Log Use of Privileged Functions
- KSI onlyAC-06 (10) — Prohibit Non-privileged Users from Executing Privileged Functions
- recipe · 1 recipeAC-07 — Unsuccessful Logon Attempts
- orphanAC-08 — System Use Notification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-10 — Concurrent Session Control — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 — Device Lock — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 (01) — Pattern-hiding Displays — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-12 — Session Termination
- KSI onlyAC-14 — Permitted Actions Without Identification or Authentication
- recipe · 1 recipeAC-17 — Remote Access
- recipe · 1 recipeAC-17 (01) — Monitoring and Control
- recipe · 1 recipeAC-17 (02) — Protection of Confidentiality and Integrity Using Encryption
- recipe · 1 recipeAC-17 (03) — Managed Access Control Points
- orphanAC-17 (04) — Privileged Commands and Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 — Wireless Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-18 (01) — Authentication and Encryption
- KSI onlyAC-18 (03) — Disable Wireless Networking
- orphanAC-18 (04) — Restrict Configurations by Users — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 (05) — Antennas and Transmission Power Levels — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 — Access Control for Mobile Devices — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 (05) — Full Device or Container-based Encryption — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-20 — Use of External Systems
- KSI onlyAC-20 (01) — Limits on Authorized Use
- orphanAC-20 (02) — Portable Storage Devices — Restricted Use — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-21 — Information Sharing — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-22 — Publicly Accessible Content — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyAC-02 (06) — Dynamic Privilege Management
- All AC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

AC-06 (01) Authorize Access to Security Functionsac-6.1

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches AC-06 (01), and none is rated full — the output narrows the question, a human judgement closes it.

AWS IAM1 recipe · 2 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for AC-06 (01). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialFull snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intentquarterlycli
iam-account-authorization-detailsIAM
The API fully enumerates entitlements (telemetry), but deciding whether a given permission set is 'least privilege' requires human judgement against a documented access baseline. Reviewers should diff this snapshot against the last approved baseline and justify deltas.

What NIST requires of AC-06 (01)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Authorize access for [individuals and roles] to: (a) [organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [security-relevant information].

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (1)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

IAMKSI-IAM-JITAuthorizing Just-in-Time
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.

FedRAMP guidance & parameters

Where you read the rule. Guidance names an FRR document, never a clause, so the links below offer the whole document and leave the reading to you.

FedRAMP-defined parameter values (ODPs)
Parameter	FedRAMP-defined value
ac-06.01_odp.02	all functions not publicly accessible
ac-06.01_odp.05	all security-relevant information not publicly available

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act