Control index

94/409 fetchable across every Rev5 baseline

- KSI onlyAC-01 — Policy and Procedures
- recipe · 1 recipeAC-02 — Account Management
- KSI onlyAC-02 (01) — Automated System Account Management
- recipe · 1 recipeAC-02 (02) — Automated Temporary and Emergency Account Management
- recipe · 1 recipeAC-02 (03) — Disable Accounts
- recipe · 1 recipeAC-02 (04) — Automated Audit Actions
- KSI onlyAC-02 (05) — Inactivity Logout
- orphanAC-02 (07) — Privileged User Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (09) — Restrictions on Use of Shared and Group Accounts — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (11) — Usage Conditions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-02 (12) — Account Monitoring for Atypical Usage — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-02 (13) — Disable Accounts for High-risk Individuals
- recipe · 2 recipesAC-03 — Access Enforcement
- KSI onlyAC-04 — Information Flow Enforcement
- orphanAC-04 (04) — Flow Control of Encrypted Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-04 (21) — Physical or Logical Separation of Information Flows — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-05 — Separation of Duties
- recipe · 2 recipesAC-06 — Least Privilege
- recipe · 1 recipeAC-06 (01) — Authorize Access to Security Functions
- KSI onlyAC-06 (02) — Non-privileged Access for Nonsecurity Functions
- orphanAC-06 (03) — Network Access to Privileged Commands — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-06 (05) — Privileged Accounts
- recipe · 1 recipeAC-06 (07) — Review of User Privileges
- orphanAC-06 (08) — Privilege Levels for Code Execution — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-06 (09) — Log Use of Privileged Functions
- KSI onlyAC-06 (10) — Prohibit Non-privileged Users from Executing Privileged Functions
- recipe · 1 recipeAC-07 — Unsuccessful Logon Attempts
- orphanAC-08 — System Use Notification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-10 — Concurrent Session Control — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 — Device Lock — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-11 (01) — Pattern-hiding Displays — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-12 — Session Termination
- KSI onlyAC-14 — Permitted Actions Without Identification or Authentication
- recipe · 1 recipeAC-17 — Remote Access
- recipe · 1 recipeAC-17 (01) — Monitoring and Control
- recipe · 1 recipeAC-17 (02) — Protection of Confidentiality and Integrity Using Encryption
- recipe · 1 recipeAC-17 (03) — Managed Access Control Points
- orphanAC-17 (04) — Privileged Commands and Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 — Wireless Access — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyAC-18 (01) — Authentication and Encryption
- KSI onlyAC-18 (03) — Disable Wireless Networking
- orphanAC-18 (04) — Restrict Configurations by Users — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-18 (05) — Antennas and Transmission Power Levels — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 — Access Control for Mobile Devices — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-19 (05) — Full Device or Container-based Encryption — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeAC-20 — Use of External Systems
- KSI onlyAC-20 (01) — Limits on Authorized Use
- orphanAC-20 (02) — Portable Storage Devices — Restricted Use — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-21 — Information Sharing — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanAC-22 — Publicly Accessible Content — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- reached, in no baseline
  - KSI onlyAC-02 (06) — Dynamic Privilege Management
- All AC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

AC-06 (07) Review of User Privilegesac-6.7

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches AC-06 (07), and none is rated full — the output narrows the question, a human judgement closes it.

AWS IAM Access Analyzer1 recipe · 3 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for AC-06 (07). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialActive unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removalcontinuouscli
iam-access-analyzer-unused-accessIAM Access Analyzer
Use list-findings-v2 (list-findings is external-access only and does not return unused-access findings). Requires an existing ACCOUNT_UNUSED_ACCESS analyzer; create one with create-analyzer --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess":{"unusedAccessAge":90}}'. Target zero ACTIVE unused-permission findings for privileged roles. An empty findings list is meaningful only if an analyzer exists, is ACTIVE, and its unusedAccessAge equals the review period the SSP declares; entities younger than the tracking period, and principals or accounts excluded by tag, never appear as findings. UnusedPermission findings are computed for roles, so IAM users' unused permissions are outside this output, and AC-06 (07)(a)'s periodic review is a human record — which is why this is partial.

What NIST requires of AC-06 (07)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

(a) Review [frequency] the privileges assigned to [roles and classes] to validate the need for such privileges; and (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (2)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act