Control index

94/409 fetchable across every Rev5 baseline

- orphanCM-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-02 — Baseline Configuration
- recipe · 1 recipeCM-02 (02) — Automation Support for Accuracy and Currency
- KSI onlyCM-02 (03) — Retention of Previous Configurations
- KSI onlyCM-02 (07) — Configure Systems and Components for High-risk Areas
- recipe · 1 recipeCM-03 — Configuration Change Control
- orphanCM-03 (01) — Automated Documentation, Notification, and Prohibition of Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-03 (02) — Testing, Validation, and Documentation of Changes
- recipe · 1 recipeCM-03 (04) — Security and Privacy Representatives
- orphanCM-03 (06) — Cryptography Management — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 — Impact Analyses — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 (01) — Separate Test Environments — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-04 (02) — Verification of Controls
- recipe · 1 recipeCM-05 — Access Restrictions for Change
- orphanCM-05 (01) — Automated Access Enforcement and Audit Records — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-05 (05) — Privilege Limitation for Production and Operation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-06 — Configuration Settings
- orphanCM-06 (01) — Automated Management, Application, and Verification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-06 (02) — Respond to Unauthorized Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-07 — Least Functionality
- recipe · 1 recipeCM-07 (01) — Periodic Review
- KSI onlyCM-07 (02) — Prevent Program Execution
- KSI onlyCM-07 (05) — Authorized Software — Allow-by-exception
- recipe · 1 recipeCM-08 — System Component Inventory
- recipe · 1 recipeCM-08 (01) — Updates During Installation and Removal
- orphanCM-08 (02) — Automated Maintenance — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-08 (03) — Automated Unauthorized Component Detection
- orphanCM-08 (04) — Accountability Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-09 — Configuration Management Plan
- orphanCM-10 — Software Usage Restrictions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-11 — User-installed Software — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-12 — Information Location
- recipe · 1 recipeCM-12 (01) — Automated Tools to Support Information Location
- orphanCM-14 — Signed Components — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- All CM in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

CM-07 (01) Periodic Reviewcm-7.1

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches CM-07 (01), and none is rated full — the output narrows the question, a human judgement closes it.

AWS Config · Amazon EC2 · AWS Systems Manager Inventory1 recipe · 3 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for CM-07 (01). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialConfig compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to readmonthlycli
config-least-functionalityAWS Config · AWS Systems Manager Inventory · Amazon EC2
These prove the negatives you asserted and hand the reviewer the real installed-application set — they do not prove least functionality. That the functions, ports, protocols and services still enabled are the minimum necessary is a judgement against your documented essential-capability list, and CM-07.01's periodic review is a decision someone makes and records, not an API result; keep the review record next to this output. Both rules are only as strong as their parameters. RESTRICTED_INCOMING_TRAFFIC defaults to blocking TCP 20, 21, 3389, 3306 and 4333 — set blockedPorts to your real denylist or you are testing AWS's defaults, not your policy. EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED needs exact application names (no wildcards, and the name differs per distro) and evaluates AWS::SSM::ManagedInstanceInventory, so a node with no running agent or inventory association is simply not evaluated rather than flagged — pair it with the inventory recipe's coverage check. Security-group ingress deliberately overlaps the SC-07 boundary recipe: there it proves boundary protection, here it proves unnecessary ports are closed.

What NIST requires of CM-07 (01)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

(a) Review the system [frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baselineannual assessment

Class C readiness

Class Dour reading: Rev5 High

in baselineannual assessment

Class D readiness

KSI indicators reaching this control (4)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act