PM-07 Enterprise Architecturepm-7
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Nothing names itNo recipe names PM-07. 3 reach an indicator it shares, which is adjacency and not coverage — worth reading, not worth recording as evidence for this control.
Collect evidence (0)
Authored pipeline recipes whose output is evidence for PM-07. This mapping is this project’s opinion (overlay v0.8.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
No authored recipe names PM-07. The nearest authored work is below.
Nobody has assessed PM-07 against AWS and pipeline yet. That is a gap in this project’s research — not a finding about the control, and not a claim that nothing collects it.
The KSI that reaches it is KSI-PIY-RSD — that is where the authoring would land. Browse /collect for the whole authored corpus.
Reaches the same indicator, not PM-07
These recipes prove a KSI that reaches it. None of them claims PM-07 — treat them as neighbours worth reading, not as coverage.
- The rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when. via KSI-PIY-RSD
- Which policy decisions were actually enforced against the infrastructure definitions the boundary deploys from: that a policy scan ran, on which branch, how many rules it applied and when it last ran, together with the failures still open and the record of which were dismissed and with what justification. The load-bearing half is the scan record rather than the findings. SA-08 asks whether security engineering principles were applied, and a clean findings list is the same output whether every principle held or the scan applied no rules, ran last quarter, or parsed nothing — so the count of rules run and the date it ran are the part of this evidence that makes the rest of it mean anything. via KSI-PIY-RSD
- For a service that ships code to a browser, the two things a pipeline can say about the mobile code it delivers: what was allowed INTO it, and whether what shipped is what this pipeline built. The first is the dependency diff for the change — every component added, its ecosystem, its version, its licence and any advisory against it, separated by whether it reaches the runtime or stops at the build — and the gate that makes the check mandatory rather than advisory. The second is a provenance attestation over the built bundle, verified against the repository and workflow that are supposed to have produced it. Neither is a statement about which mobile code technologies the organization decided to permit, and that is the control's first limb. via KSI-PIY-RSD
What NIST requires of PM-07
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (1)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.