Control index

94/409 fetchable across every Rev5 baseline

- orphanSC-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-02 — Separation of System and User Functionality
- orphanSC-03 — Security Function Isolation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-04 — Information in Shared System Resources
- recipe · 1 recipeSC-05 — Denial-of-service Protection
- recipe · 1 recipeSC-07 — Boundary Protection
- recipe · 1 recipeSC-07 (03) — Access Points
- recipe · 1 recipeSC-07 (04) — External Telecommunications Services
- recipe · 1 recipeSC-07 (05) — Deny by Default — Allow by Exception
- KSI onlySC-07 (07) — Split Tunneling for Remote Devices
- KSI onlySC-07 (08) — Route Traffic to Authenticated Proxy Servers
- orphanSC-07 (10) — Prevent Exfiltration — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (12) — Host-based Protection — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (18) — Fail Secure — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (20) — Dynamic Isolation and Segregation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (21) — Isolation of System Components — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-08 — Transmission Confidentiality and Integrity
- KSI onlySC-08 (01) — Cryptographic Protection
- KSI onlySC-10 — Network Disconnect
- KSI onlySC-12 — Cryptographic Key Establishment and Management
- orphanSC-12 (01) — Availability — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-13 — Cryptographic Protection
- orphanSC-15 — Collaborative Computing Devices and Applications — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-17 — Public Key Infrastructure Certificates
- recipe · 1 recipeSC-18 — Mobile Code
- recipe · 1 recipeSC-20 — Secure Name/Address Resolution Service (Authoritative Source)
- recipe · 1 recipeSC-21 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)
- recipe · 1 recipeSC-22 — Architecture and Provisioning for Name/Address Resolution Service
- recipe · 1 recipeSC-23 — Session Authenticity
- orphanSC-24 — Fail in Known State — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-28 — Protection of Information at Rest
- KSI onlySC-28 (01) — Cryptographic Protection
- KSI onlySC-39 — Process Isolation
- orphanSC-45 — System Time Synchronization — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-45 (01) — Synchronization with Authoritative Time Source — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- All SC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

SC-07 (04) External Telecommunications Servicessc-7.4

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches SC-07 (04), and none is rated full — the output narrows the question, a human judgement closes it.

AWS Config · Amazon EC2 · AWS Network Firewall · Amazon VPC1 recipe · 9 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for SC-07 (04). This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialEvery route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actionsweeklycli
boundary-access-points-and-default-denyAmazon VPC · Amazon EC2 · AWS Network Firewall · AWS Config
The inventory is telemetry; the limit is policy. SC-07.03 asks that external connections be held to the minimum needed and each one routed through a managed interface — these calls enumerate every gateway, endpoint and tunnel exactly, but whether that count is the minimum is a comparison against your documented architecture, and nothing in the API tells you a gateway is unnecessary. SC-07.04 is the weakest half here: describe-vpn-connections proves the tunnels exist and are up, but the control also wants each external telecommunications interface documented with its business need and traffic-flow policy, exceptions reviewed and removed — that record is a document, not a call. This recipe also does not cover carrier links terminated outside these APIs (AWS Direct Connect connections, Transit Gateway peering to another network); enumerate those separately if you use them. SC-07.05 is the closest to full: the default-deny posture of security groups, network ACLs and the firewall policy is directly readable, and vpc-default-security-group-closed is a clean pass/fail. Read the ACL Entries yourself rather than trusting a rule verdict — an allow entry with a low rule number can shadow everything below it, and no managed rule scores ordering. Substitute your real firewall policy name; describe-firewall-policy is one policy per call. Security-group ingress is covered by the SC-07 recipe (restricted-ssh, vpc-sg-open-only-to-authorized-ports) and not repeated here.

What NIST requires of SC-07 (04)

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

(a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the information being transmitted across each interface; (d) Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need; (e) Review exceptions to the traffic flow policy [frequency] and remove exceptions that are no longer supported by an explicit mission or business need; (f) Prevent unauthorized exchange of control plane traffic with external networks; (g) Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and (h) Filter unauthorized control plane traffic from external networks.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baselineannual assessment

Class C readiness

Class Dour reading: Rev5 High

in baselineannual assessment

Class D readiness

KSI indicators reaching this control (1)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

CNAKSI-CNA-MATMinimizing Attack Surface
Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act