Control index

94/409 fetchable across every Rev5 baseline

- orphanSC-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-02 — Separation of System and User Functionality
- orphanSC-03 — Security Function Isolation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-04 — Information in Shared System Resources
- recipe · 1 recipeSC-05 — Denial-of-service Protection
- recipe · 1 recipeSC-07 — Boundary Protection
- recipe · 1 recipeSC-07 (03) — Access Points
- recipe · 1 recipeSC-07 (04) — External Telecommunications Services
- recipe · 1 recipeSC-07 (05) — Deny by Default — Allow by Exception
- KSI onlySC-07 (07) — Split Tunneling for Remote Devices
- KSI onlySC-07 (08) — Route Traffic to Authenticated Proxy Servers
- orphanSC-07 (10) — Prevent Exfiltration — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (12) — Host-based Protection — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (18) — Fail Secure — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (20) — Dynamic Isolation and Segregation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-07 (21) — Isolation of System Components — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-08 — Transmission Confidentiality and Integrity
- KSI onlySC-08 (01) — Cryptographic Protection
- KSI onlySC-10 — Network Disconnect
- KSI onlySC-12 — Cryptographic Key Establishment and Management
- orphanSC-12 (01) — Availability — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-13 — Cryptographic Protection
- orphanSC-15 — Collaborative Computing Devices and Applications — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlySC-17 — Public Key Infrastructure Certificates
- recipe · 1 recipeSC-18 — Mobile Code
- recipe · 1 recipeSC-20 — Secure Name/Address Resolution Service (Authoritative Source)
- recipe · 1 recipeSC-21 — Secure Name/Address Resolution Service (Recursive or Caching Resolver)
- recipe · 1 recipeSC-22 — Architecture and Provisioning for Name/Address Resolution Service
- recipe · 1 recipeSC-23 — Session Authenticity
- orphanSC-24 — Fail in Known State — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeSC-28 — Protection of Information at Rest
- KSI onlySC-28 (01) — Cryptographic Protection
- KSI onlySC-39 — Process Isolation
- orphanSC-45 — System Time Synchronization — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanSC-45 (01) — Synchronization with Authoritative Time Source — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- All SC in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

SC-08 Transmission Confidentiality and Integritysc-8

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches SC-08, and none is rated full — the output narrows the question, a human judgement closes it.

AWS Config · Elastic Load Balancing · Amazon Redshift · Amazon S31 recipe · 9 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for SC-08. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLcontinuousconfig-rule
config-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
The SC-08.01 enhancement (cryptographic protection in transit) is the TLS requirement these rules assert. ELB_TLS_HTTPS_LISTENERS_ONLY covers Classic Load Balancers only — for Application/Network Load Balancers add elbv2-acm-certificate-required and alb-http-to-https-redirection-check, and pair with acm-certificate-expiration-check so the certs terminating TLS are valid. These three cover the dominant public data paths; extend to the services you actually run (e.g. api-gw-ssl-enabled, elasticsearch-node-to-node-encryption-check). ELB_TLS_HTTPS_LISTENERS_ONLY evaluates Classic Load Balancers only and returns NOT_APPLICABLE where there is no listener, so on an ALB/NLB estate that assertion passes having examined nothing; whether the TLS that terminates is FIPS-validated is carried by the listener's SslPolicy, which no command here reads, and a human confirms it — SC-08 (01) is not claimed.

What NIST requires of SC-08

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

Protect the [assignment] of transmitted information.

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

in baselineannual assessment

Class B readiness

Class Cour reading: Rev5 Moderate

in baselineannual assessment

Class C readiness

Class Dour reading: Rev5 High

in baselineannual assessment

Class D readiness

KSI indicators reaching this control (3)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act

Control index

SC-08 Transmission Confidentiality and Integritysc-8

Collect evidence (1)

What NIST requires of SC-08

Rev5 baseline membership

KSI indicators reaching this control (3)