Class C → D

87 of the 87 controls this step adds are orphans: no 20x Key Security Indicator reaches them. The consequence is structural rather than editorial — the control graph this site is built on is assembled from indicator edges, so an orphan has no node, no /control/ permalink, and cannot be dispositioned on the automation frontier, whose universe is the KSI-reached set. They are enumerated here and nowhere else on the site, and the ids below are deliberately not links.

Added controls grouped by the recipe that reaches the control or, for an enhancement, the base control it tightens. A recipe on a base control is a lead for scoping, never evidence for the enhancement — a covered base is why the lower authorization is held. Each control is listed once, under whichever candidate mechanism carries the most of this step, so the counts partition the added set rather than double-count it. Where a control has more than one candidate, the full set is in its row of the table below.

• 7config-threat-monitoring-enabledawssi-4.10 · si-4.11 · si-4.12 · si-4.14 · si-4.19 · si-4.20 · si-4.22
• 5guardduty-pattern-review-past-incidentsawsir-4.2 · ir-4.4 · ir-4.6 · ir-4.11 · ir-5.1
• 4cloudwatch-log-review-alertingawsau-6.4 · au-6.5 · au-6.6 · au-6.7
• 4config-cloudtrail-audit-loggingawsau-9.2 · au-9.3 · au-12.1 · au-12.3
• 3config-data-backup-enabledawscp-9.2 · cp-9.3 · cp-9.5
• 3config-network-boundary-protectionawssc-7.10 · sc-7.20 · sc-7.21
• 3integrity-verification-and-immutabilityawssi-7.2 · si-7.5 · si-7.15
• 2audit-log-retention-and-delivery-failureawsau-5.1 · au-5.2
• 2cloudtrail-config-change-historyawscm-3.1 · cm-3.6
• 2config-access-keys-rotatedawsia-5.8 · ia-5.13
• 2config-asset-inventoryawscm-8.2 · cm-8.4
• 2config-iam-policy-no-admin-accessawsac-6.3 · ac-6.8
• 2patch-and-vulnerability-remediationawsra-5.4 · ra-5.8
• 1backup-restore-testingawscp-10.4
• 1iam-account-authorization-detailsawsac-2.11
• 1personnel-separation-access-revocationawsps-4.2
• 1security-advisories-receipt-and-disseminationawssi-5.1
• 1ssm-configuration-baseline-enforcedawscm-6.2

Requirements whose timeframe is stated per class and differs across this step. A baseline diff cannot see these: the requirement id is identical in both classes and only the number moves. Units are the dataset’s own and are never converted.

The rest of the per-class rules: requirements whose class levels differ in force or in wording and carry no timeframe to diff. The clock table above cannot see these, and for the step to the highest class they are where the machine-automation requirement actually lives — the quota is stated as a count and the history window as prose, so neither is a number a clock diff can compare. Statements are the dataset’s own and are never paraphrased. A requirement that names its own class and is otherwise identical at both is counted as unchanged.

• CDS-CSO-PSMPer-Service Certification MaterialsMAY → MUST

  Class C

  Providers with Class C Certifications MAY supply per-service FedRAMP Certification materials.

  Class D

  Providers with Class D Certifications MUST supply per-service FedRAMP Certification materials.

• CMU-CSO-UVMUsing Validated Cryptographic ModulesSHOULD → MUST

  Class C

  Providers with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.

  Class D

  Providers with Class D Certifications MUST use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.

• FRC-CSX-MOTMetrics Over Time for Key Security Indicators

  Class C

  Providers seeking 20x Class C Certification MUST supply historical metrics including status from persistent validation over at least the past 6 months for all Key Security Indicators.

  Class D

  Providers seeking 20x Class D Certification MUST provide historical metrics including status from persistent validation over at least the past 18 months for all Key Security Indicators.

• FRC-CSX-VVKAutomated Verification and Validation of Key Security Indicators

  Class C

  Providers seeking 20x Class C Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 2 automated methods for each Key Security Indicator.

  Class D

  Providers seeking 20x Class D Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 4 automated methods for each Key Security Indicator.

• SDR-CSX-KMTKey Security Indicator Metrics

  Class C

  Providers with 20x Class C Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:

  Class D

  Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot.

• VDR-TFR-PVRMitigation and Remediation Expectations

  Class C

  Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:

  Class D

  Providers with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:

• VER-TFR-NRINon-Internet-Reachable IncidentsMAY → SHOULD

  Class C

  Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

  Class D

  Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.

• CP 12
• AU 11
• SI 11
• AC 7
• CM 7
• IR 7
• PE 7
• SC 6
• SA 4
• IA 3
• MP 3
• CA 2
• MA 2
• RA 2
• SR 2
• PS 1