KSI-SVC-PRRPreventing Residual Risk

The mark says whether an authored AWS recipe fetches evidence for the control; the tier strip shows which Rev5 baselines also require it — where automated KSI evidence doubles as Rev5 control evidence. ▪▪▫ = in the class B, C and D baselines, left to right

• ●recipe— an authored recipe collects evidence for this control
• ◐KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
• ○orphan— no Key Security Indicator reaches it — a person writes it up instead

• ◐KSI onlySC-04SC▫▪▪In baseline C, D

Collect evidence (0)

Authored AWS and pipeline recipes whose output is evidence for KSI-SVC-PRR. This mapping is this project’s opinion (AWS overlay v3.0.0, pipeline overlay v0.8.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

Default evidence owed by every indicator (5)

From info.default_artifacts.KSI — no indicator carries its own artifacts; requirement-specific evidence lives on /evidence.

• Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.
• Explanation of the cycle for any measures that are implemented persistently (if applicable).
• Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.
• Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.
• Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid.

Defined terms used (4)

Federal Customer Data

All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider.

Information Resource

Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc.

Likely

A reasonable degree of probability based on context.

Persistently

Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known.

• ●2 authored recipesKSI-SVC-ACMAutomating Configuration Management
• ●2 authored recipesKSI-SVC-ASMAutomating Secret Management
• ●4 authored recipesKSI-SVC-EISEvaluating and Improving Security
• ○no authored recipeKSI-SVC-PRRPreventing Residual Riskyou are here
• ○no authored recipeKSI-SVC-RUDRemoving Unwanted Data
• ●7 authored recipesKSI-SVC-SINSecuring Information
• ●2 authored recipesKSI-SVC-VCMValidating Communications
• ●3 authored recipesKSI-SVC-VRIValidating Resource Integrity