Skip to content
FedRAMP Rules Hub
JSON — GET /api/checks

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

KSI-SVC-RUDRemoving Unwanted Data

JSON — GET /api/checksMD — /ksi/ksi-svc-rud.md — this page as markdown, for pasting into an agent

The statement for this indicator varies by certification class.

Mapped NIST 800-53 controls (2)

  • KSI only2

The mark says whether an authored AWS recipe fetches evidence for the control; the tier strip shows which Rev5 baselines also require it — where automated KSI evidence doubles as Rev5 control evidence. = in the class B, C and D baselines, left to right

  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

Collect evidence (0)

Authored AWS and pipeline recipes whose output is evidence for KSI-SVC-RUD. This mapping is this project’s opinion (AWS overlay v3.0.0, pipeline overlay v0.8.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

No authored recipe proves KSI-SVC-RUD yet. That is an authoring gap, not a claim that nothing can — the unwritten indicators are enumerated on the class B narrative register.

Default evidence owed by every indicator (5)

From info.default_artifacts.KSI — no indicator carries its own artifacts; requirement-specific evidence lives on /evidence.

  • Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.
  • Explanation of the cycle for any measures that are implemented persistently (if applicable).
  • Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.
  • Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.
  • Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid.

Defined terms used (3)

Agency
Has the meaning given in 44 U.S. Code § 3502 (1), which is "any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—(A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities."
Federal Customer Data
All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider.
Promptly
Without unnecessary delay.

The Service Configuration run (8)

6/8 have an authored AWS recipe