# FedRAMP Rules Hub — every entity page, in full > The FedRAMP 2026 Consolidated Rules as a queryable dataset: every requirement, every 20x Key Security Indicator, every Rev5 control, and the authored call that fetches evidence for it. Dataset: FedRAMP Consolidated Rules for 2026 v2026.07.14.01, updated 2026-07-14. AWS evidence overlay: v3.0.0, authored against dataset 2026.07.14.01. pipeline evidence overlay: v0.8.0, authored against dataset 2026.07.14.01. Control titles and statements: NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries none. This file is the concatenation of every `.md` twin on the site. The index — what the slices are, what the verbs mean, and what not to do with any of it — is at https://ramprules.com/llms.txt and is worth reading first. Each document below is preceded by the URL it is served at. Cite that URL, not this file. --- ## https://ramprules.com/control/ac-1 # AC-01 Policy and Procedures — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-1 Canonical id: `ac-1` · family `AC` > a. Develop, document, and disseminate to [organization-defined personnel or roles]: 1. [assignment] access control policy that: (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2. Procedures to facilitate the implementation of the access control policy and the associated access controls; b. Designate an [official] to manage the development, documentation, and dissemination of the access control policy and procedures; and c. Review and update the current access control: 1. Policy [frequency] and following [events]; and 2. Procedures [frequency] and following [events]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-2 # AC-02 Account Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2 Canonical id: `ac-2` · family `AC` > a. Define and document the types of accounts allowed and specifically prohibited for use within the system; b. Assign account managers; c. Require [prerequisites and criteria] for group and role membership; d. Specify: 1. Authorized users of the system; 2. Group and role membership; and 3. Access authorizations (i.e., privileges) and [attributes (as required)] for each account; e. Require approvals by [personnel or roles] for requests to create accounts; f. Create, enable, modify, disable, and remove accounts in accordance with [policy, procedures, prerequisites, and criteria]; g. Monitor the use of accounts; h. Notify account managers and [personnel or roles] within: 1. [time period] when accounts are no longer required; 2. [time period] when users are terminated or transferred; and 3. [time period] when system usage or need-to-know changes for an individual; i. Authorize access to the system based on: 1. A valid access authorization; 2. Intended system usage; and 3. [attributes (as required)]; j. Review accounts for compliance with account management requirements [frequency]; k. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group; and l. Align account management processes with personnel termination and transfer processes. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ac-2.1 # AC-02 (01) Automated System Account Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.1 Canonical id: `ac-2.1` · family `AC` > Support the management of system accounts using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-2.2 # AC-02 (02) Automated Temporary and Emergency Account Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.2 Canonical id: `ac-2.2` · family `AC` > Automatically [assignment] temporary and emergency accounts after [time period]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-2.3 # AC-02 (03) Disable Accounts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.3 Canonical id: `ac-2.3` · family `AC` > Disable accounts within [time period] when the accounts: (a) Have expired; (b) Are no longer associated with a user or individual; (c) Are in violation of organizational policy; or (d) Have been inactive for [time period]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-2.4 # AC-02 (04) Automated Audit Actions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.4 Canonical id: `ac-2.4` · family `AC` > Automatically audit account creation, modification, enabling, disabling, and removal actions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-2.5 # AC-02 (05) Inactivity Logout — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.5 Canonical id: `ac-2.5` · family `AC` > Require that users log out when [time period of expected inactivity or description of when to log out]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-2.6 # AC-02 (06) Dynamic Privilege Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.6 Canonical id: `ac-2.6` · family `AC` > Implement [dynamic privilege management capabilities]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-2.13 # AC-02 (13) Disable Accounts for High-risk Individuals — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-2.13 Canonical id: `ac-2.13` · family `AC` > Disable accounts of individuals within [time period] of discovery of [significant risks]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-3 # AC-03 Access Enforcement — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-3 Canonical id: `ac-3` · family `AC` > Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ac-4 # AC-04 Information Flow Enforcement — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-4 Canonical id: `ac-4` · family `AC` > Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [information flow control policies]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-5 # AC-05 Separation of Duties — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-5 Canonical id: `ac-5` · family `AC` > a. Identify and document [duties of individuals]; and b. Define system access authorizations to support separation of duties. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-6 # AC-06 Least Privilege — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6 Canonical id: `ac-6` · family `AC` > Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-6.1 # AC-06 (01) Authorize Access to Security Functions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.1 Canonical id: `ac-6.1` · family `AC` > Authorize access for [individuals and roles] to: (a) [organization-defined security functions (deployed in hardware, software, and firmware)]; and (b) [security-relevant information]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance { "parameters": [ { "parameterId": "ac-06.01_odp.02", "value": "all functions not publicly accessible" }, { "parameterId": "ac-06.01_odp.05", "value": "all security-relevant information not publicly available" } ] } --- ## https://ramprules.com/control/ac-6.2 # AC-06 (02) Non-privileged Access for Nonsecurity Functions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.2 Canonical id: `ac-6.2` · family `AC` > Require that users of system accounts (or roles) with access to [security functions or security-relevant information] use non-privileged accounts or roles, when accessing nonsecurity functions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance { "parameters": [ { "parameterId": "ac-06.02_odp", "value": "all security functions" } ] } ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-6.5 # AC-06 (05) Privileged Accounts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.5 Canonical id: `ac-6.5` · family `AC` > Restrict privileged accounts on the system to [personnel or roles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-6.7 # AC-06 (07) Review of User Privileges — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.7 Canonical id: `ac-6.7` · family `AC` > (a) Review [frequency] the privileges assigned to [roles and classes] to validate the need for such privileges; and (b) Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-6.9 # AC-06 (09) Log Use of Privileged Functions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.9 Canonical id: `ac-6.9` · family `AC` > Log the execution of privileged functions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-6.10 # AC-06 (10) Prohibit Non-privileged Users from Executing Privileged Functions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-6.10 Canonical id: `ac-6.10` · family `AC` > Prevent non-privileged users from executing privileged functions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-7 # AC-07 Unsuccessful Logon Attempts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-7 Canonical id: `ac-7` · family `AC` > a. Enforce a limit of [number] consecutive invalid logon attempts by a user during a [time period]; and b. Automatically [assignment] when the maximum number of unsuccessful attempts is exceeded. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-12 # AC-12 Session Termination — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-12 Canonical id: `ac-12` · family `AC` > Automatically terminate a user session after [conditions or trigger events]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-14 # AC-14 Permitted Actions Without Identification or Authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-14 Canonical id: `ac-14` · family `AC` > a. Identify [user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions; and b. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-17 # AC-17 Remote Access — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-17 Canonical id: `ac-17` · family `AC` > a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-17.1 # AC-17 (01) Monitoring and Control — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-17.1 Canonical id: `ac-17.1` · family `AC` > Employ automated mechanisms to monitor and control remote access methods. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-17.2 # AC-17 (02) Protection of Confidentiality and Integrity Using Encryption — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-17.2 Canonical id: `ac-17.2` · family `AC` > Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SVC-ASM` — Automating Secret Management (Service Configuration) Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ac-17.3 # AC-17 (03) Managed Access Control Points — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-17.3 Canonical id: `ac-17.3` · family `AC` > Route remote accesses through authorized and managed network access control points. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-IBP` — Implementing Best Practices (Cloud Native Architecture) The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance. - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-CNA-RNT` — Restricting Network Traffic (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-18.1 # AC-18 (01) Authentication and Encryption — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-18.1 Canonical id: `ac-18.1` · family `AC` > Protect wireless access to the system using authentication of [assignment] and encryption. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-18.3 # AC-18 (03) Disable Wireless Networking — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-18.3 Canonical id: `ac-18.3` · family `AC` > Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ac-20 # AC-20 Use of External Systems — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-20 Canonical id: `ac-20` · family `AC` > a. [assignment], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to: 1. Access the system from external systems; and 2. Process, store, or transmit organization-controlled information using external systems; or b. Prohibit the use of [prohibited types of external systems]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance { "guidance": [ "The interrelated controls of AC-20, CA-3, and SA-9 should be differentiated as follows:", "AC-20 describes system access to and from external systems.", "CA-3 describes documentation of an agreement between the respective system owners when data is exchanged between the CSO and an external system.", "SA-9 describes the responsibilities of external system owners. These responsibilities would typically be captured in the agreement required by CA-3." ] } --- ## https://ramprules.com/control/ac-20.1 # AC-20 (01) Limits on Authorized Use — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ac-20.1 Canonical id: `ac-20.1` · family `AC` > Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after: (a) Verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans; or (b) Retention of approved system connection or processing agreements with the organizational entity hosting the external system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-2 # AT-02 Literacy Training and Awareness — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-2 Canonical id: `at-2` · family `AT` > a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [organization-defined frequency] thereafter; and 2. When required by system changes or following [organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [awareness techniques]; c. Update literacy training and awareness content [frequency] and following [events]; and d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-2.2 # AT-02 (02) Insider Threat — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-2.2 Canonical id: `at-2.2` · family `AT` > Provide literacy training on recognizing and reporting potential indicators of insider threat. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-2.3 # AT-02 (03) Social Engineering and Mining — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-2.3 Canonical id: `at-2.3` · family `AT` > Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-3 # AT-03 Role-based Training — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-3 Canonical id: `at-3` · family `AT` > a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [organization-defined roles and responsibilities]: 1. Before authorizing access to the system, information, or performing assigned duties, and [frequency] thereafter; and 2. When required by system changes; b. Update role-based training content [frequency] and following [events]; and c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-3.5 # AT-03 (05) Processing Personally Identifiable Information — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-3.5 Canonical id: `at-3.5` · family `AT` > Provide [personnel or roles] with initial and [frequency] training in the employment and operation of personally identifiable information processing and transparency controls. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/at-4 # AT-04 Training Records — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/at-4 Canonical id: `at-4` · family `AT` > a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain individual training records for [time period]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-2 # AU-02 Event Logging — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-2 Canonical id: `au-2` · family `AU` > a. Identify the types of events that the system is capable of logging in support of the audit function: [event types]; b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged; c. Specify the following event types for logging within the system: [organization-defined event types (subset of the event types defined in [AU-2a.](#au-2_smt.a)) along with the frequency of (or situation requiring) logging for each identified event type]; d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and e. Review and update the event types selected for logging [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-3 # AU-03 Content of Audit Records — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-3 Canonical id: `au-3` · family `AU` > Ensure that audit records contain information that establishes the following: a. What type of event occurred; b. When the event occurred; c. Where the event occurred; d. Source of the event; e. Outcome of the event; and f. Identity of any individuals, subjects, or objects/entities associated with the event. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-3.1 # AU-03 (01) Additional Audit Information — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-3.1 Canonical id: `au-3.1` · family `AU` > Generate audit records containing the following additional information: [additional information]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/au-3.3 # AU-03 (03) Limit Personally Identifiable Information Elements — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-3.3 Canonical id: `au-3.3` · family `AU` > Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [elements]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-4 # AU-04 Audit Log Storage Capacity — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-4 Canonical id: `au-4` · family `AU` > Allocate audit log storage capacity to accommodate [audit log retention requirements]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-5 # AU-05 Response to Audit Logging Process Failures — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-5 Canonical id: `au-5` · family `AU` > a. Alert [personnel or roles] within [time period] in the event of an audit logging process failure; and b. Take the following additional actions: [additional actions]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-6 # AU-06 Audit Record Review, Analysis, and Reporting — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-6 Canonical id: `au-6` · family `AU` > a. Review and analyze system audit records [frequency] for indications of [inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity; b. Report findings to [personnel or roles]; and c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. ## FedRAMP guidance { "guidance": [ "This activity is considered vulnerability detection and is subject to the Vulnerability Detection and Response rules." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-6.1 # AU-06 (01) Automated Process Integration — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-6.1 Canonical id: `au-6.1` · family `AU` > Integrate audit record review, analysis, and reporting processes using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/au-6.3 # AU-06 (03) Correlate Audit Record Repositories — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-6.3 Canonical id: `au-6.3` · family `AU` > Analyze and correlate audit records across different repositories to gain organization-wide situational awareness. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/au-7 # AU-07 Audit Record Reduction and Report Generation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-7 Canonical id: `au-7` · family `AU` > Provide and implement an audit record reduction and report generation capability that: a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b. Does not alter the original content or time ordering of audit records. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-7.1 # AU-07 (01) Automatic Processing — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-7.1 Canonical id: `au-7.1` · family `AU` > Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [fields within audit records]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-8 # AU-08 Time Stamps — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-8 Canonical id: `au-8` · family `AU` > a. Use internal system clocks to generate time stamps for audit records; and b. Record time stamps for audit records that meet [granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-9 # AU-09 Protection of Audit Information — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-9 Canonical id: `au-9` · family `AU` > a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and b. Alert [personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-9.4 # AU-09 (04) Access by Subset of Privileged Users — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-9.4 Canonical id: `au-9.4` · family `AU` > Authorize access to management of audit logging functionality to only [subset of privileged users or roles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/au-11 # AU-11 Audit Record Retention — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-11 Canonical id: `au-11` · family `AU` > Retain audit records for [time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/au-12 # AU-12 Audit Record Generation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/au-12 Canonical id: `au-12` · family `AU` > a. Provide audit record generation capability for the event types the system is capable of auditing as defined in [AU-2a](#au-2_smt.a) on [system components]; b. Allow [personnel or roles] to select the event types that are to be logged by specific components of the system; and c. Generate audit records for the event types defined in [AU-2c](#au-2_smt.c) that include the audit record content defined in [AU-3](#au-3). _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. ## FedRAMP guidance { "parameters": [ { "parameterId": "au-12_odp.01", "value": "at least all information system and network components where audit capability is deployed/available" } ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ca-2 # CA-02 Control Assessments — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-2 Canonical id: `ca-2` · family `CA` > a. Select the appropriate assessor or assessment team for the type of assessment to be conducted; b. Develop a control assessment plan that describes the scope of the assessment including: 1. Controls and control enhancements under assessment; 2. Assessment procedures to be used to determine control effectiveness; and 3. Assessment environment, assessment team, and assessment roles and responsibilities; c. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment; d. Assess the controls in the system and its environment of operation [assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements; e. Produce a control assessment report that document the results of the assessment; and f. Provide the results of the control assessment to [individuals or roles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. ## FedRAMP guidance { "parameters": [ { "parameterId": "ca-02_odp.02", "value": "individuals or roles to include FedRAMP and agency customers" } ] } --- ## https://ramprules.com/control/ca-2.1 # CA-02 (01) Independent Assessors — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-2.1 Canonical id: `ca-2.1` · family `CA` > Employ independent assessors or assessment teams to conduct control assessments. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-EIS` — Enforcing Intended State (Cloud Native Architecture) ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ca-3 # CA-03 Information Exchange — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-3 Canonical id: `ca-3` · family `CA` > a. Approve and manage the exchange of information between the system and other systems using [assignment]; b. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and c. Review and update the agreements [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ca-7 # CA-07 Continuous Monitoring — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-7 Canonical id: `ca-7` · family `CA` > Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes: a. Establishing the following system-level metrics to be monitored: [system-level metrics]; b. Establishing [frequencies] for monitoring and [frequencies] for assessment of control effectiveness; c. Ongoing control assessments in accordance with the continuous monitoring strategy; d. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy; e. Correlation and analysis of information generated by control assessments and monitoring; f. Response actions to address results of the analysis of control assessment and monitoring information; and g. Reporting the security and privacy status of the system to [organization-defined personnel or roles] [organization-defined frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-EVC` — Evaluating Configurations (Monitoring, Logging, and Auditing) The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Continuous Collaborative Monitoring, Significant Change Notification, Vulnerability Detection and Response, and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/ca-7.1 # CA-07 (01) Independent Assessment — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-7.1 Canonical id: `ca-7.1` · family `CA` > Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-EIS` — Enforcing Intended State (Cloud Native Architecture) ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ca-7.4 # CA-07 (04) Risk Monitoring — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-7.4 Canonical id: `ca-7.4` · family `CA` > Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following: (a) Effectiveness monitoring; (b) Compliance monitoring; and (c) Change monitoring. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ca-9 # CA-09 Internal System Connections — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ca-9 Canonical id: `ca-9` · family `CA` > a. Authorize internal connections of [system components] to the system; b. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated; c. Terminate internal system connections after [conditions]; and d. Review [frequency] the continued need for each internal connection. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-CNA-RNT` — Restricting Network Traffic (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-2 # CM-02 Baseline Configuration — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-2 Canonical id: `cm-2` · family `CM` > a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [frequency]; 2. When required due to [circumstances]; and 3. When system components are installed or upgraded. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-CNA-DFP` — Defining Functionality and Privileges (Cloud Native Architecture) The functionality and privileges for infrastructure and services are strictly defined. - `KSI-CNA-IBP` — Implementing Best Practices (Cloud Native Architecture) The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance. - `KSI-MLA-EVC` — Evaluating Configurations (Monitoring, Logging, and Auditing) The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-2.2 # CM-02 (02) Automation Support for Accuracy and Currency — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-2.2 Canonical id: `cm-2.2` · family `CM` > Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-2.3 # CM-02 (03) Retention of Previous Configurations — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-2.3 Canonical id: `cm-2.3` · family `CM` > Retain [number] of previous versions of baseline configurations of the system to support rollback. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-2.7 # CM-02 (07) Configure Systems and Components for High-risk Areas — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-2.7 Canonical id: `cm-2.7` · family `CM` > (a) Issue [systems or system components] with [configurations] to individuals traveling to locations that the organization deems to be of significant risk; and (b) Apply the following controls to the systems or components when the individuals return from travel: [controls]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-3 # CM-03 Configuration Change Control — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-3 Canonical id: `cm-3` · family `CM` > a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c. Document configuration change decisions associated with the system; d. Implement approved configuration-controlled changes to the system; e. Retain records of configuration-controlled changes to the system for [time period]; f. Monitor and review activities associated with configuration-controlled changes to the system; and g. Coordinate and provide oversight for configuration change control activities through [configuration change control element] that convenes [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-CMT-VTD` — Validating Throughout Deployment (Change Management) Persistent testing and validation of changes throughout deployment is automated. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-3.2 # CM-03 (02) Testing, Validation, and Documentation of Changes — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-3.2 Canonical id: `cm-3.2` · family `CM` > Test, validate, and document changes to the system before finalizing the implementation of the changes. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-CMT-VTD` — Validating Throughout Deployment (Change Management) Persistent testing and validation of changes throughout deployment is automated. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-3.4 # CM-03 (04) Security and Privacy Representatives — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-3.4 Canonical id: `cm-3.4` · family `CM` > Require [organization-defined security and privacy representatives] to be members of the [configuration change control element]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-4.2 # CM-04 (02) Verification of Controls — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-4.2 Canonical id: `cm-4.2` · family `CM` > After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-CMT-VTD` — Validating Throughout Deployment (Change Management) Persistent testing and validation of changes throughout deployment is automated. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-5 # CM-05 Access Restrictions for Change — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-5 Canonical id: `cm-5` · family `CM` > Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/cm-6 # CM-06 Configuration Settings — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-6 Canonical id: `cm-6` · family `CM` > a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [common secure configurations]; b. Implement the configuration settings; c. Identify, document, and approve any deviations from established configuration settings for [system components] based on [operational requirements]; and d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-MLA-EVC` — Evaluating Configurations (Monitoring, Logging, and Auditing) The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/cm-7 # CM-07 Least Functionality — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-7 Canonical id: `cm-7` · family `CM` > a. Configure the system to provide only [mission-essential capabilities]; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/cm-7.1 # CM-07 (01) Periodic Review — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-7.1 Canonical id: `cm-7.1` · family `CM` > (a) Review the system [frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-CNA-RNT` — Restricting Network Traffic (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/cm-7.2 # CM-07 (02) Prevent Program Execution — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-7.2 Canonical id: `cm-7.2` · family `CM` > Prevent program execution in accordance with [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/cm-7.5 # CM-07 (05) Authorized Software — Allow-by-exception — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-7.5 Canonical id: `cm-7.5` · family `CM` > (a) Identify [software programs]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and (c) Review and update the list of authorized software programs [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/cm-8 # CM-08 System Component Inventory — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-8 Canonical id: `cm-8` · family `CM` > a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other system; 4. Is at the level of granularity deemed necessary for tracking and reporting; and 5. Includes the following information to achieve system component accountability: [information]; and b. Review and update the system component inventory [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Continuous Collaborative Monitoring, Significant Change Notification, Vulnerability Detection and Response, and Vulnerability Evaluation and Reporting rules." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/cm-8.1 # CM-08 (01) Updates During Installation and Removal — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-8.1 Canonical id: `cm-8.1` · family `CM` > Update the inventory of system components as part of component installations, removals, and system updates. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-8.3 # CM-08 (03) Automated Unauthorized Component Detection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-8.3 Canonical id: `cm-8.3` · family `CM` > (a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [organization-defined automated mechanisms] [frequency]; and (b) Take the following actions when unauthorized components are detected: [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-9 # CM-09 Configuration Management Plan — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-9 Canonical id: `cm-9` · family `CM` > Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; c. Defines the configuration items for the system and places the configuration items under configuration management; d. Is reviewed and approved by [personnel or roles]; and e. Protects the configuration management plan from unauthorized disclosure and modification. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-RVP` — Reviewing Change Procedures (Change Management) The effectiveness of documented change management procedures is persistently reviewed. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cm-12 # CM-12 Information Location — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-12 Canonical id: `cm-12` · family `CM` > a. Identify and document the location of [information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access to the system and system components where the information is processed and stored; and c. Document changes to the location (i.e., system or system components) where the information is processed and stored. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Minimum Assessment Scope rules." ] } --- ## https://ramprules.com/control/cm-12.1 # CM-12 (01) Automated Tools to Support Information Location — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cm-12.1 Canonical id: `cm-12.1` · family `CM` > Use automated tools to identify [information by information type] on [system components] to ensure controls are in place to protect organizational information and individual privacy. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Minimum Assessment Scope rules." ] } --- ## https://ramprules.com/control/cp-2 # CP-02 Contingency Plan — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-2 Canonical id: `cp-2` · family `CP` > a. Develop a contingency plan for the system that: 1. Identifies essential mission and business functions and associated contingency requirements; 2. Provides recovery objectives, restoration priorities, and metrics; 3. Addresses contingency roles, responsibilities, assigned individuals with contact information; 4. Addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure; 5. Addresses eventual, full system restoration without deterioration of the controls originally planned and implemented; 6. Addresses the sharing of contingency information; and 7. Is reviewed and approved by [organization-defined personnel or roles]; b. Distribute copies of the contingency plan to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; c. Coordinate contingency planning activities with incident handling activities; d. Review the contingency plan for the system [frequency]; e. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing; f. Communicate contingency plan changes to [organization-defined key contingency personnel (identified by name and/or by role) and organizational elements]; g. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training; and h. Protect the contingency plan from unauthorized disclosure and modification. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-2.1 # CP-02 (01) Coordinate with Related Plans — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-2.1 Canonical id: `cp-2.1` · family `CP` > Coordinate contingency plan development with organizational elements responsible for related plans. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-2.3 # CP-02 (03) Resume Mission and Business Functions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-2.3 Canonical id: `cp-2.3` · family `CP` > Plan for the resumption of [assignment] mission and business functions within [time period] of contingency plan activation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-RRO` — Reviewing Recovery Objectives (Recovery Planning) The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance { "parameters": [ { "parameterId": "cp-02.03_odp.02", "value": "time period defined in service provider and organization Service Level Agreements" } ] } --- ## https://ramprules.com/control/cp-2.8 # CP-02 (08) Identify Critical Assets — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-2.8 Canonical id: `cp-2.8` · family `CP` > Identify critical system assets supporting [assignment] mission and business functions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-GIV` — Generating Inventories (Policy and Inventory) Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-3 # CP-03 Contingency Training — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-3 Canonical id: `cp-3` · family `CP` > a. Provide contingency training to system users consistent with assigned roles and responsibilities: 1. Within [time period] of assuming a contingency role or responsibility; 2. When required by system changes; and 3. [frequency] thereafter; and b. Review and update contingency training content [frequency] and following [events]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-4 # CP-04 Contingency Plan Testing — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-4 Canonical id: `cp-4` · family `CP` > a. Test the contingency plan for the system [frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [organization-defined tests]. b. Review the contingency plan test results; and c. Initiate corrective actions, if needed. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/cp-4.1 # CP-04 (01) Coordinate with Related Plans — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-4.1 Canonical id: `cp-4.1` · family `CP` > Coordinate contingency plan testing with organizational elements responsible for related plans. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-6 # CP-06 Alternate Storage Site — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-6 Canonical id: `cp-6` · family `CP` > a. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information; and b. Ensure that the alternate storage site provides controls equivalent to that of the primary site. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-6.1 # CP-06 (01) Separation from Primary Site — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-6.1 Canonical id: `cp-6.1` · family `CP` > Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-6.3 # CP-06 (03) Accessibility — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-6.3 Canonical id: `cp-6.3` · family `CP` > Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-7 # CP-07 Alternate Processing Site — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-7 Canonical id: `cp-7` · family `CP` > a. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [system operations] for essential mission and business functions within [time period] when the primary processing capabilities are unavailable; b. Make available at the alternate processing site, the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption; and c. Provide controls at the alternate processing site that are equivalent to those at the primary site. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-7.1 # CP-07 (01) Separation from Primary Site — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-7.1 Canonical id: `cp-7.1` · family `CP` > Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance { "guidance": [ "The service provider may determine what is considered a sufficient degree of separation between the primary and alternate processing sites, based on the types of threats that are of concern. For one particular type of threat (i.e., hostile cyber attack), the degree of separation between sites will be less relevant." ] } --- ## https://ramprules.com/control/cp-7.2 # CP-07 (02) Accessibility — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-7.2 Canonical id: `cp-7.2` · family `CP` > Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-7.3 # CP-07 (03) Priority of Service — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-7.3 Canonical id: `cp-7.3` · family `CP` > Develop alternate processing site agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives). _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-8 # CP-08 Telecommunications Services — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-8 Canonical id: `cp-8` · family `CP` > Establish alternate telecommunications services, including necessary agreements to permit the resumption of [system operations] for essential mission and business functions within [time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-8.1 # CP-08 (01) Priority of Service Provisions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-8.1 Canonical id: `cp-8.1` · family `CP` > (a) Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives); and (b) Request Telecommunications Service Priority for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-8.2 # CP-08 (02) Single Points of Failure — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-8.2 Canonical id: `cp-8.2` · family `CP` > Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-9 # CP-09 System Backup — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-9 Canonical id: `cp-9` · family `CP` > a. Conduct backups of user-level information contained in [system components] [frequency]; b. Conduct backups of system-level information contained in the system [frequency]; c. Conduct backups of system documentation, including security- and privacy-related documentation [frequency]; and d. Protect the confidentiality, integrity, and availability of backup information. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-9.1 # CP-09 (01) Testing for Reliability and Integrity — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-9.1 Canonical id: `cp-9.1` · family `CP` > Test backup information [organization-defined frequency] to verify media reliability and information integrity. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-9.8 # CP-09 (08) Cryptographic Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-9.8 Canonical id: `cp-9.8` · family `CP` > Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [backup information]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-10 # CP-10 System Recovery and Reconstitution — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-10 Canonical id: `cp-10` · family `CP` > Provide for the recovery and reconstitution of the system to a known state within [organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. - `KSI-RPL-RRO` — Reviewing Recovery Objectives (Recovery Planning) The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/cp-10.2 # CP-10 (02) Transaction Recovery — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/cp-10.2 Canonical id: `cp-10.2` · family `CP` > Implement transaction recovery for systems that are transaction-based. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. - `KSI-RPL-ARP` — Aligning Recovery Plan (Recovery Planning) The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-2 # IA-02 Identification and Authentication (Organizational Users) — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-2 Canonical id: `ia-2` · family `IA` > Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance { "guidance": [ "Multi-factor authentication must be phishing-resistant. In accordance with current CISA Guidance. Current CISA guidance can be found here: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-2.1 # IA-02 (01) Multi-factor Authentication to Privileged Accounts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-2.1 Canonical id: `ia-2.1` · family `IA` > Implement multi-factor authentication for access to privileged accounts. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance { "guidance": [ "Multi-factor authentication must be phishing-resistant. In accordance with current CISA Guidance. Current CISA guidance can be found here: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-2.2 # IA-02 (02) Multi-factor Authentication to Non-privileged Accounts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-2.2 Canonical id: `ia-2.2` · family `IA` > Implement multi-factor authentication for access to non-privileged accounts. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance { "guidance": [ "Multi-factor authentication must be phishing-resistant. In accordance with current CISA Guidance. Current CISA guidance can be found here: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-2.8 # IA-02 (08) Access to Accounts — Replay Resistant — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-2.8 Canonical id: `ia-2.8` · family `IA` > Implement replay-resistant authentication mechanisms for access to [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance { "parameters": [ { "parameterId": "ia-02.08_odp", "value": "privileged accounts; non-privileged accounts" } ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-3 # IA-03 Device Identification and Authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-3 Canonical id: `ia-3` · family `IA` > Uniquely identify and authenticate [devices and/or types of devices] before establishing a [assignment] connection. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-4 # IA-04 Identifier Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-4 Canonical id: `ia-4` · family `IA` > Manage system identifiers by: a. Receiving authorization from [personnel or roles] to assign an individual, group, role, service, or device identifier; b. Selecting an identifier that identifies an individual, group, role, service, or device; c. Assigning the identifier to the intended individual, group, role, service, or device; and d. Preventing reuse of identifiers for [time period]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-4.4 # IA-04 (04) Identify User Status — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-4.4 Canonical id: `ia-4.4` · family `IA` > Manage individual identifiers by uniquely identifying each individual as [characteristics]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance { "parameters": [ { "parameterId": "ia-04.04_odp", "value": "contractors; foreign nationals" } ] } --- ## https://ramprules.com/control/ia-5 # IA-05 Authenticator Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-5 Canonical id: `ia-5` · family `IA` > Manage system authenticators by: a. Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator; b. Establishing initial authenticator content for any authenticators issued by the organization; c. Ensuring that authenticators have sufficient strength of mechanism for their intended use; d. Establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators; e. Changing default authenticators prior to first use; f. Changing or refreshing authenticators [time period by authenticator type] or when [events] occur; g. Protecting authenticator content from unauthorized disclosure and modification; h. Requiring individuals to take, and having devices implement, specific controls to protect authenticators; and i. Changing authenticators for group or role accounts when membership to those accounts changes. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance { "varies_by_class": { "b": { "guidance": [ "Authenticators must be compliant with the most recent NIST Digital Identity Guidelines IAL, AAL, FAL level 1.", "IA-5 Guidance: FedRAMP requires that authentication assertions be encrypted when passed through third parties, such as a browser. For example, a SAML assertion can be encrypted using XML-Encryption, or an OpenID Connect ID Token can be encrypted using JSON Web Encryption (JWE)." ] }, "c": { "guidance": [ "Authenticators must be compliant with the most recent NIST Digital Identity Guidelines IAL, AAL, FAL level 2.", "IA-5 Guidance: FedRAMP requires that authentication assertions be encrypted when passed through third parties, such as a browser. For example, a SAML assertion can be encrypted using XML-Encryption, or an OpenID Connect ID Token can be encrypted using JSON Web Encryption (JWE)." ] }, "d": { "guidance": [ "Authenticators must be compliant with the most recent NIST Digital Identity Guidelines IAL, AAL, FAL level 3.", "IA-5 Guidance: FedRAMP requires that authentication assertions be encrypted when passed through third parties, such as a browser. For example, a SAML assertion can be encrypted using XML-Encryption, or an OpenID Connect ID Token can be encrypted using JSON Web Encryption (JWE)." ] } }, "updated": [ { "date": "2026-07-14", "comment": "Update guidance to direct users to the latest NIST Digital Identity Guidelines and remove references to specific instances of SP 800-63." } ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ia-5.1 # IA-05 (01) Password-based Authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-5.1 Canonical id: `ia-5.1` · family `IA` > For password-based authentication: (a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [frequency] and when organizational passwords are suspected to have been compromised directly or indirectly; (b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a); (c) Transmit passwords only over cryptographically-protected channels; (d) Store passwords using an approved salted key derivation function, preferably using a keyed hash; (e) Require immediate selection of a new password upon account recovery; (f) Allow user selection of long passwords and passphrases, including spaces and all printable characters; (g) Employ automated tools to assist the user in selecting strong password authenticators; and (h) Enforce the following composition and complexity rules: [composition and complexity rules]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-5.2 # IA-05 (02) Public Key-based Authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-5.2 Canonical id: `ia-5.2` · family `IA` > (a) For public key-based authentication: (1) Enforce authorized access to the corresponding private key; and (2) Map the authenticated identity to the account of the individual or group; and (b) When public key infrastructure (PKI) is used: (1) Validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information; and (2) Implement a local cache of revocation data to support path discovery and validation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. - `KSI-SVC-ASM` — Automating Secret Management (Service Configuration) Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-5.6 # IA-05 (06) Protection of Authenticators — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-5.6 Canonical id: `ia-5.6` · family `IA` > Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SVC-ASM` — Automating Secret Management (Service Configuration) Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-6 # IA-06 Authentication Feedback — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-6 Canonical id: `ia-6` · family `IA` > Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-7 # IA-07 Cryptographic Module Authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-7 Canonical id: `ia-7` · family `IA` > Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-8 # IA-08 Identification and Authentication (Non-organizational Users) — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-8 Canonical id: `ia-8` · family `IA` > Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-11 # IA-11 Re-authentication — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-11 Canonical id: `ia-11` · family `IA` > Require users to re-authenticate when [circumstances or situations]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-12 # IA-12 Identity Proofing — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-12 Canonical id: `ia-12` · family `IA` > a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a unique individual; and c. Collect, validate, and verify identity evidence. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-12.2 # IA-12 (02) Identity Evidence — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-12.2 Canonical id: `ia-12.2` · family `IA` > Require evidence of individual identification be presented to the registration authority. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-12.3 # IA-12 (03) Identity Evidence Validation and Verification — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-12.3 Canonical id: `ia-12.3` · family `IA` > Require that the presented identity evidence be validated and verified through [methods of validation and verification]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ia-12.5 # IA-12 (05) Address Confirmation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ia-12.5 Canonical id: `ia-12.5` · family `IA` > Require that a [assignment] be delivered through an out-of-band channel to verify the users address (physical or digital) of record. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-AAM` — Automating Account Management (Identity and Access Management) The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ir-2 # IR-02 Incident Response Training — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-2 Canonical id: `ir-2` · family `IR` > a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [time period] of assuming an incident response role or responsibility or acquiring system access; 2. When required by system changes; and 3. [frequency] thereafter; and b. Review and update incident response training content [frequency] and following [events]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-2.3 # IR-02 (03) Breach — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-2.3 Canonical id: `ir-2.3` · family `IR` > Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ir-3 # IR-03 Incident Response Testing — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-3 Canonical id: `ir-3` · family `IR` > Test the effectiveness of the incident response capability for the system [frequency] using the following tests: [tests]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-INR-AAR` — Generating After Action Reports (Incident Response) Incident after action reports are generated and lessons learned are persistently incorporated. - `KSI-INR-RPI` — Reviewing Past Incidents (Incident Response) Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ir-3.2 # IR-03 (02) Coordination with Related Plans — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-3.2 Canonical id: `ir-3.2` · family `IR` > Coordinate incident response testing with organizational elements responsible for related plans. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. - `KSI-RPL-TRC` — Testing Recovery Capabilities (Recovery Planning) The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-4 # IR-04 Incident Handling — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-4 Canonical id: `ir-4` · family `IR` > a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-INR-AAR` — Generating After Action Reports (Incident Response) Incident after action reports are generated and lessons learned are persistently incorporated. - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. - `KSI-INR-RPI` — Reviewing Past Incidents (Incident Response) Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ir-4.1 # IR-04 (01) Automated Incident Handling Processes — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-4.1 Canonical id: `ir-4.1` · family `IR` > Support the incident handling process using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-INR-AAR` — Generating After Action Reports (Incident Response) Incident after action reports are generated and lessons learned are persistently incorporated. - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. - `KSI-INR-RPI` — Reviewing Past Incidents (Incident Response) Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/ir-5 # IR-05 Incident Monitoring — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-5 Canonical id: `ir-5` · family `IR` > Track and document incidents. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RPI` — Reviewing Past Incidents (Incident Response) Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-6 # IR-06 Incident Reporting — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-6 Canonical id: `ir-6` · family `IR` > a. Require personnel to report suspected incidents to the organizational incident response capability within [time period]; and b. Report incident information to [authorities]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-6.1 # IR-06 (01) Automated Reporting — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-6.1 Canonical id: `ir-6.1` · family `IR` > Report incidents using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-6.3 # IR-06 (03) Supply Chain Coordination — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-6.3 Canonical id: `ir-6.3` · family `IR` > Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-7 # IR-07 Incident Response Assistance — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-7 Canonical id: `ir-7` · family `IR` > Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-7.1 # IR-07 (01) Automation Support for Availability of Information and Support — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-7.1 Canonical id: `ir-7.1` · family `IR` > Increase the availability of incident response information and support using [automated mechanisms]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-8 # IR-08 Incident Response Plan — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-8 Canonical id: `ir-8` · family `IR` > a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and organization of the incident response capability; 3. Provides a high-level approach for how the incident response capability fits into the overall organization; 4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; 5. Defines reportable incidents; 6. Provides metrics for measuring the incident response capability within the organization; 7. Defines the resources and management support needed to effectively maintain and mature an incident response capability; 8. Addresses the sharing of incident information; 9. Is reviewed and approved by [personnel or roles] [frequency]; and 10. Explicitly designates responsibility for incident response to [entities, personnel, or roles]. b. Distribute copies of the incident response plan to [incident response personnel]; c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing; d. Communicate incident response plan changes to [organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; and e. Protect the incident response plan from unauthorized disclosure and modification. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-AAR` — Generating After Action Reports (Incident Response) Incident after action reports are generated and lessons learned are persistently incorporated. - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. - `KSI-INR-RPI` — Reviewing Past Incidents (Incident Response) Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/ir-8.1 # IR-08 (01) Breaches — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ir-8.1 Canonical id: `ir-8.1` · family `IR` > Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; (b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and (c) Identification of applicable privacy requirements. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ma-2 # MA-02 Controlled Maintenance — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ma-2 Canonical id: `ma-2` · family `MA` > a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c. Require that [personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [information]; e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f. Include the following information in organizational maintenance records: [information]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-LMC` — Logging Changes (Change Management) Modifications to the cloud service offering are logged and monitored. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/pl-8 # PL-08 Security and Privacy Architectures — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/pl-8 Canonical id: `pl-8` · family `PL` > a. Develop security and privacy architectures for the system that: 1. Describe the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information; 2. Describe the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals; 3. Describe how the architectures are integrated into and support the enterprise architecture; and 4. Describe any assumptions about, and dependencies on, external systems and services; b. Review and update the architectures [frequency] to reflect changes in the enterprise architecture; and c. Reflect planned architecture changes in security and privacy plans, Concept of Operations (CONOPS), criticality analysis, organizational procedures, and procurements and acquisitions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/pl-9 # PL-09 Central Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/pl-9 Canonical id: `pl-9` · family `PL` > Centrally manage [controls and related processes]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/pl-10 # PL-10 Baseline Selection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/pl-10 Canonical id: `pl-10` · family `PL` > Select a control baseline for the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-IBP` — Implementing Best Practices (Cloud Native Architecture) The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/pm-3 # PM-03 Information Security and Privacy Resources — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/pm-3 Canonical id: `pm-3` · family `PM` > a. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; b. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and c. Make available for expenditure, the planned information security and privacy resources. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/pm-7 # PM-07 Enterprise Architecture — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/pm-7 Canonical id: `pm-7` · family `PM` > Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-2 # PS-02 Position Risk Designation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-2 Canonical id: `ps-2` · family `PS` > a. Assign a risk designation to all organizational positions; b. Establish screening criteria for individuals filling those positions; and c. Review and update position risk designations [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-3 # PS-03 Personnel Screening — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-3 Canonical id: `ps-3` · family `PS` > a. Screen individuals prior to authorizing access to the system; and b. Rescreen individuals in accordance with [organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-4 # PS-04 Personnel Termination — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-4 Canonical id: `ps-4` · family `PS` > Upon termination of individual employment: a. Disable system access within [time period]; b. Terminate or revoke any authenticators and credentials associated with the individual; c. Conduct exit interviews that include a discussion of [information security topics]; d. Retrieve all security-related organizational system-related property; and e. Retain access to organizational information and systems formerly controlled by terminated individual. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-5 # PS-05 Personnel Transfer — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-5 Canonical id: `ps-5` · family `PS` > a. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization; b. Initiate [transfer or reassignment actions] within [time period following the formal transfer action]; c. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer; and d. Notify [personnel or roles] within [time period]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-6 # PS-06 Access Agreements — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-6 Canonical id: `ps-6` · family `PS` > a. Develop and document access agreements for organizational systems; b. Review and update the access agreements [frequency]; and c. Verify that individuals requiring access to organizational information and systems: 1. Sign appropriate access agreements prior to being granted access; and 2. Re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-7 # PS-07 External Personnel Security — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-7 Canonical id: `ps-7` · family `PS` > a. Establish personnel security requirements, including security roles and responsibilities for external providers; b. Require external providers to comply with personnel security policies and procedures established by the organization; c. Document personnel security requirements; d. Require external providers to notify [personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [time period]; and e. Monitor provider compliance with personnel security requirements. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance { "guidance": [ "CSPs MUST clearly document any nationality requirements for any account type within its platform. If none exists, this must also be explicitly stated." ] } --- ## https://ramprules.com/control/ps-8 # PS-08 Personnel Sanctions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-8 Canonical id: `ps-8` · family `PS` > a. Employ a formal sanctions process for individuals failing to comply with established information security and privacy policies and procedures; and b. Notify [personnel or roles] within [time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-SUS` — Responding to Suspicious Activity (Identity and Access Management) Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ps-9 # PS-09 Position Descriptions — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ps-9 Canonical id: `ps-9` · family `PS` > Incorporate security and privacy roles and responsibilities into organizational position descriptions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ra-3.1 # RA-03 (01) Supply Chain Risk Assessment — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ra-3.1 Canonical id: `ra-3.1` · family `RA` > (a) Assess supply chain risks associated with [systems, system components, and system services]; and (b) Update the supply chain risk assessment [frequency], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/ra-5 # RA-05 Vulnerability Monitoring and Scanning — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ra-5 Canonical id: `ra-5` · family `RA` > a. Monitor and scan for vulnerabilities in the system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; c. Analyze vulnerability scan reports and results from vulnerability monitoring; d. Remediate legitimate vulnerabilities [response times] in accordance with an organizational assessment of risk; e. Share information obtained from the vulnerability monitoring process and control assessments with [personnel or roles] to help eliminate similar vulnerabilities in other systems; and f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/ra-5.5 # RA-05 (05) Privileged Access — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ra-5.5 Canonical id: `ra-5.5` · family `RA` > Implement privileged access authorization to [system components] for [vulnerability scanning activities]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-IAM-SNU` — Securing Non-User Authentication (Identity and Access Management) Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/ra-5.11 # RA-05 (11) Public Disclosure Program — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/ra-5.11 Canonical id: `ra-5.11` · family `RA` > Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RVD` — Reviewing Vulnerability Disclosures (Policy and Inventory) The effectiveness of the provider's vulnerability disclosure program is persistently reviewed. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/sa-2 # SA-02 Allocation of Resources — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-2 Canonical id: `sa-2` · family `SA` > a. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; b. Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and c. Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-3 # SA-03 System Development Life Cycle — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-3 Canonical id: `sa-3` · family `SA` > a. Acquire, develop, and manage the system using [system-development life cycle] that incorporates information security and privacy considerations; b. Define and document information security and privacy roles and responsibilities throughout the system development life cycle; c. Identify individuals having information security and privacy roles and responsibilities; and d. Integrate the organizational information security and privacy risk management process into system development life cycle activities. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-5 # SA-05 System Documentation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-5 Canonical id: `sa-5` · family `SA` > a. Obtain or develop administrator documentation for the system, system component, or system service that describes: 1. Secure configuration, installation, and operation of the system, component, or service; 2. Effective use and maintenance of security and privacy functions and mechanisms; and 3. Known vulnerabilities regarding configuration and use of administrative or privileged functions; b. Obtain or develop user documentation for the system, system component, or system service that describes: 1. User-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms; 2. Methods for user interaction, which enables individuals to use the system, component, or service in a more secure manner and protect individual privacy; and 3. User responsibilities in maintaining the security of the system, component, or service and privacy of individuals; c. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or nonexistent and take [actions] in response; and d. Distribute documentation to [personnel or roles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Secure Configuration Guide rules." ] } --- ## https://ramprules.com/control/sa-8 # SA-08 Security and Privacy Engineering Principles — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-8 Canonical id: `sa-8` · family `SA` > Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [organization-defined systems security and privacy engineering principles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-9 # SA-09 External System Services — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-9 Canonical id: `sa-9` · family `SA` > a. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [controls]; b. Define and document organizational oversight and user roles and responsibilities with regard to external system services; and c. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [processes, methods, and techniques]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sa-10 # SA-10 Developer Configuration Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-10 Canonical id: `sa-10` · family `SA` > Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [assignment]; b. Document, manage, and control the integrity of changes to [configuration items]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [personnel]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-11 # SA-11 Developer Testing and Evaluation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-11 Canonical id: `sa-11` · family `SA` > Require the developer of the system, system component, or system service, at all post-design stages of the system development life cycle, to: a. Develop and implement a plan for ongoing security and privacy control assessments; b. Perform [assignment] testing/evaluation [frequency to conduct] at [depth and coverage]; c. Produce evidence of the execution of the assessment plan and the results of the testing and evaluation; d. Implement a verifiable flaw remediation process; and e. Correct flaws identified during testing and evaluation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-15.3 # SA-15 (03) Criticality Analysis — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-15.3 Canonical id: `sa-15.3` · family `SA` > Require the developer of the system, system component, or system service to perform a criticality analysis: (a) At the following decision points in the system development life cycle: [decision points]; and (b) At the following level of rigor: [organization-defined breadth and depth of criticality analysis]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sa-22 # SA-22 Unsupported System Components — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sa-22 Canonical id: `sa-22` · family `SA` > a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support for unsupported components [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-2 # SC-02 Separation of System and User Functionality — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-2 Canonical id: `sc-2` · family `SC` > Separate user functionality, including user interface services, from system management functionality. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-4 # SC-04 Information in Shared System Resources — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-4 Canonical id: `sc-4` · family `SC` > Prevent unauthorized and unintended information transfer via shared system resources. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. - `KSI-SVC-PRR` — Preventing Residual Risk (Service Configuration) ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-5 # SC-05 Denial-of-service Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-5 Canonical id: `sc-5` · family `SC` > a. [assignment] the effects of the following types of denial-of-service events: [types of denial-of-service events]; and b. Employ the following controls to achieve the denial-of-service objective: [controls by type of denial-of-service event]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-RVP` — Reviewing Protections (Cloud Native Architecture) The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-7 # SC-07 Boundary Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7 Canonical id: `sc-7` · family `SC` > a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [assignment] separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance { "guidance": [ "SC-7 (b) may be met by using any technical capability or complement of capabilities that ensures logical separation between publicly accessible components and internal networks by preventing traversal without inspection and authorization; traffic may not flow unrestricted from publicly accessible components to internal networks." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-7.3 # SC-07 (03) Access Points — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7.3 Canonical id: `sc-7.3` · family `SC` > Limit the number of external network connections to the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/sc-7.4 # SC-07 (04) External Telecommunications Services — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7.4 Canonical id: `sc-7.4` · family `SC` > (a) Implement a managed interface for each external telecommunication service; (b) Establish a traffic flow policy for each managed interface; (c) Protect the confidentiality and integrity of the information being transmitted across each interface; (d) Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need; (e) Review exceptions to the traffic flow policy [frequency] and remove exceptions that are no longer supported by an explicit mission or business need; (f) Prevent unauthorized exchange of control plane traffic with external networks; (g) Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and (h) Filter unauthorized control plane traffic from external networks. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/sc-7.5 # SC-07 (05) Deny by Default — Allow by Exception — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7.5 Canonical id: `sc-7.5` · family `SC` > Deny network communications traffic by default and allow network communications traffic by exception [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-CNA-RNT` — Restricting Network Traffic (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/sc-7.7 # SC-07 (07) Split Tunneling for Remote Devices — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7.7 Canonical id: `sc-7.7` · family `SC` > Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [safeguards]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/sc-7.8 # SC-07 (08) Route Traffic to Authenticated Proxy Servers — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-7.8 Canonical id: `sc-7.8` · family `SC` > Route [internal communications traffic] to [external networks] through authenticated proxy servers at managed interfaces. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/sc-8 # SC-08 Transmission Confidentiality and Integrity — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-8 Canonical id: `sc-8` · family `SC` > Protect the [assignment] of transmitted information. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-8.1 # SC-08 (01) Cryptographic Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-8.1 Canonical id: `sc-8.1` · family `SC` > Implement cryptographic mechanisms to [assignment] during transmission. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-10 # SC-10 Network Disconnect — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-10 Canonical id: `sc-10` · family `SC` > Terminate the network connection associated with a communications session at the end of the session or after [time period] of inactivity. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-CNA-ULN` — Using Logical Networking (Cloud Native Architecture) Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-12 # SC-12 Cryptographic Key Establishment and Management — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-12 Canonical id: `sc-12` · family `SC` > Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [requirements]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SVC-ASM` — Automating Secret Management (Service Configuration) Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-13 # SC-13 Cryptographic Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-13 Canonical id: `sc-13` · family `SC` > a. Determine the [cryptographic uses]; and b. Implement the following types of cryptography required for each specified cryptographic use: [types of cryptography]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Cryptographic Module Use rules." ] } ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-17 # SC-17 Public Key Infrastructure Certificates — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-17 Canonical id: `sc-17` · family `SC` > a. Issue public key certificates under an [certificate policy] or obtain public key certificates from an approved service provider; and b. Include only approved trust anchors in trust stores or certificate stores managed by the organization. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-ASM` — Automating Secret Management (Service Configuration) Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-18 # SC-18 Mobile Code — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-18 Canonical id: `sc-18` · family `SC` > a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-20 # SC-20 Secure Name/Address Resolution Service (Authoritative Source) — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-20 Canonical id: `sc-20` · family `SC` > a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and b. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-21 # SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-21 Canonical id: `sc-21` · family `SC` > Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-22 # SC-22 Architecture and Provisioning for Name/Address Resolution Service — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-22 Canonical id: `sc-22` · family `SC` > Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-23 # SC-23 Session Authenticity — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-23 Canonical id: `sc-23` · family `SC` > Protect the authenticity of communications sessions. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-APM` — Adopting Passwordless Methods (Identity and Access Management) Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. - `KSI-SVC-VCM` — Validating Communications (Service Configuration) - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-28 # SC-28 Protection of Information at Rest — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-28 Canonical id: `sc-28` · family `SC` > Protect the [assignment] of the following information at rest: [information at rest]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/sc-28.1 # SC-28 (01) Cryptographic Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-28.1 Canonical id: `sc-28.1` · family `SC` > Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [system components or media]: [information]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-SIN` — Securing Information (Service Configuration) Information is encrypted or otherwise secured from unwanted access or modification. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sc-39 # SC-39 Process Isolation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sc-39 Canonical id: `sc-39` · family `SC` > Maintain a separate execution domain for each executing system process. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. - `KSI-IAM-JIT` — Authorizing Just-in-Time (Identity and Access Management) A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-2 # SI-02 Flaw Remediation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-2 Canonical id: `si-2` · family `SI` > a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-relevant software and firmware updates within [time period] of the release of the updates; and d. Incorporate flaw remediation into the organizational configuration management process. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CMT-VTD` — Validating Throughout Deployment (Change Management) Persistent testing and validation of changes throughout deployment is automated. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/si-2.2 # SI-02 (02) Automated Flaw Remediation Status — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-2.2 Canonical id: `si-2.2` · family `SI` > Determine if system components have applicable security-relevant software and firmware updates installed using [automated mechanisms] [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/si-3 # SI-03 Malicious Code Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-3 Canonical id: `si-3` · family `SI` > a. Implement [assignment] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; b. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures; c. Configure malicious code protection mechanisms to: 1. Perform periodic scans of the system [frequency] and real-time scans of files from external sources at [assignment] as the files are downloaded, opened, or executed in accordance with organizational policy; and 2. [assignment]; and send alert to [personnel or roles] in response to malicious code detection; and d. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B (in the annual independent assessment) - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CMT-RMV` — Redeploying vs Modifying (Change Management) Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. - `KSI-CNA-DFP` — Defining Functionality and Privileges (Cloud Native Architecture) The functionality and privileges for infrastructure and services are strictly defined. - `KSI-IAM-ELP` — Ensuring Least Privilege (Identity and Access Management) Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class B, C, D. --- ## https://ramprules.com/control/si-4 # SI-04 System Monitoring — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-4 Canonical id: `si-4` · family `SI` > a. Monitor the system to detect: 1. Attacks and indicators of potential attacks in accordance with the following monitoring objectives: [monitoring objectives]; and 2. Unauthorized local, network, and remote connections; b. Identify unauthorized use of the system through the following techniques and methods: [techniques and methods]; c. Invoke internal monitoring capabilities or deploy monitoring devices: 1. Strategically within the system to collect organization-determined essential information; and 2. At ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Analyze detected events and anomalies; e. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or the Nation; f. Obtain legal opinion regarding system monitoring activities; and g. Provide [system monitoring information] to [personnel or roles] [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## FedRAMP guidance { "guidance": [ "Follow all applicable rules within the Vulnerability and Detection Response and Incident Communication Procedure guidance." ] } --- ## https://ramprules.com/control/si-4.2 # SI-04 (02) Automated Tools and Mechanisms for Real-time Analysis — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-4.2 Canonical id: `si-4.2` · family `SI` > Employ automated tools and mechanisms to support near real-time analysis of events. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/si-4.4 # SI-04 (04) Inbound and Outbound Communications Traffic — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-4.4 Canonical id: `si-4.4` · family `SI` > (a) Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic; (b) Monitor inbound and outbound communications traffic [organization-defined frequency] for [organization-defined unusual or unauthorized activities or conditions]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. - `KSI-MLA-RVL` — Reviewing Logs (Monitoring, Logging, and Auditing) Logs are persistently reviewed and audited. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/si-4.5 # SI-04 (05) System-generated Alerts — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-4.5 Canonical id: `si-4.5` · family `SI` > Alert [personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [compromise indicators]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-INR-RIR` — Reviewing Incident Response Procedures (Incident Response) The effectiveness of documented incident response procedures is persistently reviewed. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules." ] } --- ## https://ramprules.com/control/si-5 # SI-05 Security Alerts, Advisories, and Directives — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-5 Canonical id: `si-5` · family `SI` > a. Receive system security alerts, advisories, and directives from [external organizations] on an ongoing basis; b. Generate internal security alerts, advisories, and directives as deemed necessary; c. Disseminate security alerts, advisories, and directives to: [assignment]; and d. Implement security directives in accordance with established time frames, or notify the issuing organization of the degree of noncompliance. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Addressing FedRAMP Communication rules." ] } --- ## https://ramprules.com/control/si-7 # SI-07 Software, Firmware, and Information Integrity — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-7 Canonical id: `si-7` · family `SI` > a. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [organization-defined software, firmware, and information]; and b. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [organization-defined actions]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/si-7.1 # SI-07 (01) Integrity Checks — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-7.1 Canonical id: `si-7.1` · family `SI` > Perform an integrity check of [organization-defined software, firmware, and information] [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. - `KSI-SVC-VCM` — Validating Communications (Service Configuration) - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/si-7.7 # SI-07 (07) Integration of Detection and Response — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-7.7 Canonical id: `si-7.7` · family `SI` > Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [changes]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-MLA-EVC` — Evaluating Configurations (Monitoring, Logging, and Auditing) The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. - `KSI-MLA-LET` — Logging Event Types (Monitoring, Logging, and Auditing) A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. - `KSI-MLA-OSM` — Operating SIEM Capability (Monitoring, Logging, and Auditing) A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-8 # SI-08 Spam Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-8 Canonical id: `si-8` · family `SI` > a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-RNT` — Restricting Network Traffic (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. - `KSI-CNA-RVP` — Reviewing Protections (Cloud Native Architecture) The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed. ## FedRAMP guidance { "guidance": [ "When CSO sends email on behalf of the government as part of the business offering, Control Description should include implementation of Domain-based Message Authentication, Reporting & Conformance (DMARC) on the sending domain for outgoing messages as described in DHS Binding Operational Directive (BOD) 18-01. https://www.cisa.gov/news-events/directives", "SI-8 Guidance: CSPs should confirm DMARC configuration (where appropriate) to ensure that policy=reject and the rua parameter includes reports@dmarc.cyber.dhs.gov. DMARC compliance should be documented in the SI-08 control implementation solution description, and list the FROM: domain(s) when emails are sent on behalf of the government." ] } --- ## https://ramprules.com/control/si-8.2 # SI-08 (02) Automatic Updates — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-8.2 Canonical id: `si-8.2` · family `SI` > Automatically update spam protection mechanisms [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-RVP` — Reviewing Protections (Cloud Native Architecture) The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-10 # SI-10 Information Input Validation — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-10 Canonical id: `si-10` · family `SI` > Check the validity of the following information inputs: [information inputs]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C (in the annual independent assessment) - certification class D (in the annual independent assessment) ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ ## Annual independent assessment In the annual assessment subset for class C, D. --- ## https://ramprules.com/control/si-11 # SI-11 Error Handling — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-11 Canonical id: `si-11` · family `SI` > a. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited; and b. Reveal error messages only to [personnel or roles]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-MLA-ALA` — Authorizing Log Access (Monitoring, Logging, and Auditing) - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-12 # SI-12 Information Management and Retention — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-12 Canonical id: `si-12` · family `SI` > Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-RPL-ABO` — Aligning Backups with Objectives (Recovery Planning) The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-12.3 # SI-12 (03) Information Disposal — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-12.3 Canonical id: `si-12.3` · family `SI` > Use the following techniques to dispose of, destroy, or erase information following the retention period: [organization-defined techniques]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-SVC-RUD` — Removing Unwanted Data (Service Configuration) ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-16 # SI-16 Memory Protection — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-16 Canonical id: `si-16` · family `SI` > Implement the following controls to protect the system memory from unauthorized code execution: [controls]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CNA-MAT` — Minimizing Attack Surface (Cloud Native Architecture) Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. - `KSI-PIY-RSD` — Reviewing Security in the SDLC (Policy and Inventory) The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/si-18.4 # SI-18 (04) Individual Requests — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/si-18.4 Canonical id: `si-18.4` · family `SI` > Correct or delete personally identifiable information upon request by individuals or their designated representatives. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership _In no Rev5 baseline for any certification class._ ## Key Security Indicators that reach it - `KSI-SVC-RUD` — Removing Unwanted Data (Service Configuration) ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sr-2.1 # SR-02 (01) Establish SCRM Team — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-2.1 Canonical id: `sr-2.1` · family `SR` > Establish a supply chain risk management team consisting of [personnel, roles and responsibilities] to lead and support the following SCRM activities: [supply chain risk management activities]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-PIY-RIS` — Reviewing Investments in Security (Policy and Inventory) The effectiveness of the provider's investments in achieving security goals is persistently reviewed. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sr-5 # SR-05 Acquisition Strategies, Tools, and Methods — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-5 Canonical id: `sr-5` · family `SR` > Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [strategies, tools, and methods]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sr-6 # SR-06 Supplier Assessments and Reviews — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-6 Canonical id: `sr-6` · family `SR` > Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [frequency]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MIT` — Mitigating Supply Chain Risk (Supply Chain Risk) Persistently identify, review, and mitigate potential supply chain risks. - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sr-8 # SR-08 Notification Agreements — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-8 Canonical id: `sr-8` · family `SR` > Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [assignment]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SCR-MON` — Monitoring Supply Chain Risk (Supply Chain Risk) Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## FedRAMP guidance { "guidance": [ "Follow the FedRAMP Incident Evaluation and Communication rules." ] } --- ## https://ramprules.com/control/sr-10 # SR-10 Inspection of Systems or Components — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-10 Canonical id: `sr-10` · family `SR` > Inspect the following systems or system components [assignment] to detect tampering: [systems or system components]. _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-SVC-ACM` — Automating Configuration Management (Service Configuration) The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. - `KSI-SVC-EIS` — Evaluating and Improving Security (Service Configuration) Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. - `KSI-SVC-VRI` — Validating Resource Integrity (Service Configuration) Use cryptographic methods to validate the integrity of machine-based information resources. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/control/sr-11.1 # SR-11 (01) Anti-counterfeit Training — NIST 800-53 Rev5 control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /control/sr-11.1 Canonical id: `sr-11.1` · family `SR` > Train [personnel or roles] to detect counterfeit system components (including hardware, software, and firmware). _Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._ ## Rev5 baseline membership - certification class B - certification class C - certification class D ## Key Security Indicators that reach it - `KSI-CED-RAT` — Reviewing All Training (Cybersecurity Education) The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## FedRAMP guidance _No FedRAMP-specific guidance attaches to this control._ --- ## https://ramprules.com/ksi/ksi-ced-rat # KSI-CED-RAT — Reviewing All Training > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-ced-rat Theme: Cybersecurity Education (`CED`) ## Statement The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. ## NIST 800-53 controls it reaches (11) - `AT-02` (AT) — baselines B, C, D - `AT-02 (02)` (AT) — baselines B, C, D - `AT-02 (03)` (AT) — baselines C, D - `AT-03` (AT) — baselines B, C, D - `AT-03 (05)` (AT) — in no class baseline - `AT-04` (AT) — baselines B, C, D - `CP-03` (CP) — baselines B, C, D - `IR-02` (IR) — baselines B, C, D - `IR-02 (03)` (IR) — in no class baseline - `PS-06` (PS) — baselines B, C, D - `SR-11 (01)` (SR) — baselines B, C, D ## Defined terms - **Incident** — Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Vulnerability Response** — The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cmt-lmc # KSI-CMT-LMC — Logging Changes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cmt-lmc Theme: Change Management (`CMT`) ## Statement Modifications to the cloud service offering are logged and monitored. ## NIST 800-53 controls it reaches (7) - `AU-02` (AU) — baselines B, C, D - `CM-03` (CM) — baselines C, D - `CM-03 (02)` (CM) — baselines C, D - `CM-04 (02)` (CM) — baselines C, D - `CM-06` (CM) — baselines B, C, D - `CM-08 (03)` (CM) — baselines C, D - `MA-02` (MA) — baselines B, C, D ## Defined terms - **Cloud Service Offering** — A specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers, that is the subject of a FedRAMP Certification. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cmt-rmv # KSI-CMT-RMV — Redeploying vs Modifying > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cmt-rmv Theme: Change Management (`CMT`) ## Statement Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. ## NIST 800-53 controls it reaches (7) - `CM-02` (CM) — baselines B, C, D - `CM-03` (CM) — baselines C, D - `CM-05` (CM) — baselines B, C, D - `CM-06` (CM) — baselines B, C, D - `CM-07` (CM) — baselines B, C, D - `CM-08 (01)` (CM) — baselines C, D - `SI-03` (SI) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cmt-rvp # KSI-CMT-RVP — Reviewing Change Procedures > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cmt-rvp Theme: Change Management (`CMT`) ## Statement The effectiveness of documented change management procedures is persistently reviewed. ## NIST 800-53 controls it reaches (6) - `CM-03` (CM) — baselines C, D - `CM-03 (02)` (CM) — baselines C, D - `CM-03 (04)` (CM) — baselines C, D - `CM-05` (CM) — baselines B, C, D - `CM-07 (01)` (CM) — baselines C, D - `CM-09` (CM) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cmt-vtd # KSI-CMT-VTD — Validating Throughout Deployment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cmt-vtd Theme: Change Management (`CMT`) ## Statement Persistent testing and validation of changes throughout deployment is automated. ## NIST 800-53 controls it reaches (4) - `CM-03` (CM) — baselines C, D - `CM-03 (02)` (CM) — baselines C, D - `CM-04 (02)` (CM) — baselines C, D - `SI-02` (SI) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Validation** — Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-dfp # KSI-CNA-DFP — Defining Functionality and Privileges > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-dfp Theme: Cloud Native Architecture (`CNA`) ## Statement The functionality and privileges for infrastructure and services are strictly defined. ## NIST 800-53 controls it reaches (2) - `CM-02` (CM) — baselines B, C, D - `SI-03` (SI) — baselines B, C, D ## Defined terms _This indicator's statement uses no FRD-defined term._ ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-eis # KSI-CNA-EIS — Enforcing Intended State > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-eis Theme: Cloud Native Architecture (`CNA`) ## Statement _The statement for this indicator varies by certification class; see the per-class plan rather than a single sentence._ ## NIST 800-53 controls it reaches (2) - `CA-02 (01)` (CA) — baselines B, C, D - `CA-07 (01)` (CA) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-ibp # KSI-CNA-IBP — Implementing Best Practices > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-ibp Theme: Cloud Native Architecture (`CNA`) ## Statement The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance. ## NIST 800-53 controls it reaches (3) - `AC-17 (03)` (AC) — baselines C, D - `CM-02` (CM) — baselines B, C, D - `PL-10` (PL) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Provider** — The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-mat # KSI-CNA-MAT — Minimizing Attack Surface > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-mat Theme: Cloud Native Architecture (`CNA`) ## Statement Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. ## NIST 800-53 controls it reaches (14) - `AC-17 (03)` (AC) — baselines C, D - `AC-18 (01)` (AC) — baselines C, D - `AC-18 (03)` (AC) — baselines C, D - `AC-20 (01)` (AC) — baselines C, D - `CA-09` (CA) — baselines B, C, D - `SC-07 (03)` (SC) — baselines C, D - `SC-07 (04)` (SC) — baselines C, D - `SC-07 (05)` (SC) — baselines C, D - `SC-07 (08)` (SC) — baselines C, D - `SC-08` (SC) — baselines B, C, D - `SC-10` (SC) — baselines C, D - `SI-10` (SI) — baselines C, D - `SI-11` (SI) — baselines C, D - `SI-16` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-ofa # KSI-CNA-OFA — Optimizing for Availability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-ofa Theme: Cloud Native Architecture (`CNA`) ## Statement Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery. ## NIST 800-53 controls it reaches (0) _This indicator maps to no control._ ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-rnt # KSI-CNA-RNT — Restricting Network Traffic > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-rnt Theme: Cloud Native Architecture (`CNA`) ## Statement Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. ## NIST 800-53 controls it reaches (5) - `AC-17 (03)` (AC) — baselines C, D - `CA-09` (CA) — baselines B, C, D - `CM-07 (01)` (CM) — baselines C, D - `SC-07 (05)` (SC) — baselines C, D - `SI-08` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-rvp # KSI-CNA-RVP — Reviewing Protections > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-rvp Theme: Cloud Native Architecture (`CNA`) ## Statement The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed. ## NIST 800-53 controls it reaches (3) - `SC-05` (SC) — baselines B, C, D - `SI-08` (SI) — baselines C, D - `SI-08 (02)` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-cna-uln # KSI-CNA-ULN — Using Logical Networking > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-cna-uln Theme: Cloud Native Architecture (`CNA`) ## Statement Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. ## NIST 800-53 controls it reaches (8) - `AC-12` (AC) — baselines C, D - `AC-17 (03)` (AC) — baselines C, D - `CA-09` (CA) — baselines B, C, D - `SC-04` (SC) — baselines C, D - `SC-07` (SC) — baselines B, C, D - `SC-07 (07)` (SC) — baselines C, D - `SC-08` (SC) — baselines B, C, D - `SC-10` (SC) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-aam # KSI-IAM-AAM — Automating Account Management > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-aam Theme: Identity and Access Management (`IAM`) ## Statement The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. ## NIST 800-53 controls it reaches (9) - `AC-02 (02)` (AC) — baselines C, D - `AC-02 (03)` (AC) — baselines C, D - `AC-02 (13)` (AC) — baselines C, D - `AC-06 (07)` (AC) — baselines C, D - `IA-04 (04)` (IA) — baselines C, D - `IA-12` (IA) — baselines C, D - `IA-12 (02)` (IA) — baselines C, D - `IA-12 (03)` (IA) — baselines C, D - `IA-12 (05)` (IA) — baselines C, D ## Defined terms _This indicator's statement uses no FRD-defined term._ ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-apm # KSI-IAM-APM — Adopting Passwordless Methods > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-apm Theme: Identity and Access Management (`IAM`) ## Statement Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. ## NIST 800-53 controls it reaches (13) - `AC-02` (AC) — baselines B, C, D - `AC-03` (AC) — baselines B, C, D - `IA-02` (IA) — baselines B, C, D - `IA-02 (01)` (IA) — baselines B, C, D - `IA-02 (02)` (IA) — baselines B, C, D - `IA-02 (08)` (IA) — baselines B, C, D - `IA-05` (IA) — baselines B, C, D - `IA-05 (01)` (IA) — baselines B, C, D - `IA-05 (02)` (IA) — baselines C, D - `IA-05 (06)` (IA) — baselines C, D - `IA-06` (IA) — baselines B, C, D - `IA-08` (IA) — baselines B, C, D - `SC-23` (SC) — baselines C, D ## Defined terms _This indicator's statement uses no FRD-defined term._ ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-elp # KSI-IAM-ELP — Ensuring Least Privilege > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-elp Theme: Identity and Access Management (`IAM`) ## Statement Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. ## NIST 800-53 controls it reaches (34) - `AC-02 (05)` (AC) — baselines C, D - `AC-02 (06)` (AC) — in no class baseline - `AC-03` (AC) — baselines B, C, D - `AC-04` (AC) — baselines C, D - `AC-06` (AC) — baselines C, D - `AC-12` (AC) — baselines C, D - `AC-14` (AC) — baselines B, C, D - `AC-17` (AC) — baselines B, C, D - `AC-17 (01)` (AC) — baselines C, D - `AC-17 (02)` (AC) — baselines C, D - `AC-17 (03)` (AC) — baselines C, D - `AC-20` (AC) — baselines B, C, D - `AC-20 (01)` (AC) — baselines C, D - `CM-02 (07)` (CM) — baselines C, D - `CM-09` (CM) — baselines C, D - `IA-02` (IA) — baselines B, C, D - `IA-03` (IA) — baselines C, D - `IA-04` (IA) — baselines B, C, D - `IA-04 (04)` (IA) — baselines C, D - `IA-05 (02)` (IA) — baselines C, D - `IA-05 (06)` (IA) — baselines C, D - `IA-11` (IA) — baselines B, C, D - `PS-02` (PS) — baselines B, C, D - `PS-03` (PS) — baselines B, C, D - `PS-04` (PS) — baselines B, C, D - `PS-05` (PS) — baselines B, C, D - `PS-06` (PS) — baselines B, C, D - `SC-04` (SC) — baselines C, D - `SC-20` (SC) — baselines B, C, D - `SC-21` (SC) — baselines B, C, D - `SC-22` (SC) — baselines B, C, D - `SC-23` (SC) — baselines C, D - `SC-39` (SC) — baselines B, C, D - `SI-03` (SI) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-jit # KSI-IAM-JIT — Authorizing Just-in-Time > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-jit Theme: Identity and Access Management (`IAM`) ## Statement A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. ## NIST 800-53 controls it reaches (38) - `AC-02` (AC) — baselines B, C, D - `AC-02 (01)` (AC) — baselines C, D - `AC-02 (02)` (AC) — baselines C, D - `AC-02 (03)` (AC) — baselines C, D - `AC-02 (04)` (AC) — baselines C, D - `AC-02 (06)` (AC) — in no class baseline - `AC-03` (AC) — baselines B, C, D - `AC-04` (AC) — baselines C, D - `AC-05` (AC) — baselines C, D - `AC-06` (AC) — baselines C, D - `AC-06 (01)` (AC) — baselines C, D - `AC-06 (02)` (AC) — baselines C, D - `AC-06 (05)` (AC) — baselines C, D - `AC-06 (07)` (AC) — baselines C, D - `AC-06 (09)` (AC) — baselines C, D - `AC-06 (10)` (AC) — baselines C, D - `AC-07` (AC) — baselines B, C, D - `AC-17` (AC) — baselines B, C, D - `AC-20 (01)` (AC) — baselines C, D - `AU-09 (04)` (AU) — baselines C, D - `CM-05` (CM) — baselines B, C, D - `CM-07` (CM) — baselines B, C, D - `CM-07 (02)` (CM) — baselines C, D - `CM-07 (05)` (CM) — baselines C, D - `CM-09` (CM) — baselines C, D - `IA-04` (IA) — baselines B, C, D - `IA-04 (04)` (IA) — baselines C, D - `IA-07` (IA) — baselines B, C, D - `PS-02` (PS) — baselines B, C, D - `PS-03` (PS) — baselines B, C, D - `PS-04` (PS) — baselines B, C, D - `PS-05` (PS) — baselines B, C, D - `PS-06` (PS) — baselines B, C, D - `PS-09` (PS) — baselines B, C, D - `RA-05 (05)` (RA) — baselines C, D - `SC-02` (SC) — baselines C, D - `SC-23` (SC) — baselines C, D - `SC-39` (SC) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-snu # KSI-IAM-SNU — Securing Non-User Authentication > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-snu Theme: Identity and Access Management (`IAM`) ## Statement Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. ## NIST 800-53 controls it reaches (7) - `AC-02` (AC) — baselines B, C, D - `AC-02 (02)` (AC) — baselines C, D - `AC-04` (AC) — baselines C, D - `AC-06 (05)` (AC) — baselines C, D - `IA-03` (IA) — baselines C, D - `IA-05 (02)` (IA) — baselines C, D - `RA-05 (05)` (RA) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-iam-sus # KSI-IAM-SUS — Responding to Suspicious Activity > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-iam-sus Theme: Identity and Access Management (`IAM`) ## Statement Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. ## NIST 800-53 controls it reaches (7) - `AC-02` (AC) — baselines B, C, D - `AC-02 (01)` (AC) — baselines C, D - `AC-02 (03)` (AC) — baselines C, D - `AC-02 (13)` (AC) — baselines C, D - `AC-07` (AC) — baselines B, C, D - `PS-04` (PS) — baselines B, C, D - `PS-08` (PS) — baselines B, C, D ## Defined terms - **Vulnerability Response** — The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-inr-aar # KSI-INR-AAR — Generating After Action Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-inr-aar Theme: Incident Response (`INR`) ## Statement Incident after action reports are generated and lessons learned are persistently incorporated. ## NIST 800-53 controls it reaches (4) - `IR-03` (IR) — baselines C, D - `IR-04` (IR) — baselines B, C, D - `IR-04 (01)` (IR) — baselines C, D - `IR-08` (IR) — baselines B, C, D ## Defined terms - **Incident** — Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-inr-rir # KSI-INR-RIR — Reviewing Incident Response Procedures > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-inr-rir Theme: Incident Response (`INR`) ## Statement The effectiveness of documented incident response procedures is persistently reviewed. ## NIST 800-53 controls it reaches (10) - `IR-04` (IR) — baselines B, C, D - `IR-04 (01)` (IR) — baselines C, D - `IR-06` (IR) — baselines B, C, D - `IR-06 (01)` (IR) — baselines C, D - `IR-06 (03)` (IR) — baselines C, D - `IR-07` (IR) — baselines B, C, D - `IR-07 (01)` (IR) — baselines C, D - `IR-08` (IR) — baselines B, C, D - `IR-08 (01)` (IR) — in no class baseline - `SI-04 (05)` (SI) — baselines C, D ## Defined terms - **Incident** — Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Vulnerability Response** — The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-inr-rpi # KSI-INR-RPI — Reviewing Past Incidents > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-inr-rpi Theme: Incident Response (`INR`) ## Statement Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. ## NIST 800-53 controls it reaches (5) - `IR-03` (IR) — baselines C, D - `IR-04` (IR) — baselines B, C, D - `IR-04 (01)` (IR) — baselines C, D - `IR-05` (IR) — baselines B, C, D - `IR-08` (IR) — baselines B, C, D ## Defined terms - **Incident** — Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Vulnerability** — Has the meaning given to "security vulnerability" in 6 USC § 650 (25), which is "any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information." This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional). ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-mla-ala # KSI-MLA-ALA — Authorizing Log Access > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-mla-ala Theme: Monitoring, Logging, and Auditing (`MLA`) ## Statement _The statement for this indicator varies by certification class; see the per-class plan rather than a single sentence._ ## NIST 800-53 controls it reaches (1) - `SI-11` (SI) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-mla-evc # KSI-MLA-EVC — Evaluating Configurations > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-mla-evc Theme: Monitoring, Logging, and Auditing (`MLA`) ## Statement The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. ## NIST 800-53 controls it reaches (4) - `CA-07` (CA) — baselines B, C, D - `CM-02` (CM) — baselines B, C, D - `CM-06` (CM) — baselines B, C, D - `SI-07 (07)` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-mla-let # KSI-MLA-LET — Logging Event Types > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-mla-let Theme: Monitoring, Logging, and Auditing (`MLA`) ## Statement A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. ## NIST 800-53 controls it reaches (10) - `AC-02 (04)` (AC) — baselines C, D - `AC-06 (09)` (AC) — baselines C, D - `AC-17 (01)` (AC) — baselines C, D - `AC-20 (01)` (AC) — baselines C, D - `AU-02` (AU) — baselines B, C, D - `AU-07 (01)` (AU) — baselines C, D - `AU-12` (AU) — baselines B, C, D - `SI-04 (04)` (SI) — baselines C, D - `SI-04 (05)` (SI) — baselines C, D - `SI-07 (07)` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-mla-osm # KSI-MLA-OSM — Operating SIEM Capability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-mla-osm Theme: Monitoring, Logging, and Auditing (`MLA`) ## Statement A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. ## NIST 800-53 controls it reaches (18) - `AC-17 (01)` (AC) — baselines C, D - `AC-20 (01)` (AC) — baselines C, D - `AU-02` (AU) — baselines B, C, D - `AU-03` (AU) — baselines B, C, D - `AU-03 (01)` (AU) — baselines C, D - `AU-04` (AU) — baselines B, C, D - `AU-05` (AU) — baselines B, C, D - `AU-06 (01)` (AU) — baselines C, D - `AU-06 (03)` (AU) — baselines C, D - `AU-07` (AU) — baselines C, D - `AU-07 (01)` (AU) — baselines C, D - `AU-08` (AU) — baselines B, C, D - `AU-09` (AU) — baselines B, C, D - `AU-11` (AU) — baselines B, C, D - `IR-04 (01)` (IR) — baselines C, D - `SI-04 (02)` (SI) — baselines C, D - `SI-04 (04)` (SI) — baselines C, D - `SI-07 (07)` (SI) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-mla-rvl # KSI-MLA-RVL — Reviewing Logs > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-mla-rvl Theme: Monitoring, Logging, and Auditing (`MLA`) ## Statement Logs are persistently reviewed and audited. ## NIST 800-53 controls it reaches (7) - `AC-02 (04)` (AC) — baselines C, D - `AC-06 (09)` (AC) — baselines C, D - `AU-02` (AU) — baselines B, C, D - `AU-06` (AU) — baselines B, C, D - `AU-06 (01)` (AU) — baselines C, D - `SI-04` (SI) — baselines B, C, D - `SI-04 (04)` (SI) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-piy-giv # KSI-PIY-GIV — Generating Inventories > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-piy-giv Theme: Policy and Inventory (`PIY`) ## Statement Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. ## NIST 800-53 controls it reaches (7) - `CM-02 (02)` (CM) — baselines C, D - `CM-07 (05)` (CM) — baselines C, D - `CM-08` (CM) — baselines B, C, D - `CM-08 (01)` (CM) — baselines C, D - `CM-12` (CM) — baselines C, D - `CM-12 (01)` (CM) — baselines C, D - `CP-02 (08)` (CP) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-piy-res # KSI-PIY-RES — Reviewing Executive Support > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-piy-res Theme: Policy and Inventory (`PIY`) ## Statement Executive support for achieving the provider's security goals is persistently reviewed and demonstrated. ## NIST 800-53 controls it reaches (0) _This indicator maps to no control._ ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Provider** — The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-piy-ris # KSI-PIY-RIS — Reviewing Investments in Security > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-piy-ris Theme: Policy and Inventory (`PIY`) ## Statement The effectiveness of the provider's investments in achieving security goals is persistently reviewed. ## NIST 800-53 controls it reaches (9) - `AC-05` (AC) — baselines C, D - `CA-02` (CA) — baselines B, C, D - `CP-02 (01)` (CP) — baselines C, D - `CP-04 (01)` (CP) — baselines C, D - `IR-03 (02)` (IR) — baselines C, D - `PM-03` (PM) — in no class baseline - `SA-02` (SA) — baselines B, C, D - `SA-03` (SA) — baselines B, C, D - `SR-02 (01)` (SR) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Provider** — The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-piy-rsd # KSI-PIY-RSD — Reviewing Security in the SDLC > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-piy-rsd Theme: Policy and Inventory (`PIY`) ## Statement The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. ## NIST 800-53 controls it reaches (12) - `AC-05` (AC) — baselines C, D - `AU-03 (03)` (AU) — in no class baseline - `CM-03 (04)` (CM) — baselines C, D - `PL-08` (PL) — baselines B, C, D - `PM-07` (PM) — in no class baseline - `SA-03` (SA) — baselines B, C, D - `SA-08` (SA) — baselines B, C, D - `SC-04` (SC) — baselines C, D - `SC-18` (SC) — baselines C, D - `SI-10` (SI) — baselines C, D - `SI-11` (SI) — baselines C, D - `SI-16` (SI) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-piy-rvd # KSI-PIY-RVD — Reviewing Vulnerability Disclosures > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-piy-rvd Theme: Policy and Inventory (`PIY`) ## Statement The effectiveness of the provider's vulnerability disclosure program is persistently reviewed. ## NIST 800-53 controls it reaches (1) - `RA-05 (11)` (RA) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Provider** — The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification. - **Vulnerability** — Has the meaning given to "security vulnerability" in 6 USC § 650 (25), which is "any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information." This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional). ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-rpl-abo # KSI-RPL-ABO — Aligning Backups with Objectives > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-rpl-abo Theme: Recovery Planning (`RPL`) ## Statement The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. ## NIST 800-53 controls it reaches (6) - `CM-02 (03)` (CM) — baselines C, D - `CP-06` (CP) — baselines C, D - `CP-09` (CP) — baselines B, C, D - `CP-10` (CP) — baselines B, C, D - `CP-10 (02)` (CP) — baselines C, D - `SI-12` (SI) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-rpl-arp # KSI-RPL-ARP — Aligning Recovery Plan > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-rpl-arp Theme: Recovery Planning (`RPL`) ## Statement The alignment of recovery plans with defined recovery objectives is persistently reviewed. ## NIST 800-53 controls it reaches (16) - `CP-02` (CP) — baselines B, C, D - `CP-02 (01)` (CP) — baselines C, D - `CP-02 (03)` (CP) — baselines C, D - `CP-04 (01)` (CP) — baselines C, D - `CP-06` (CP) — baselines C, D - `CP-06 (01)` (CP) — baselines C, D - `CP-06 (03)` (CP) — baselines C, D - `CP-07` (CP) — baselines C, D - `CP-07 (01)` (CP) — baselines C, D - `CP-07 (02)` (CP) — baselines C, D - `CP-07 (03)` (CP) — baselines C, D - `CP-08` (CP) — baselines C, D - `CP-08 (01)` (CP) — baselines C, D - `CP-08 (02)` (CP) — baselines C, D - `CP-10` (CP) — baselines B, C, D - `CP-10 (02)` (CP) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-rpl-rro # KSI-RPL-RRO — Reviewing Recovery Objectives > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-rpl-rro Theme: Recovery Planning (`RPL`) ## Statement The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities. ## NIST 800-53 controls it reaches (2) - `CP-02 (03)` (CP) — baselines C, D - `CP-10` (CP) — baselines B, C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Provider** — The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-rpl-trc # KSI-RPL-TRC — Testing Recovery Capabilities > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-rpl-trc Theme: Recovery Planning (`RPL`) ## Statement The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. ## NIST 800-53 controls it reaches (10) - `CP-02 (01)` (CP) — baselines C, D - `CP-02 (03)` (CP) — baselines C, D - `CP-04` (CP) — baselines B, C, D - `CP-04 (01)` (CP) — baselines C, D - `CP-06` (CP) — baselines C, D - `CP-06 (01)` (CP) — baselines C, D - `CP-09 (01)` (CP) — baselines C, D - `CP-10` (CP) — baselines B, C, D - `IR-03` (IR) — baselines C, D - `IR-03 (02)` (IR) — baselines C, D ## Defined terms - **Incident** — Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies." - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-scr-mit # KSI-SCR-MIT — Mitigating Supply Chain Risk > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-scr-mit Theme: Supply Chain Risk (`SCR`) ## Statement Persistently identify, review, and mitigate potential supply chain risks. ## NIST 800-53 controls it reaches (12) - `AC-20` (AC) — baselines B, C, D - `CA-07 (04)` (CA) — baselines B, C, D - `RA-03 (01)` (RA) — baselines B, C, D - `SA-09` (SA) — baselines B, C, D - `SA-10` (SA) — baselines C, D - `SA-11` (SA) — baselines C, D - `SA-15 (03)` (SA) — baselines C, D - `SA-22` (SA) — baselines B, C, D - `SC-18` (SC) — baselines C, D - `SI-07 (01)` (SI) — baselines C, D - `SR-05` (SR) — baselines B, C, D - `SR-06` (SR) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-scr-mon # KSI-SCR-MON — Monitoring Supply Chain Risk > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-scr-mon Theme: Supply Chain Risk (`SCR`) ## Statement Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. ## NIST 800-53 controls it reaches (10) - `AC-20` (AC) — baselines B, C, D - `CA-03` (CA) — baselines B, C, D - `IR-06 (03)` (IR) — baselines C, D - `PS-07` (PS) — baselines B, C, D - `RA-05` (RA) — baselines B, C, D - `SA-09` (SA) — baselines B, C, D - `SI-05` (SI) — baselines B, C, D - `SR-05` (SR) — baselines B, C, D - `SR-06` (SR) — baselines C, D - `SR-08` (SR) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Vulnerability** — Has the meaning given to "security vulnerability" in 6 USC § 650 (25), which is "any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information." This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional). ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-acm # KSI-SVC-ACM — Automating Configuration Management > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-acm Theme: Service Configuration (`SVC`) ## Statement The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. ## NIST 800-53 controls it reaches (11) - `AC-02 (04)` (AC) — baselines C, D - `CM-02` (CM) — baselines B, C, D - `CM-02 (02)` (CM) — baselines C, D - `CM-02 (03)` (CM) — baselines C, D - `CM-06` (CM) — baselines B, C, D - `CM-07 (01)` (CM) — baselines C, D - `PL-09` (PL) — in no class baseline - `PL-10` (PL) — baselines B, C, D - `SA-05` (SA) — baselines B, C, D - `SI-05` (SI) — baselines B, C, D - `SR-10` (SR) — baselines B, C, D ## Defined terms - **Drift** — Changes to information resources that cause deviations from the intended and assessed state; common forms of drift include changes to configurations, deployed software, privileges, running processes, and availability. - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-asm # KSI-SVC-ASM — Automating Secret Management > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-asm Theme: Service Configuration (`SVC`) ## Statement Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. ## NIST 800-53 controls it reaches (5) - `AC-17 (02)` (AC) — baselines C, D - `IA-05 (02)` (IA) — baselines C, D - `IA-05 (06)` (IA) — baselines C, D - `SC-12` (SC) — baselines B, C, D - `SC-17` (SC) — baselines C, D ## Defined terms - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Regularly** — Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different activities. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-eis # KSI-SVC-EIS — Evaluating and Improving Security > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-eis Theme: Service Configuration (`SVC`) ## Statement Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. ## NIST 800-53 controls it reaches (9) - `CM-07 (01)` (CM) — baselines C, D - `CM-12 (01)` (CM) — baselines C, D - `MA-02` (MA) — baselines B, C, D - `PL-08` (PL) — baselines B, C, D - `SC-07` (SC) — baselines B, C, D - `SC-39` (SC) — baselines B, C, D - `SI-02 (02)` (SI) — baselines C, D - `SI-04` (SI) — baselines B, C, D - `SR-10` (SR) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-prr # KSI-SVC-PRR — Preventing Residual Risk > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-prr Theme: Service Configuration (`SVC`) ## Statement _The statement for this indicator varies by certification class; see the per-class plan rather than a single sentence._ ## NIST 800-53 controls it reaches (1) - `SC-04` (SC) — baselines C, D ## Defined terms - **Federal Customer Data** — All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider. - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Likely** — A reasonable degree of probability based on context. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-rud # KSI-SVC-RUD — Removing Unwanted Data > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-rud Theme: Service Configuration (`SVC`) ## Statement _The statement for this indicator varies by certification class; see the per-class plan rather than a single sentence._ ## NIST 800-53 controls it reaches (2) - `SI-12 (03)` (SI) — in no class baseline - `SI-18 (04)` (SI) — in no class baseline ## Defined terms - **Agency** — Has the meaning given in 44 U.S. Code § 3502 (1), which is "any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—(A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities." - **Federal Customer Data** — All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider. - **Promptly** — Without unnecessary delay. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-sin # KSI-SVC-SIN — Securing Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-sin Theme: Service Configuration (`SVC`) ## Statement Information is encrypted or otherwise secured from unwanted access or modification. ## NIST 800-53 controls it reaches (12) - `AC-01` (AC) — baselines B, C, D - `AC-17 (02)` (AC) — baselines C, D - `CP-09 (08)` (CP) — baselines C, D - `SC-08` (SC) — baselines B, C, D - `SC-08 (01)` (SC) — baselines B, C, D - `SC-13` (SC) — baselines B, C, D - `SC-20` (SC) — baselines B, C, D - `SC-21` (SC) — baselines B, C, D - `SC-22` (SC) — baselines B, C, D - `SC-23` (SC) — baselines C, D - `SC-28` (SC) — baselines B, C, D - `SC-28 (01)` (SC) — baselines B, C, D ## Defined terms _This indicator's statement uses no FRD-defined term._ ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-vcm # KSI-SVC-VCM — Validating Communications > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-vcm Theme: Service Configuration (`SVC`) ## Statement _The statement for this indicator varies by certification class; see the per-class plan rather than a single sentence._ ## NIST 800-53 controls it reaches (2) - `SC-23` (SC) — baselines C, D - `SI-07 (01)` (SI) — baselines C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Persistently** — Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known. - **Validation** — Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/ksi/ksi-svc-vri # KSI-SVC-VRI — Validating Resource Integrity > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /ksi/ksi-svc-vri Theme: Service Configuration (`SVC`) ## Statement Use cryptographic methods to validate the integrity of machine-based information resources. ## NIST 800-53 controls it reaches (7) - `CM-02 (02)` (CM) — baselines C, D - `CM-08 (03)` (CM) — baselines C, D - `SC-13` (SC) — baselines B, C, D - `SC-23` (SC) — baselines C, D - `SI-07` (SI) — baselines C, D - `SI-07 (01)` (SI) — baselines C, D - `SR-10` (SR) — baselines B, C, D ## Defined terms - **Information Resource** — Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc. - **Machine-Based (Information Resources)** — Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation. - **Validation** — Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering. ## Default artifacts owed by every indicator - Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator. - Explanation of the cycle for any measures that are implemented persistently (if applicable). - Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted. - Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure. - Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. --- ## https://ramprules.com/requirement/afc-cso-ack # AFC-CSO-ACK — Acknowledge Receipt > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-ack Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-cra # AFC-CSO-CRA — Complete Required Actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-cra Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-emr # AFC-CSO-EMR — Emergency Message Routing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-emr Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Configuration settings for FSI mailbox","scope":"all","class":null,"source":"requirement"} - {"text":"Automated validation to check FSI mailbox configuration","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-ima # AFC-CSO-IMA — Important Message Actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-ima Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD complete the required actions in Important designated messages sent by FedRAMP within the timeframe specified in the message. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-inb # AFC-CSO-INB — Maintain a FedRAMP Security Inbox > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-inb Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI). ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Email address to receive messages from FedRAMP","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-noc # AFC-CSO-NOC — Notification of Changes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-noc Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Process, manual or automated, to notify FedRAMP of changes in the FedRAMP Security Inbox","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AFC-CSO-NOC","documentKey":"AFC","requirementName":"Notification of Changes","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51829466938011","name":"[CSP] Notification of Changes"} --- ## https://ramprules.com/requirement/afc-cso-rcv # AFC-CSO-RCV — Receive Email Without Disruption > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-rcv Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-cso-tfg # AFC-CSO-TFG — Trust @fedramp.gov and @gsa.gov > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-cso-tfg Addressing FedRAMP Communication (`AFC`) · group all · subset CSO Force: MUST ## Statement Providers MUST treat any email originating from an @fedramp.gov or @gsa.gov email address as if it was sent from FedRAMP by default; if such a message is confirmed to originate from someone other than FedRAMP then the FedRAMP Security Inbox rules no longer apply. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Configuration settings for FSI mailbox","scope":"all","class":null,"source":"requirement"} - {"text":"Automated validation to check FSI mailbox configuration","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-cds # AFC-FRP-CDS — Criticality Designators > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-cds Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST convey the criticality of the message in the subject line, IF the message requires an elevated reaction, using one of the following designators: ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-cor # AFC-FRP-COR — Explain Corrective Actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-cor Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST clearly specify the corrective actions that will result from failure to complete the required actions in the body of messages that require an elevated reaction; such actions may vary from negative ratings in the FedRAMP Marketplace to suspension of FedRAMP Certification depending on the severity of the event. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-ert # AFC-FRP-ERT — Elevated Reaction Timeframes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-ert Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST clearly specify the expected timeframe for completing required actions in the body of messages that require an elevated reaction; timeframes for actions will vary depending on the situation but the default timeframes to provide an estimated resolution time for Emergency and Emergency Test designated messages will be as follows: ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-pnt # AFC-FRP-PNT — Public Notice of Emergency Tests > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-pnt Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST post a public notice at least 10 business days in advance of sending an Emergency Test message; such notices MUST include explanation of the likely expected actions and timeframes for the Emergency Test message. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"AFC-FRP-PNT","documentKey":"AFC","documentName":"Addressing FedRAMP Communication","group":"all","subset":"FRP","name":"Public Notice of Emergency Tests","statement":"FedRAMP MUST post a public notice at least 10 business days in advance of sending an Emergency Test message; such notices MUST include explanation of the likely expected actions and timeframes for the Emergency Test message.","force":"MUST","affects":["FedRAMP"],"class":null,"num":10,"type":"bizdays","sortKey":336} ## Notifications - {"requirementId":"AFC-FRP-PNT","documentKey":"AFC","requirementName":"Public Notice of Emergency Tests","party":"Everyone","method":"web","target":"https://www.fedramp.gov/notices","name":"FedRAMP Public Notices"} --- ## https://ramprules.com/requirement/afc-frp-rpm # AFC-FRP-RPM — Reaction Metrics > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-rpm Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MAY ## Statement FedRAMP MAY track and publicly share the time required by cloud service providers to take the actions specified in messages that require an elevated reaction. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-rqa # AFC-FRP-RQA — Required Actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-rqa Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST clearly specify the required actions in the body of messages that require an elevated reaction. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-ufs # AFC-FRP-UFS — Use FedRAMP_Security Email in Emergencies > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-ufs Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST send Emergency and Emergency Test designated messages from fedramp_security@gsa.gov OR fedramp_security@fedramp.gov. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/afc-frp-vre # AFC-FRP-VRE — Verified Emails > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/afc-frp-vre Addressing FedRAMP Communication (`AFC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST send messages to cloud service providers using an official @fedramp.gov or @gsa.gov email address with properly configured Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication Reporting and Conformance (DMARC) email authentication. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-agc-aip # AGU-AGC-AIP — Agency Internal Policies > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-aip Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST ## Statement Agencies MUST maintain agency-wide policy that aligns with the requirements in OMB Memorandum M-24-15. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-agc-grc # AGU-AGC-GRC — Governance, Risk, and Compliance Tools > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-grc Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST ## Statement Agencies MUST ensure that internal governance, risk, compliance, and inventory tools can produce and ingest machine-readable artifacts using formats identified by FedRAMP, including at least: ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-agc-lia # AGU-AGC-LIA — Agency Liaison Program > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-lia Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: SHOULD ## Statement Agencies SHOULD assign at least 1 federal employee to be an active participant in the FedRAMP Agency Liaison program. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-agc-naa # AGU-AGC-NAA — Notify FedRAMP After Authorization > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-naa Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST ## Statement Agencies MUST notify FedRAMP upon authorizing the use of a cloud service within the scope of FedRAMP, supplying at least the following information: ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-AGC-NAA","documentKey":"AGU","requirementName":"Notify FedRAMP After Authorization","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51447926193691","name":"Submit an ATO Letter"} --- ## https://ramprules.com/requirement/agu-agc-nai # AGU-AGC-NAI — Notify Additional Information Requests > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-nai Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST ## Statement Agencies MUST notify FedRAMP after requesting any additional information or materials from a FedRAMP Certified cloud service offering beyond those required by FedRAMP. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-AGC-NAI","documentKey":"AGU","requirementName":"Notify Additional Information Requests","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51822364715035","name":"[For Agencies] Additional Information, Security Requirements, or Certification Change, or After Request Form"} --- ## https://ramprules.com/requirement/agu-agc-nar # AGU-AGC-NAR — No Additional Security Requirements > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-nar Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST NOT ## Statement Agencies MUST NOT require additional information or materials from FedRAMP Certified cloud service offerings beyond those required by FedRAMP UNLESS the head of the agency or an authorized delegate determines there is a demonstrable need and notifies FedRAMP; this does not apply to seeking clarification or asking general questions about FedRAMP Certification Data. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-AGC-NAR","documentKey":"AGU","requirementName":"No Additional Security Requirements","party":"FedRAMP","method":"email","target":"info@fedramp.gov","name":"info@fedramp.gov"} --- ## https://ramprules.com/requirement/agu-agc-sin # AGU-AGC-SIN — Shared FedRAMP Inbox > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-sin Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: SHOULD ## Statement Agencies SHOULD establish and maintain a dedicated shared FedRAMP agency inbox to serve as the official point of contact for communications between FedRAMP and the agency. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-agc-tpp # AGU-AGC-TPP — No Certification Type or Path Preferences > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-tpp Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: MUST NOT ## Statement Agencies MUST NOT require cloud service offerings to obtain or maintain a specific FedRAMP Certification Type or FedRAMP Certification Path, UNLESS the head of the agency or an authorized delegate determines there is a demonstrable need and notifies FedRAMP. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-AGC-TPP","documentKey":"AGU","requirementName":"No Certification Type or Path Preferences","party":"FedRAMP","method":"email","target":"info@fedramp.gov","name":"info@fedramp.gov"} --- ## https://ramprules.com/requirement/agu-agc-wkg # AGU-AGC-WKG — FedRAMP Working Groups > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-agc-wkg Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset AGC Force: SHOULD ## Statement Agencies SHOULD participate in FedRAMP working groups, communities of practice, and stakeholder engagements to supply feedback and align practices across government. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-spn-mrc # AGU-SPN-MRC — Most Recent Consolidated Rules > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-spn-mrc Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset SPN Force: MUST ## Statement Agencies MUST follow the most recent FedRAMP Consolidated Rules when initiating agency-sponsored FedRAMP Certification. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Rev5 Path: Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-abu # AGU-USE-ABU — Authorization Before Use > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-abu Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: MUST ## Statement Agencies MUST complete the Authorization to Operate process for federal information systems that use FedRAMP Certified cloud service offerings. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-afr # AGU-USE-AFR — Accept FedRAMP Rules > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-afr Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: MUST ## Statement Agencies MUST allow FedRAMP Certified cloud service offerings to follow FedRAMP rules. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-cla # AGU-USE-CLA — Using FedRAMP Class A Certifications > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-cla Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: SHOULD NOT ## Statement Agencies SHOULD NOT authorize the use of a FedRAMP Class A Certified cloud service offering for more than 12 months UNLESS the cloud service offering is actively seeking a FedRAMP Class B, C, or D Certification. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-dso # AGU-USE-DSO — Designate Senior Official > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-dso Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: SHOULD ## Statement Agencies SHOULD designate a federal senior information security official to review Ongoing Certification Reports and represent the agency at Quarterly Reviews for cloud service offerings included in agency information systems. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-nfc # AGU-USE-NFC — Notify FedRAMP of Monitoring Concerns > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-nfc Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: MUST ## Statement Agencies MUST notify FedRAMP if information presented in an Ongoing Certification Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-USE-NFC","documentKey":"AGU","requirementName":"Notify FedRAMP of Monitoring Concerns","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51821301979547","name":"Report Concerns on Ongoing Certifications"} --- ## https://ramprules.com/requirement/agu-use-npc # AGU-USE-NPC — Notify Provider of Concerns > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-npc Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: SHOULD ## Statement Agencies SHOULD formally notify the cloud service provider if information presented in an Ongoing Certification Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"AGU-USE-NPC","documentKey":"AGU","requirementName":"Notify Provider of Concerns","party":"Provider","method":"varies","target":"varies by provider","name":"The provider's security contact email or form."} --- ## https://ramprules.com/requirement/agu-use-rcf # AGU-USE-RCF — Resolve Certification Package Conflicts > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-rcf Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: MUST ## Statement Agencies MUST collaborate with FedRAMP when discrepancies or conflicts arise between agency-specific security determinations and the FedRAMP Certification Package. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-rir # AGU-USE-RIR — Review All Information Resources > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-rir Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: SHOULD ## Statement Agencies SHOULD consider third-party information resources used by the cloud service offering during initial and ongoing authorization activities. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-ror # AGU-USE-ROR — Review Ongoing Certification Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-ror Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: SHOULD ## Statement Agencies SHOULD review each Ongoing Certification Report to understand how changes to the cloud service offering may impact the risk tolerance documented in the agency Authorization to Operate for the federal information system that includes the cloud service offering in its boundary. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/agu-use-rsg # AGU-USE-RSG — Review Secure Configuration Guides > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/agu-use-rsg Agency Use of FedRAMP Certified Cloud Services (`AGU`) · group all · subset USE Force: MUST ## Statement Agencies MUST review the Secure Configuration Guides supplied by Providers and configure relevant security settings. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-agm-csc # CCM-AGM-CSC — Consider Security Category > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-agm-csc Collaborative Continuous Monitoring (`CCM`) · group all · subset AGM Force: SHOULD ## Statement Agencies SHOULD consider the Security Category noted in their Authorization to Operate of the federal information system that includes the cloud service offering in its boundary and assign appropriate information security resources for reviewing Ongoing Certification Reports, attending Quarterly Reviews, and other ongoing FedRAMP Certification Data. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-agm-ror # CCM-AGM-ROR — Review Ongoing Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-agm-ror Collaborative Continuous Monitoring (`CCM`) · group all · subset AGM Force: MUST ## Statement Agencies MUST review each Ongoing Certification Report to understand how changes to the cloud service offering may impact the previously agreed-upon risk tolerance documented in the agency's Authorization to Operate of a federal information system that includes the cloud service offering in its boundary. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-afs # CCM-OCR-AFS — Anonymized Feedback Summary > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-afs Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MUST ## Statement Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"How the summary will be delivered","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-avl # CCM-OCR-AVL — Report Availability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-avl Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MUST ## Statement Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Ongoing Certification Report (CCM-OCR-AVL) — https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json ## Artifacts - {"text":"Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.","scope":"all","class":null,"source":"requirement"} - {"text":"How the report will be delivered","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-fbm # CCM-OCR-FBM — Feedback Mechanism > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-fbm Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MUST ## Statement Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"How to access the feedback mechanism.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-lsi # CCM-OCR-LSI — Limit Sensitive Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-lsi Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MUST NOT ## Statement Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-nrd # CCM-OCR-NRD — Next Report Date > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-nrd Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MUST ## Statement Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-rps # CCM-OCR-RPS — Responsible Public Certification Report Sharing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-rps Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: MAY ## Statement Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-ocr-sor # CCM-OCR-SOR — Spread Out Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-ocr-sor Collaborative Continuous Monitoring (`CCM`) · group all · subset OCR Force: SHOULD ## Statement Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-act # CCM-QTR-ACT — Additional Content > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-act Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: SHOULD ## Statement Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-mtg # CCM-QTR-MTG — Quarterly Review Meeting > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-mtg Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"selected ordinal recurrence for the synchronous Quarterly Review cycle if applicable.","scope":"all","class":"a","source":"requirement"} - {"text":"selected ordinal recurrence for the Ongoing Certification Report cycle if applicable OR explanation for why Ongoing Certification Reports are not being delivered.","scope":"all","class":"b","source":"requirement"} - {"text":"selected ordinal recurrence for the Ongoing Certification Report cycle.","scope":"all","class":"c","source":"requirement"} - {"text":"selected ordinal recurrence for the Ongoing Certification Report cycle.","scope":"all","class":"d","source":"requirement"} ## Timeframes - {"requirementId":"CCM-QTR-MTG","documentKey":"CCM","documentName":"Collaborative Continuous Monitoring","group":"all","subset":"QTR","name":"Quarterly Review Meeting","statement":"Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MAY","affects":["Providers"],"class":"a","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"CCM-QTR-MTG","documentKey":"CCM","documentName":"Collaborative Continuous Monitoring","group":"all","subset":"QTR","name":"Quarterly Review Meeting","statement":"Providers with Class B Certifications SHOULD host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"SHOULD","affects":["Providers"],"class":"b","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"CCM-QTR-MTG","documentKey":"CCM","documentName":"Collaborative Continuous Monitoring","group":"all","subset":"QTR","name":"Quarterly Review Meeting","statement":"Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","affects":["Providers"],"class":"c","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"CCM-QTR-MTG","documentKey":"CCM","documentName":"Collaborative Continuous Monitoring","group":"all","subset":"QTR","name":"Quarterly Review Meeting","statement":"Providers with Class D Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","affects":["Providers"],"class":"d","num":3,"type":"months","sortKey":2191.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-nid # CCM-QTR-NID — No Irresponsible Disclosure > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-nid Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: MUST NOT ## Statement Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-nrd # CCM-QTR-NRD — Next Review Date > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-nrd Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: MUST ## Statement Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-reg # CCM-QTR-REG — Meeting Registration Info > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-reg Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: MUST ## Statement Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"URL to the registration page or calendar file.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-rtp # CCM-QTR-RTP — Restrict Third Parties > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-rtp Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: SHOULD NOT ## Statement Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-rtr # CCM-QTR-RTR — Record/Transcribe Reviews > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-rtr Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: SHOULD ## Statement Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-sar # CCM-QTR-SAR — Schedule Around Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-sar Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: SHOULD ## Statement Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-scr # CCM-QTR-SCR — Share Content Responsibly > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-scr Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: MAY ## Statement Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ccm-qtr-srr # CCM-QTR-SRR — Share Recordings Responsibly > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ccm-qtr-srr Collaborative Continuous Monitoring (`CCM`) · group all · subset QTR Force: MAY ## Statement Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-csf-tcm # CDS-CSF-TCM — Trust Center Migration > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-csf-tcm Certification Data Sharing (`CDS`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST notify all necessary parties when migrating to a trust center and MUST provide information in their existing USDA Connect Community Portal secure folders explaining how to use the trust center to obtain FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"CDS-CSF-TCM","documentKey":"CDS","requirementName":"Trust Center Migration","party":"FedRAMP","method":"email","target":"info@fedramp.gov","name":"info@fedramp.gov"} - {"requirementId":"CDS-CSF-TCM","documentKey":"CDS","requirementName":"Trust Center Migration","party":"Agency Customers","method":"varies","target":"varies by agency","name":"Agency Security Contact"} --- ## https://ramprules.com/requirement/cds-cso-avr # CDS-CSO-AVR — Availability Reporting > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-avr Certification Data Sharing (`CDS`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-cbf # CDS-CSO-CBF — Consistency Between Formats > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-cbf Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-fid # CDS-CSO-FID — Always Include FedRAMP ID > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-fid Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST always include the FedRAMP ID of the related cloud service offering in all FedRAMP Certification Data once assigned, including all reports, notifications, and other communication that results from FedRAMP rules. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-frc # CDS-CSO-FRC — FedRAMP Certification Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-frc Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"CDS-CSO-FRC","documentKey":"CDS","documentName":"Certification Data Sharing","group":"all","subset":"CSO","name":"FedRAMP Certification Reports","statement":"Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP.","force":"MUST","affects":["Providers"],"class":null,"num":2,"type":"weeks","sortKey":336} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-had # CDS-CSO-HAD — Historical FedRAMP Certification Data > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-had Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply snapshots of FedRAMP Certification Data aligned to Ongoing Certification Reports to all necessary parties; these snapshots MUST be available for the duration of FedRAMP Certification. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-irp # CDS-CSO-IRP — Include Relevant Policies > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-irp Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply all relevant policies and procedures in the FedRAMP Certification Data, including a human-readable and machine-readable reference that explains at least the following about each included policy and procedure: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-psm # CDS-CSO-PSM — Per-Service Certification Materials > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-psm Certification Data Sharing (`CDS`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of the supplied materials, including how to access and use them.","scope":"all","class":"a","source":"requirement"} - {"text":"Explanation of the supplied materials, including how to access and use them.","scope":"all","class":"b","source":"requirement"} - {"text":"Explanation of the supplied materials, including how to access and use them.","scope":"all","class":"c","source":"requirement"} - {"text":"Explanation of the supplied materials, including how to access and use them.","scope":"all","class":"d","source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-pub # CDS-CSO-PUB — Public Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-pub Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts - {"text":"URL to the human-readable data.","scope":"all","class":null,"source":"requirement"} - {"text":"URL to the machine-readable data.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-ris # CDS-CSO-RIS — Responsible Information Sharing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-ris Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-rps # CDS-CSO-RPS — Responsible Public Package Sharing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-rps Certification Data Sharing (`CDS`) · group all · subset CSO Force: MAY ## Statement Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly or with other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of if and how this information is shared with other parties.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-svc # CDS-CSO-SVC — Public Service List > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-svc Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts - {"text":"URL to the human-readable data.","scope":"all","class":null,"source":"requirement"} - {"text":"URL to the machine-readable data (if applicable).","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-cso-utc # CDS-CSO-UTC — Use Trust Centers > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-cso-utc Certification Data Sharing (`CDS`) · group all · subset CSO Force: MUST ## Statement Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-aai # CDS-TRC-AAI — Agency Access Inventory > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-aai Certification Data Sharing (`CDS`) · group all · subset TRC Force: MUST ## Statement Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how FedRAMP can obtain this information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-acl # CDS-TRC-ACL — Access Logging > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-acl Certification Data Sharing (`CDS`) · group all · subset TRC Force: MUST ## Statement Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how the appropriate parties can obtain this log information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-hmr # CDS-TRC-HMR — Human and Machine-Readable Certification Data > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-hmr Certification Data Sharing (`CDS`) · group all · subset TRC Force: SHOULD ## Statement Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-pac # CDS-TRC-PAC — Programmatic Access > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-pac Certification Data Sharing (`CDS`) · group all · subset TRC Force: MUST ## Statement Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"URL to the documentation for programmatic access.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-ssm # CDS-TRC-SSM — Self-Service Access Management > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-ssm Certification Data Sharing (`CDS`) · group all · subset TRC Force: SHOULD ## Statement Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"URL or explanation how to access documentation of these features and capabilities.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-trc-ush # CDS-TRC-USH — Uninterrupted Sharing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-trc-ush Certification Data Sharing (`CDS`) · group all · subset TRC Force: MUST ## Statement Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cds-utc-aad # CDS-UTC-AAD — Agency Access Denial > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-utc-aad Certification Data Sharing (`CDS`) · group all · subset UTC Force: MUST ## Statement Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"CDS-UTC-AAD","documentKey":"CDS","documentName":"Certification Data Sharing","group":"all","subset":"UTC","name":"Agency Access Denial","statement":"Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data.","force":"MUST","affects":["Providers"],"class":null,"num":5,"type":"bizdays","sortKey":168} ## Notifications - {"requirementId":"CDS-UTC-AAD","documentKey":"CDS","requirementName":"Agency Access Denial","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51829826617243","name":"[CSP] Agency Access Denial"} --- ## https://ramprules.com/requirement/cds-utc-aga # CDS-UTC-AGA — Agency Access > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cds-utc-aga Certification Data Sharing (`CDS`) · group all · subset UTC Force: SHOULD ## Statement Providers SHOULD supply access to the FedRAMP Certification Package with agencies upon request. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"URL or explanation of how to request these materials.","scope":"all","class":null,"source":"requirement"} - {"text":"Explanation of how the provider decides whether or not to share these materials or other related policies.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cmu-cso-cat # CMU-CSO-CAT — Configuration of Agency Tenants > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cmu-cso-cat Cryptographic Module Use (`CMU`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD configure agency tenants by default to use cryptographic services that use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when such modules are available. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"List of cryptographic modules used by default including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cmu-cso-cmd # CMU-CSO-CMD — Cryptographic Module Documentation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cmu-cso-cmd Cryptographic Module Use (`CMU`) · group all · subset CSO Force: MUST ## Statement Providers MUST document the cryptographic modules used in each service (or groups of services that use the same modules) where cryptographic services are used to protect federal customer data, including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cmu-cso-uvm # CMU-CSO-UVM — Using Validated Cryptographic Modules > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cmu-cso-uvm Cryptographic Module Use (`CMU`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":"a","source":"requirement"} - {"text":"List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":"b","source":"requirement"} - {"text":"List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":"c","source":"requirement"} - {"text":"List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","scope":"all","class":"d","source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cpo-csf-cpm # CPO-CSF-CPM — Certification Package Maintenance for Rev5 > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cpo-csf-cpm Certification Package Overview (`CPO`) · group rev5 · subset CSF Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class D Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every six months.","force":"MUST","affects":["Providers"],"class":"d","num":6,"type":"months","sortKey":4383} - {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class B Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every year.","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"years","sortKey":8766} - {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every year.","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"years","sortKey":8766} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cpo-cso-mtd # CPO-CSO-MTD — Certification Package Overview Metadata > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cpo-cso-mtd Certification Package Overview (`CPO`) · group all · subset CSO Force: MUST ## Statement Providers MUST also include the following basic metadata in their Certification Package Overview: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cpo-cso-osa # CPO-CSO-OSA — Overall Summary of Assessment in Certification Package > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cpo-cso-osa Certification Package Overview (`CPO`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cpo-cso-ovr # CPO-CSO-OVR — Overview of the Cloud Service Offering > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cpo-cso-ovr Certification Package Overview (`CPO`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply a Certification Package Overview within their FedRAMP Certification Package, in both human-readable and JSON formats, that includes at least all of the information required by the following rules: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview Schema — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/cpo-csx-cpm # CPO-CSX-CPM — Certification Package Maintenance for 20x > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/cpo-csx-cpm Certification Package Overview (`CPO`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"CPO-CSX-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","statement":"Providers with 20x Class D Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every week.","force":"MUST","affects":["Providers"],"class":"d","num":1,"type":"weeks","sortKey":168} - {"requirementId":"CPO-CSX-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","statement":"Providers with 20x Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 2 weeks.","force":"MUST","affects":["Providers"],"class":"c","num":2,"type":"weeks","sortKey":336} - {"requirementId":"CPO-CSX-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","statement":"Providers with 20x Class B Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every month.","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"months","sortKey":730.5} - {"requirementId":"CPO-CSX-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","statement":"Providers with 20x Class A Certifications SHOULD persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 3 months.","force":"SHOULD","affects":["Providers"],"class":"a","num":3,"type":"months","sortKey":2191.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-app-afc # FRC-APP-AFC — Applying for FedRAMP Certification > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-afc FedRAMP Certification (`FRC`) · group all · subset APP Force: MUST ## Statement Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"FRC-APP-AFC","documentKey":"FRC","requirementName":"Applying for FedRAMP Certification","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51137131584283","name":"[For CSPs] FedRAMP Certification Application Form"} --- ## https://ramprules.com/requirement/frc-app-fcp # FRC-APP-FCP — Fresh FedRAMP Certification Package > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-fcp FedRAMP Certification (`FRC`) · group all · subset APP Force: MUST ## Statement Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-app-fia # FRC-APP-FIA — Fresh Independent Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-fia FedRAMP Certification (`FRC`) · group all · subset APP Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"FRC-APP-FIA","documentKey":"FRC","documentName":"FedRAMP Certification","group":"all","subset":"APP","name":"Fresh Independent Assessment","statement":"Providers seeking Class A Certification MAY supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MAY","affects":["Providers"],"class":"a","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"FRC-APP-FIA","documentKey":"FRC","documentName":"FedRAMP Certification","group":"all","subset":"APP","name":"Fresh Independent Assessment","statement":"Providers seeking Class B Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","affects":["Providers"],"class":"b","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"FRC-APP-FIA","documentKey":"FRC","documentName":"FedRAMP Certification","group":"all","subset":"APP","name":"Fresh Independent Assessment","statement":"Providers seeking Class C Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","affects":["Providers"],"class":"c","num":3,"type":"months","sortKey":2191.5} - {"requirementId":"FRC-APP-FIA","documentKey":"FRC","documentName":"FedRAMP Certification","group":"all","subset":"APP","name":"Fresh Independent Assessment","statement":"Providers seeking Class D Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","affects":["Providers"],"class":"d","num":3,"type":"months","sortKey":2191.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-app-mlf # FRC-APP-MLF — Marketplace Listing First > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-mlf FedRAMP Certification (`FRC`) · group all · subset APP Force: MUST ## Statement Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-app-ntp # FRC-APP-NTP — No Third-Party Applicants > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-ntp FedRAMP Certification (`FRC`) · group all · subset APP Force: MUST NOT ## Statement Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-app-usa # FRC-APP-USA — Updating Stale Assessments > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-app-usa FedRAMP Certification (`FRC`) · group all · subset APP Force: MAY ## Statement Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-aps-ato # FRC-APS-ATO — Agency Authorization to Operate > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-aps-ato FedRAMP Certification (`FRC`) · group all · subset APS Force: MUST ## Statement Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has sent over official government channels to FedRAMP. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Rev5 Path: Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-ccl-dcc # FRC-CCL-DCC — Downgrading Certification Class > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-ccl-dcc FedRAMP Certification (`FRC`) · group all · subset CCL Force: MUST ## Statement Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Rev5 Path: Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-ccl-dnp # FRC-CCL-DNP — Downgrade Notification Period > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-ccl-dnp FedRAMP Certification (`FRC`) · group all · subset CCL Force: SHOULD ## Statement Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Rev5 Path: Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-ccl-ucc # FRC-CCL-UCC — Upgrading Certification Class > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-ccl-ucc FedRAMP Certification (`FRC`) · group all · subset CCL Force: MUST ## Statement Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Rev5 Path: Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-asf # FRC-CLA-ASF — Approved Alternative Security Frameworks > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-asf FedRAMP Certification (`FRC`) · group all · subset CLA Force: MUST ## Statement Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-eam # FRC-CLA-EAM — External Assessment Materials > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-eam FedRAMP Certification (`FRC`) · group all · subset CLA Force: MUST ## Statement Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-ivv # FRC-CLA-IVV — Optional Independent Verification and Validation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-ivv FedRAMP Certification (`FRC`) · group all · subset CLA Force: MAY ## Statement Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-mfr # FRC-CLA-MFR — Mandatory FedRAMP Rules for Class A > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-mfr FedRAMP Certification (`FRC`) · group all · subset CLA Force: MUST ## Statement Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-ofr # FRC-CLA-OFR — Address Optional FedRAMP Rules for Class A > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-ofr FedRAMP Certification (`FRC`) · group all · subset CLA Force: MAY ## Statement Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable): ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cla-rfr # FRC-CLA-RFR — Recommended FedRAMP Rules for Class A > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cla-rfr FedRAMP Certification (`FRC`) · group all · subset CLA Force: SHOULD ## Statement Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable): ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x Path: Program ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csf-acp # FRC-CSF-ACP — Assign Control Parameters > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csf-acp FedRAMP Certification (`FRC`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST assign all organization-defined control parameters, following FedRAMP Rev5 Controls Guidance, and ensure that all control parameter assignments are documented in the Security Decision Record (SDR). ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csf-bsl # FRC-CSF-BSL — FedRAMP Rev5 Baselines > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csf-bsl FedRAMP Certification (`FRC`) · group rev5 · subset CSF Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csf-ffg # FRC-CSF-FFG — Follow FedRAMP Rev5 Controls Guidance > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csf-ffg FedRAMP Certification (`FRC`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST follow FedRAMP Rev5 Controls Guidance for the implementation and documentation of all applicable controls. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csf-rdy # FRC-CSF-RDY — FedRAMP Ready Conversion > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csf-rdy FedRAMP Certification (`FRC`) · group rev5 · subset CSF Force: MUST ## Statement Providers with FedRAMP Rev5 Ready status MUST convert to a FedRAMP Certification by whichever of the follow dates is later: the expiration of their annual assessment or November 17, 2026 (the legacy FedRAMP Ready status will be entirely removed on December 31, 2027). ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cso-fcp # FRC-CSO-FCP — FedRAMP Certification Profile > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cso-fcp FedRAMP Certification (`FRC`) · group all · subset CSO Force: MUST ## Statement Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cso-jsn # FRC-CSO-JSN — FedRAMP JSON Schemas > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cso-jsn FedRAMP Certification (`FRC`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cso-mra # FRC-CSO-MRA — Maintain Responsibility and Accountability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cso-mra FedRAMP Certification (`FRC`) · group all · subset CSO Force: MUST ## Statement Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cso-pkg # FRC-CSO-PKG — FedRAMP Certification Package > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cso-pkg FedRAMP Certification (`FRC`) · group all · subset CSO Force: MUST ## Statement Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-cso-pop # FRC-CSO-POP — Pick One Program Certification Type > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-cso-pop FedRAMP Certification (`FRC`) · group all · subset CSO Force: MUST NOT ## Statement Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csx-mas # FRC-CSX-MAS — Application within MAS > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csx-mas FedRAMP Certification (`FRC`) · group 20x · subset CSX Force: SHOULD ## Statement Providers SHOULD apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csx-mot # FRC-CSX-MOT — Metrics Over Time for Key Security Indicators > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csx-mot FedRAMP Certification (`FRC`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csx-vvk # FRC-CSX-VVK — Automated Verification and Validation of Key Security Indicators > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csx-vvk FedRAMP Certification (`FRC`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/frc-csx-vvr # FRC-CSX-VVR — Automated Verification and Validation of FedRAMP Rules > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/frc-csx-vvr FedRAMP Certification (`FRC`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/iec-cso-air # IEC-CSO-AIR — Automated Incident Reporting > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-air Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD use automation to minimize human intervention in the process of reporting FedRAMP Reportable Incidents to all affected parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/iec-cso-dpr # IEC-CSO-DPR — Default PAIN Rating > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-dpr Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: MUST ## Statement Providers MUST treat FedRAMP Reportable Incidents as if they have a Potential Agency Impact N-rating (PAIN) of 5 UNLESS they promptly estimate the PAIN rating following the rule in IEC-CSO-EFI (Estimate Federal Impact). ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/iec-cso-efi # IEC-CSO-EFI — Estimate Federal Impact > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-efi Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD promptly estimate the likely adverse impact of an incident on agency customers to assign a Potential Agency Impact N-rating; this step is called Incident Rating. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR) — https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json ## Artifacts - {"text":"An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/iec-cso-efr # IEC-CSO-EFR — Evaluate FedRAMP Reportability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-efr Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: MUST ## Statement Providers MUST promptly evaluate incidents to determine if they affect confidentiality or integrity of federal customer data or are likely to affect confidentiality or integrity of federal customer data; such incidents are FedRAMP Reportable Incidents and must be reported following the FedRAMP Incident Evaluation and Communication rules. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/iec-cso-fir # IEC-CSO-FIR — Final Incident Report > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-fir Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR) — https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json ## Artifacts - {"text":"An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"a","source":"requirement"} - {"text":"An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"b","source":"requirement"} - {"text":"An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"c","source":"requirement"} - {"text":"An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"d","source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"IEC-CSO-FIR","documentKey":"IEC","requirementName":"Final Incident Report","party":"FedRAMP","method":"email","target":"fedramp_security@fedramp.gov","name":"fedramp_security@fedramp.gov"} - {"requirementId":"IEC-CSO-FIR","documentKey":"IEC","requirementName":"Final Incident Report","party":"Agency Customers","method":"varies","target":"varies by agency","name":"Follow agency-specific incident reporting procedures"} - {"requirementId":"IEC-CSO-FIR","documentKey":"IEC","requirementName":"Final Incident Report","party":"All Necessary Parties","method":"update","target":"trust center","name":"Provider's Trust Center or USDA Connect"} --- ## https://ramprules.com/requirement/iec-cso-iir # IEC-CSO-IIR — Initial Incident Report > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-iir Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR) — https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json ## Artifacts - {"text":"An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"a","source":"requirement"} - {"text":"An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"b","source":"requirement"} - {"text":"An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"c","source":"requirement"} - {"text":"An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"d","source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"IEC-CSO-IIR","documentKey":"IEC","requirementName":"Initial Incident Report","party":"FedRAMP","method":"email","target":"fedramp_security@fedramp.gov","name":"fedramp_security@fedramp.gov"} - {"requirementId":"IEC-CSO-IIR","documentKey":"IEC","requirementName":"Initial Incident Report","party":"Agency Customers","method":"varies","target":"varies by agency","name":"Follow agency-specific incident reporting procedures"} - {"requirementId":"IEC-CSO-IIR","documentKey":"IEC","requirementName":"Initial Incident Report","party":"All Necessary Parties","method":"update","target":"trust center","name":"Provider's Trust Center or USDA Connect"} --- ## https://ramprules.com/requirement/iec-cso-oir # IEC-CSO-OIR — Ongoing Incident Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-cso-oir Incident Evaluation and Communication (`IEC`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR) — https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json ## Artifacts - {"text":"An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"a","source":"requirement"} - {"text":"An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"b","source":"requirement"} - {"text":"An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"c","source":"requirement"} - {"text":"An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources.","scope":"all","class":"d","source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"IEC-CSO-OIR","documentKey":"IEC","requirementName":"Ongoing Incident Reports","party":"FedRAMP","method":"email","target":"fedramp_security@fedramp.gov","name":"fedramp_security@fedramp.gov"} - {"requirementId":"IEC-CSO-OIR","documentKey":"IEC","requirementName":"Ongoing Incident Reports","party":"Agency Customers","method":"varies","target":"varies by agency","name":"Follow agency-specific incident reporting procedures"} - {"requirementId":"IEC-CSO-OIR","documentKey":"IEC","requirementName":"Ongoing Incident Reports","party":"All Necessary Parties","method":"update","target":"trust center","name":"Provider's Trust Center or USDA Connect"} --- ## https://ramprules.com/requirement/iec-frp-orv # IEC-FRP-ORV — Ongoing Review > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/iec-frp-orv Incident Evaluation and Communication (`IEC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST periodically review FedRAMP Incident Evaluation and Communication implementation with providers based on lack of reporting or other information. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-csf-acf # IVV-CSF-ACF — Assessment of Rev5 Controls with Findings > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-csf-acf Independent Verification and Validation (`IVV`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST have Rev5 Controls with negative findings from the previous FedRAMP independent assessment included in the next FedRAMP independent assessment. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-csf-aia # IVV-CSF-AIA — Annual Independent Assessments for Rev5 > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-csf-aia Independent Verification and Validation (`IVV`) · group rev5 · subset CSF Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"IVV-CSF-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"rev5","subset":"CSF","name":"Annual Independent Assessments for Rev5","statement":"Providers with Rev5 Class B Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSF-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"rev5","subset":"CSF","name":"Annual Independent Assessments for Rev5","statement":"Providers with Rev5 Class C Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSF-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"rev5","subset":"CSF","name":"Annual Independent Assessments for Rev5","statement":"Providers with Rev5 Class D Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:","force":"MUST","affects":["Providers"],"class":"d","num":1,"type":"years","sortKey":8766} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-csf-mca # IVV-CSF-MCA — Mandatory Control Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-csf-mca Independent Verification and Validation (`IVV`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST have all applicable Rev5 Controls included in FedRAMP independent assessments every 3 years but are not required to have all Rev5 Controls included in the same FedRAMP independent assessment. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-csf-pca # IVV-CSF-PCA — Preferred Control Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-csf-pca Independent Verification and Validation (`IVV`) · group rev5 · subset CSF Force: SHOULD ## Statement Providers SHOULD include all applicable Rev5 Controls in each FedRAMP independent assessment. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-dus # IVV-CSO-DUS — Document Use of Representative Samples > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-dus Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MUST ## Statement Providers MUST document and explain the use of representative samples during verification and validation when using representative samples as allowed by IVV-CSO-USR (Use Representative Samples). ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-fia # IVV-CSO-FIA — FedRAMP Independent Assessments > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-fia Independent Verification and Validation (`IVV`) · group all · subset CSO Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"IVV-CSO-FIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"all","subset":"CSO","name":"FedRAMP Independent Assessments","statement":"Providers with Class A Certifications MAY persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MAY","affects":["Providers"],"class":"a","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSO-FIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"all","subset":"CSO","name":"FedRAMP Independent Assessments","statement":"Providers with Class B Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSO-FIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"all","subset":"CSO","name":"FedRAMP Independent Assessments","statement":"Providers with Class C Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSO-FIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"all","subset":"CSO","name":"FedRAMP Independent Assessments","statement":"Providers with Class D Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","affects":["Providers"],"class":"d","num":1,"type":"years","sortKey":8766} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-icp # IVV-CSO-ICP — Inclusion in Certification Package > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-icp Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply the results of FedRAMP independent assessments in their FedRAMP Certification Package without inappropriate modification. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-raa # IVV-CSO-RAA — Receiving Assessor Advice > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-raa Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MAY ## Statement Providers MAY ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-see # IVV-CSO-SEE — Supply Evidence of Effectiveness > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-see Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply evidence to all necessary assessors of the effectiveness of the measures that have been implemented to meet FedRAMP Practices; this evidence is the result of validation. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-sei # IVV-CSO-SEI — Supply Evidence of Implementation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-sei Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply evidence to all necessary assessors of the implementation of the measures that have been documented to meet FedRAMP Practices; this evidence is the result of verification. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-ste # IVV-CSO-STE — Supply Technical Explanations > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-ste Independent Verification and Validation (`IVV`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD supply all necessary assessors with technical explanations, demonstrations, and other relevant supporting information about the technical capabilities they employ to address FedRAMP rules; this SHOULD be supplied as necessary to ensure the assessor can effectively complete verification and validation. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-cso-usr # IVV-CSO-USR — Use Representative Samples > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-cso-usr Independent Verification and Validation (`IVV`) · group all · subset CSO Force: MAY ## Statement Providers MAY use representative samples as appropriate during verification and validation. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-csx-aia # IVV-CSX-AIA — Annual Independent Assessments for 20x > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-csx-aia Independent Verification and Validation (`IVV`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"IVV-CSX-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"20x","subset":"CSX","name":"Annual Independent Assessments for 20x","statement":"Providers with 20x Class B Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSX-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"20x","subset":"CSX","name":"Annual Independent Assessments for 20x","statement":"Providers with 20x Class C Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"years","sortKey":8766} - {"requirementId":"IVV-CSX-AIA","documentKey":"IVV","documentName":"Independent Verification and Validation","group":"20x","subset":"CSX","name":"Annual Independent Assessments for 20x","statement":"Providers with 20x Class D Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","affects":["Providers"],"class":"d","num":1,"type":"years","sortKey":8766} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-epx # IVV-IAS-EPX — Engage Provider Experts > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-epx Independent Verification and Validation (`IVV`) · group all · subset IAS Force: SHOULD ## Statement Assessors SHOULD engage provider experts in discussion to understand the decisions made by the provider and inform expert qualitative assessment, and SHOULD perform independent research to test such information as part of the expert qualitative assessment process. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-osa # IVV-IAS-OSA — Overall Summary of Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-osa Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MUST ## Statement Assessors MUST supply the provider with an overall summary of the verification and validation assessment results, including any resulting failures or areas of dispute; this summary will be included by the provider in the FedRAMP Certification Package Overview for the cloud service offering. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-sha # IVV-IAS-SHA — Sharing Advice > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-sha Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MAY ## Statement Assessors MAY share advice with providers they are assessing about techniques and procedures that will improve the provider's security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-sum # IVV-IAS-SUM — Assessment Summary > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-sum Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MUST ## Statement Assessors MUST supply the provider with a high-level summary of their assessment process and findings for each FedRAMP Practice; this summary will be included by the provider in the FedRAMP Security Decision Record for the cloud service offering. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-vef # IVV-IAS-VEF — Validate Effectiveness > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-vef Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MUST ## Statement Assessors MUST validate the effectiveness of the implemented measures to ensure they have the intended outcome for meeting FedRAMP Practices. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-vim # IVV-IAS-VIM — Verify Implementation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-vim Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MUST ## Statement Assessors MUST verify that the measures implemented by the cloud service offering matches the measures they documented to meet FedRAMP Practices. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ivv-ias-vip # IVV-IAS-VIP — Verify Inclusion in Certification Package > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ivv-ias-vip Independent Verification and Validation (`IVV`) · group all · subset IAS Force: MUST ## Statement Assessors MUST verify that information supplied during a FedRAMP independent assessment is included in the FedRAMP Certification Package by the provider without inappropriate modification. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mas-cso-flo # MAS-CSO-FLO — Information Flows and Security Categories > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mas-cso-flo Minimum Assessment Scope (`MAS`) · group all · subset CSO Force: MUST ## Statement Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"A machine readable output containing all required data of the permitted connections between components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","scope":"all","class":null,"source":"requirement"} - {"text":"A human readable explanation of how the machine readable output is derived.","scope":"all","class":null,"source":"requirement"} - {"text":"The code for the automated process used to generate the machine readable output.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mas-cso-iir # MAS-CSO-IIR — Identify Information Resources > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mas-cso-iir Minimum Assessment Scope (`MAS`) · group all · subset CSO Force: MUST ## Statement Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"A machine readable output containing all required data of the components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","scope":"all","class":null,"source":"requirement"} - {"text":"A human readable explanation of how the machine readable output is derived.","scope":"all","class":null,"source":"requirement"} - {"text":"The code for the automated process used to generate the machine readable output.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mas-cso-mdi # MAS-CSO-MDI — Metadata Inclusion > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mas-cso-mdi Minimum Assessment Scope (`MAS`) · group all · subset CSO Force: MUST ## Statement Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"A machine readable output containing all required data of the metadata collected or maintained by the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","scope":"all","class":null,"source":"requirement"} - {"text":"A human readable explanation of how the machine readable output is derived.","scope":"all","class":null,"source":"requirement"} - {"text":"The code for the automated process used to generate the machine readable output.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mas-cso-sup # MAS-CSO-SUP — Supplemental Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mas-cso-sup Minimum Assessment Scope (`MAS`) · group all · subset CSO Force: MAY ## Statement Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly marked and separated from the cloud service offering. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mas-cso-tpr # MAS-CSO-TPR — Third-Party Information Resources > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mas-cso-tpr Minimum Assessment Scope (`MAS`) · group all · subset CSO Force: MUST ## Statement Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts - {"text":"A machine readable output containing all required data of the third-party information resources of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","scope":"all","class":null,"source":"requirement"} - {"text":"A human readable explanation of how the machine readable output is derived.","scope":"all","class":null,"source":"requirement"} - {"text":"The code for the automated process used to generate the machine readable output.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-cas-lrq # MKT-CAS-LRQ — Listing Requests for Advisors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-cas-lrq Marketplace Listing (`MKT`) · group all · subset CAS Force: MUST ## Statement Advisors MUST complete the Advisor Listing Request Form to request listing in the FedRAMP Marketplace. ## Who it binds - Advisors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"MKT-CAS-LRQ","documentKey":"MKT","requirementName":"Listing Requests for Advisors","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52060327520795","name":"[For Assessors/Advisors] Marketplace Listing Form"} --- ## https://ramprules.com/requirement/mkt-cas-rfr # MKT-CAS-RFR — Advisor Responses to FedRAMP > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-cas-rfr Marketplace Listing (`MKT`) · group all · subset CAS Force: MUST ## Statement Advisors MUST reply to all requests from @fedramp.gov or @gsa.gov email addresses sent to the contact information provided in their advisor listing within 5 business days. ## Who it binds - Advisors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-cas-web # MKT-CAS-WEB — Website Requirements for Advisors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-cas-web Marketplace Listing (`MKT`) · group all · subset CAS Force: MUST ## Statement Advisors MUST have an appropriate web site that publicly supplies at least the following information in consistent machine-readable and human-readable formats: ## Who it binds - Advisors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form FedRAMP Advisory Service Information Schema — https://fedramp.gov/schemas/fedramp-advisor-information-schema-2026-06-24.json ## Artifacts - {"text":"URL to the human-readable data.","scope":"all","class":null,"source":"requirement"} - {"text":"URL to the machine-readable data.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-cso-mlr # MKT-CSO-MLR — Marketplace Listing Requirements > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-cso-mlr Marketplace Listing (`MKT`) · group all · subset CSO Force: MUST ## Statement Providers MUST address at least these FedRAMP rules to apply for a new FedRAMP Marketplace listing OR to request updates to an existing listing: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-cso-pml # MKT-CSO-PML — Provider Marketplace Listing Requests > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-cso-pml Marketplace Listing (`MKT`) · group all · subset CSO Force: MUST ## Statement Providers MUST notify FedRAMP using the FedRAMP Marketplace Providing Listing Request Form to request a listing in the FedRAMP Marketplace. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"MKT-CSO-PML","documentKey":"MKT","requirementName":"Provider Marketplace Listing Requests","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=50939227168027","name":"FedRAMP Marketplace Provider Listing Request Form"} --- ## https://ramprules.com/requirement/mkt-frp-sof # MKT-FRP-SOF — Scope of FedRAMP > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-frp-sof Marketplace Listing (`MKT`) · group all · subset FRP Force: MUST NOT ## Statement FedRAMP MUST NOT list cloud service offerings in the Marketplace or perform any FedRAMP Certification activities unless it determines the cloud service offering is within the scope of FedRAMP. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-ias-lrq # MKT-IAS-LRQ — Listing Requests for Assessors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-ias-lrq Marketplace Listing (`MKT`) · group all · subset IAS Force: MUST ## Statement Assessors MUST complete the Assessor Listing Request Form to request listing in the FedRAMP Marketplace. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications - {"requirementId":"MKT-IAS-LRQ","documentKey":"MKT","requirementName":"Listing Requests for Assessors","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52060327520795","name":"[For Assessors/Advisors] Marketplace Listing Form"} --- ## https://ramprules.com/requirement/mkt-ias-ofr # MKT-IAS-OFR — Only FedRAMP Recognized Assessors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-ias-ofr Marketplace Listing (`MKT`) · group all · subset IAS Force: MUST ## Statement Assessors MUST obtain and maintain FedRAMP Recognition to be listed in the FedRAMP Marketplace. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-ias-web # MKT-IAS-WEB — Website Requirements for Assessors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-ias-web Marketplace Listing (`MKT`) · group all · subset IAS Force: MUST ## Statement Assessors MUST have an appropriate web site that publicly supplies at least the following information in human-readable and JSON formats: ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form FedRAMP Assessor Information Schema — https://fedramp.gov/schemas/fedramp-assessor-information-schema-2026-06-24.json ## Artifacts - {"text":"URL to the human-readable data.","scope":"all","class":null,"source":"requirement"} - {"text":"URL to the machine-readable data.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-iip-agu # MKT-IIP-AGU — Agency Use Cases > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-iip-agu Marketplace Listing (`MKT`) · group all · subset IIP Force: MUST ## Statement Providers MUST demonstrate that a cloud service offering is intended for one of the following use cases: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-iip-dcp # MKT-IIP-DCP — Demonstrating Continuous Progress > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-iip-dcp Marketplace Listing (`MKT`) · group all · subset IIP Force: MUST ## Statement Providers MUST demonstrate continuous progress towards a FedRAMP Certification, documented in their Trust Center or website and updated at least quarterly; progress is measured by the provider against documented goals and milestones. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/mkt-iip-dla # MKT-IIP-DLA — Deadline for Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/mkt-iip-dla Marketplace Listing (`MKT`) · group all · subset IIP Force: MUST ## Statement Providers MUST demonstrate that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing in the Initial Implementation Phase. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-frp-drd # REC-FRP-DRD — Double Revocation Disqualification > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-frp-drd FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset FRP Force: MUST NOT ## Statement FedRAMP MUST NOT restore FedRAMP Recognition for an assessor after FedRAMP has revoked that assessor's FedRAMP Recognition 2 times. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-frp-foc # REC-FRP-FOC — Foreign Ownership Collection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-frp-foc FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset FRP Force: MUST ## Statement FedRAMP MUST maintain a process to collect foreign ownership, control, or influence declarations from FedRAMP Recognized assessors and updates to those declarations. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-frp-rao # REC-FRP-RAO — Recognized Assessors Only > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-frp-rao FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset FRP Force: MUST NOT ## Statement FedRAMP MUST NOT accept verification, validation, or other attestations from independent assessors who are not FedRAMP Recognized. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-acc # REC-IAS-ACC — A2LA Accreditation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-acc FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST obtain and maintain accreditation through the American Association for Laboratory Accreditation (A2LA) Cybersecurity Inspection Body Program to qualify for FedRAMP Recognition. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-ada # REC-IAS-ADA — Actually Do Assessments > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-ada FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST complete at least 2 initial or ongoing assessments for Class B, C, or D FedRAMP Certifications every 2 years to maintain FedRAMP Recognition. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-ADA","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Actually Do Assessments","statement":"Assessors MUST complete at least 2 initial or ongoing assessments for Class B, C, or D FedRAMP Certifications every 2 years to maintain FedRAMP Recognition.","force":"MUST","affects":["Assessors"],"class":null,"num":2,"type":"years","sortKey":17532} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-afi # REC-IAS-AFI — Annual Foreign Interest Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-afi FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST report information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service to FedRAMP annually. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-AFI","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Annual Foreign Interest Reports","statement":"Assessors MUST report information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service to FedRAMP annually.","force":"MUST","affects":["Assessors"],"class":null,"num":1,"type":"years","sortKey":8766} ## Notifications - {"requirementId":"REC-IAS-AFI","documentKey":"REC","requirementName":"Annual Foreign Interest Reports","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587","name":"FedRAMP Foreign Ownership, Control, or Influence Declaration Form"} --- ## https://ramprules.com/requirement/rec-ias-anr # REC-IAS-ANR — Annual Surveillance Assessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-anr FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST achieve a favorable annual surveillance assessment by the American Association for Laboratory Accreditation (A2LA) to maintain FedRAMP Recognition. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-ANR","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Annual Surveillance Assessment","statement":"Assessors MUST achieve a favorable annual surveillance assessment by the American Association for Laboratory Accreditation (A2LA) to maintain FedRAMP Recognition.","force":"MUST","affects":["Assessors"],"class":null,"num":1,"type":"years","sortKey":8766} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-cap # REC-IAS-CAP — Corrective Action Plan > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-cap FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST supply a corrective action plan when FedRAMP requires one for performance standards deficiencies or organizational risks. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-cfi # REC-IAS-CFI — Changes in Foreign Interest > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-cfi FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST report updated information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service within 48 hours of any change in foreign ownership or control. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-CFI","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Changes in Foreign Interest","statement":"Assessors MUST report updated information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service within 48 hours of any change in foreign ownership or control.","force":"MUST","affects":["Assessors"],"class":null,"num":48,"type":"hours","sortKey":48} ## Notifications - {"requirementId":"REC-IAS-CFI","documentKey":"REC","requirementName":"Changes in Foreign Interest","party":"FedRAMP","method":"form","target":"https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587","name":"FedRAMP Foreign Ownership, Control, or Influence Declaration Form"} --- ## https://ramprules.com/requirement/rec-ias-inv # REC-IAS-INV — Invalid Deliverables > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-inv FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST treat deliverables prepared, performed, or submitted by personnel who do not meet required role qualifications as invalid for FedRAMP purposes. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-psc # REC-IAS-PSC — Policy and Standards Compliance > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-psc FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST maintain compliance with the latest American Association for Laboratory Accreditation (A2LA) R311 - Specific Requirements - Federal Risk and Authorization Management Program to maintain FedRAMP Recognition. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-pst # REC-IAS-PST — Performance Standards > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-pst FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST meet FedRAMP performance standards for assessor deliverables to support independent, risk-based reviews by FedRAMP and federal agencies, including at least: ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-rar # REC-IAS-RAR — Re-entry after Revocation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-rar FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST satisfy all American Association for Laboratory Accreditation (A2LA) re-entry conditions before regaining FedRAMP Recognition after revocation. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-ras # REC-IAS-RAS — Full A2LA Reassessment > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-ras FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST achieve a favorable full reassessment by the American Association for Laboratory Accreditation (A2LA) at least once every 2 years to maintain FedRAMP Recognition. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-RAS","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Full A2LA Reassessment","statement":"Assessors MUST achieve a favorable full reassessment by the American Association for Laboratory Accreditation (A2LA) at least once every 2 years to maintain FedRAMP Recognition.","force":"MUST","affects":["Assessors"],"class":null,"num":2,"type":"years","sortKey":17532} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-rqu # REC-IAS-RQU — Roles and Qualifications > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-rqu FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST ## Statement Assessors MUST staff FedRAMP assessments with all roles required by the American Association for Laboratory Accreditation (A2LA) R311, including personnel who meet the qualifications for each role, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/rec-ias-sep # REC-IAS-SEP — Advisory Separation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/rec-ias-sep FedRAMP Recognition of Independent Assessment Services (`REC`) · group all · subset IAS Force: MUST NOT ## Statement Assessors MUST NOT perform a FedRAMP independent assessment of the same cloud service offering within 2 years after supplying advisory or consulting services for that offering, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process. ## Who it binds - Assessors ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: Path: ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"REC-IAS-SEP","documentKey":"REC","documentName":"FedRAMP Recognition of Independent Assessment Services","group":"all","subset":"IAS","name":"Advisory Separation","statement":"Assessors MUST NOT perform a FedRAMP independent assessment of the same cloud service offering within 2 years after supplying advisory or consulting services for that offering, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process.","force":"MUST NOT","affects":["Assessors"],"class":null,"num":2,"type":"years","sortKey":17532} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-cso-aup # SCG-CSO-AUP — Use Instructions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-cso-aup Secure Configuration Guide (`SCG`) · group all · subset CSO Force: MUST ## Statement Providers MUST include instructions in the FedRAMP Certification Package that explain how to obtain and use the Secure Configuration Guide. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"URL or explanation of how to request these materials.","scope":"all","class":null,"source":"requirement"} - {"text":"Explanation of how the provider decides whether or not to share these materials or other related policies.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-cso-pub # SCG-CSO-PUB — Public Secure Configuration Guidance > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-cso-pub Secure Configuration Guide (`SCG`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD make the Secure Configuration Guide available publicly. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-cso-rsc # SCG-CSO-RSC — Recommended Secure Configuration > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-cso-rsc Secure Configuration Guide (`SCG`) · group all · subset CSO Force: MUST ## Statement Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Certification Package Overview (FRC-CSO-PKG) — https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json ## Artifacts - {"text":"URL to the human-readable data.","scope":"all","class":null,"source":"requirement"} - {"text":"URL to the machine-readable data.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-cso-sdf # SCG-CSO-SDF — Secure Defaults > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-cso-sdf Secure Configuration Guide (`SCG`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-enh-api # SCG-ENH-API — API Capability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-enh-api Secure Configuration Guide (`SCG`) · group all · subset ENH Force: SHOULD ## Statement Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-enh-cmp # SCG-ENH-CMP — Comparison Capability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-enh-cmp Secure Configuration Guide (`SCG`) · group all · subset ENH Force: SHOULD ## Statement Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-enh-exp # SCG-ENH-EXP — Export Capability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-enh-exp Secure Configuration Guide (`SCG`) · group all · subset ENH Force: SHOULD ## Statement Providers SHOULD offer the capability to export all security settings in a machine-readable format. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-enh-mrg # SCG-ENH-MRG — Machine-Readable Guidance > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-enh-mrg Secure Configuration Guide (`SCG`) · group all · subset ENH Force: SHOULD ## Statement Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scg-enh-vrh # SCG-ENH-VRH — Versioning and Release History > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scg-enh-vrh Secure Configuration Guide (`SCG`) · group all · subset ENH Force: SHOULD ## Statement Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how to access this information","scope":"all","class":null,"source":"requirement"} - {"text":"or explanation why this functionality is not available","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-adp-ntf # SCN-ADP-NTF — Notification Requirements > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-adp-ntf Significant Change Notification (`SCN`) · group all · subset ADP Force: MUST ## Statement Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"At least the most recent SCN notification including the date it was sent and the date the change was applied. Additional examples may be provided. If no SCN notifications have been sent then this artifact is not required.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-ADP-NTF","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"ADP","name":"Notification Requirements","statement":"Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:","force":"MUST","affects":["Providers"],"class":null,"num":10,"type":"bizdays","sortKey":336} ## Notifications - {"requirementId":"SCN-ADP-NTF","documentKey":"SCN","requirementName":"Notification Requirements","party":"All Necessary Parties","method":"update","target":"FedRAMP Certification Data","name":"FedRAMP Certification Data"} --- ## https://ramprules.com/requirement/scn-cso-ari # SCN-CSO-ARI — Additional Relevant Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-ari Significant Change Notification (`SCN`) · group all · subset CSO Force: MAY ## Statement Providers MAY include additional relevant information in Significant Change Notifications. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-emg # SCN-CSO-EMG — Emergency Changes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-emg Significant Change Notification (`SCN`) · group all · subset CSO Force: MAY ## Statement Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-eva # SCN-CSO-EVA — Evaluate Changes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-eva Significant Change Notification (`SCN`) · group all · subset CSO Force: MUST ## Statement Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Significant Change Notification (SCN-CSO-INF) — https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json ## Artifacts - {"text":"Evidence of significant change evaluation including a description fo the change, the determined type, and an explanation for the decision. At least one example must be provided for each type of change. Real examples are prefered but the provider may use fictitious examples as long as the example provides evidence of the decision making process.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-his # SCN-CSO-HIS — Historical Notifications > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-his Significant Change Notification (`SCN`) · group all · subset CSO Force: MUST ## Statement Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how FedRAMP can obtain this information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-hrm # SCN-CSO-HRM — Human and Machine-Readable Notifications > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-hrm Significant Change Notification (`SCN`) · group all · subset CSO Force: MUST ## Statement Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Significant Change Notifications Schema — https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json ## Artifacts - {"text":"URL or explanation of how to request these materials.","scope":"all","class":null,"source":"requirement"} - {"text":"Explanation of how the provider decides whether or not to share these materials or other related policies.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-inf # SCN-CSO-INF — Required Information > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-inf Significant Change Notification (`SCN`) · group all · subset CSO Force: MUST ## Statement Providers MUST include at least the following information in Significant Change Notifications: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Significant Change Notification (SCN-CSO-INF) — https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json ## Artifacts - {"text":"A recent Significant Change Notification or sample Significant Change Notification","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-mar # SCN-CSO-MAR — Maintain Audit Records > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-mar Significant Change Notification (`SCN`) · group all · subset CSO Force: MUST ## Statement Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Explanation of how FedRAMP can obtain this information.","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-cso-nom # SCN-CSO-NOM — Notification Mechanisms > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-cso-nom Significant Change Notification (`SCN`) · group all · subset CSO Force: MAY ## Statement Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Current list of available notification mechanisms","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-frp-cap # SCN-FRP-CAP — Corrective Action Plan Conditions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-frp-cap Significant Change Notification (`SCN`) · group all · subset FRP Force: MAY ## Statement FedRAMP MAY require providers to delay significant changes beyond the standard Significant Change Notification period and/or submit significant changes for approval in advance as a condition of a formal FedRAMP Corrective Action Plan or other agreement. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-rtr-nnr # SCN-RTR-NNR — No Notification Requirements > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-rtr-nnr Significant Change Notification (`SCN`) · group all · subset RTR Force: SHOULD NOT ## Statement Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-trf-naf # SCN-TRF-NAF — Notification After Finishing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-naf Significant Change Notification (`SCN`) · group all · subset TRF Force: MUST ## Statement Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"At least the most recent post deployment SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-TRF-NAF","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"TRF","name":"Notification After Finishing","statement":"Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.","force":"MUST","affects":["Providers"],"class":null,"num":5,"type":"bizdays","sortKey":168} ## Notifications - {"requirementId":"SCN-TRF-NAF","documentKey":"SCN","requirementName":"Notification After Finishing","party":"All Necessary Parties","method":"update","target":"FedRAMP Certification Data","name":"FedRAMP Certification Data"} --- ## https://ramprules.com/requirement/scn-trf-nav # SCN-TRF-NAV — Notification After Verification > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-nav Significant Change Notification (`SCN`) · group all · subset TRF Force: MUST ## Statement Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"At least the most recent after verification SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-TRF-NAV","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"TRF","name":"Notification After Verification","statement":"Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:","force":"MUST","affects":["Providers"],"class":null,"num":5,"type":"bizdays","sortKey":168} ## Notifications - {"requirementId":"SCN-TRF-NAV","documentKey":"SCN","requirementName":"Notification After Verification","party":"All Necessary Parties","method":"update","target":"FedRAMP Certification Data","name":"FedRAMP Certification Data"} --- ## https://ramprules.com/requirement/scn-trf-nfp # SCN-TRF-NFP — Notification of Final Plans > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-nfp Significant Change Notification (`SCN`) · group all · subset TRF Force: MUST ## Statement Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"At least the most recent final SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-TRF-NFP","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"TRF","name":"Notification of Final Plans","statement":"Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.","force":"MUST","affects":["Providers"],"class":null,"num":10,"type":"bizdays","sortKey":336} ## Notifications - {"requirementId":"SCN-TRF-NFP","documentKey":"SCN","requirementName":"Notification of Final Plans","party":"All Necessary Parties","method":"update","target":"FedRAMP Certification Data","name":"FedRAMP Certification Data"} --- ## https://ramprules.com/requirement/scn-trf-nip # SCN-TRF-NIP — Notification of Initial Plans > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-nip Significant Change Notification (`SCN`) · group all · subset TRF Force: MUST ## Statement Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"At least the most recent initial SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-TRF-NIP","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"TRF","name":"Notification of Initial Plans","statement":"Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.","force":"MUST","affects":["Providers"],"class":null,"num":30,"type":"bizdays","sortKey":1008} ## Notifications - {"requirementId":"SCN-TRF-NIP","documentKey":"SCN","requirementName":"Notification of Initial Plans","party":"All Necessary Parties","method":"update","target":"FedRAMP Certification Data","name":"FedRAMP Certification Data"} --- ## https://ramprules.com/requirement/scn-trf-tpr # SCN-TRF-TPR — Third-Party Review > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-tpr Significant Change Notification (`SCN`) · group all · subset TRF Force: SHOULD ## Statement Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Third Party assesment report OR explanation why a third party assessor was not engaged","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/scn-trf-upd # SCN-TRF-UPD — Update Documentation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/scn-trf-upd Significant Change Notification (`SCN`) · group all · subset TRF Force: MUST ## Statement Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"Date of the most recent transformative change and the date of the corresponding documentation update. If no documentation updates were required as the result of this change, explain how this was determined.","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"SCN-TRF-UPD","documentKey":"SCN","documentName":"Significant Change Notification","group":"all","subset":"TRF","name":"Update Documentation","statement":"Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.","force":"MUST","affects":["Providers"],"class":null,"num":30,"type":"bizdays","sortKey":1008} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/sdr-csf-ctf # SDR-CSF-CTF — Rev5 Controls > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/sdr-csf-ctf Security Decision Record (`SDR`) · group rev5 · subset CSF Force: MUST ## Statement Providers MUST also include short and simple high-level summaries of at least the following for each applicable Rev5 Control: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/sdr-cso-frr # SDR-CSO-FRR — FedRAMP Rules > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/sdr-cso-frr Security Decision Record (`SDR`) · group all · subset CSO Force: MUST ## Statement Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Security Decision Record Schema — https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/sdr-cso-mtd # SDR-CSO-MTD — Security Decision Record Metadata > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/sdr-cso-mtd Security Decision Record (`SDR`) · group all · subset CSO Force: MUST ## Statement Providers MUST also include the following basic metadata in their Security Decision Record: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/sdr-csx-kmt # SDR-CSX-KMT — Key Security Indicator Metrics > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/sdr-csx-kmt Security Decision Record (`SDR`) · group 20x · subset CSX Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form FedRAMP Security Decision Record Schema — https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/sdr-csx-ksi # SDR-CSX-KSI — Key Security Indicators > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/sdr-csx-ksi Security Decision Record (`SDR`) · group 20x · subset CSX Force: MUST ## Statement Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 (this subset states no type restriction) Path: Program, Agency (this subset states no path restriction) ## Machine-readable form FedRAMP Security Decision Record Schema — https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-adt # VDR-CSO-ADT — Automate Detection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-adt Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD use automated services to improve and streamline vulnerability detection and response. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-ake # VDR-CSO-AKE — Avoid KEVs > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-ake Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: SHOULD NOT ## Statement Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-dac # VDR-CSO-DAC — Detect After Changes > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-dac Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-det # VDR-CSO-DET — Vulnerability Detection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-det Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: MUST ## Statement Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-dfr # VDR-CSO-DFR — Design For Resilience > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-dfr Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: SHOULD ## Statement Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-fav # VDR-CSO-FAV — Failures Are Vulnerabilities > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-fav Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: MUST ## Statement Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-msp # VDR-CSO-MSP — Maintain Security > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-msp Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: SHOULD NOT ## Statement Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-res # VDR-CSO-RES — Vulnerability Response > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-res Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: MUST ## Statement Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-cso-sir # VDR-CSO-SIR — Sampling > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-cso-sir Vulnerability Detection and Response (`VDR`) · group all · subset CSO Force: MAY ## Statement Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-kev # VDR-TFR-KEV — Remediate KEVs > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-kev Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: SHOULD ## Statement Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-mvf # VDR-TFR-MVF — Persistent Machine Verification and Validation for Rev5 > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-mvf Vulnerability Detection and Response (`VDR`) · group rev5 · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VDR-TFR-MVF","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"rev5","subset":"TFR","name":"Persistent Machine Verification and Validation for Rev5","statement":"Providers of FedRAMP Rev5 Class B offerings SHOULD verify and validate the status of machine-based information resources at least once every month.","force":"SHOULD","affects":["Providers"],"class":"b","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VDR-TFR-MVF","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"rev5","subset":"TFR","name":"Persistent Machine Verification and Validation for Rev5","statement":"Providers of FedRAMP Rev5 Class C offerings MUST verify and validate the status of machine-based information resources at least once every month.","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VDR-TFR-MVF","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"rev5","subset":"TFR","name":"Persistent Machine Verification and Validation for Rev5","statement":"Providers of FedRAMP Rev5 Class D offerings MUST verify and validate the status of machine-based information resources at least once every month.","force":"MUST","affects":["Providers"],"class":"d","num":1,"type":"months","sortKey":730.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-mvx # VDR-TFR-MVX — Persistent Machine Verification and Validation for 20x > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-mvx Vulnerability Detection and Response (`VDR`) · group 20x · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VDR-TFR-MVX","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"20x","subset":"TFR","name":"Persistent Machine Verification and Validation for 20x","statement":"Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.","force":"MUST","affects":["Providers"],"class":"c","num":3,"type":"days","sortKey":72} - {"requirementId":"VDR-TFR-MVX","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"20x","subset":"TFR","name":"Persistent Machine Verification and Validation for 20x","statement":"Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days.","force":"MUST","affects":["Providers"],"class":"b","num":7,"type":"days","sortKey":168} - {"requirementId":"VDR-TFR-MVX","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"20x","subset":"TFR","name":"Persistent Machine Verification and Validation for 20x","statement":"Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month.","force":"SHOULD","affects":["Providers"],"class":"a","num":1,"type":"months","sortKey":730.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-nmv # VDR-TFR-NMV — Non-Machine Verification and Validation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-nmv Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: MUST ## Statement Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-pcd # VDR-TFR-PCD — Persistently Complete Detection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-pcd Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VDR-TFR-PCD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistently Complete Detection","statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","affects":["Providers"],"class":"c","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VDR-TFR-PCD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistently Complete Detection","statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","affects":["Providers"],"class":"d","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VDR-TFR-PCD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistently Complete Detection","statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","affects":["Providers"],"class":"a","num":6,"type":"months","sortKey":4383} - {"requirementId":"VDR-TFR-PCD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistently Complete Detection","statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","affects":["Providers"],"class":"b","num":6,"type":"months","sortKey":4383} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-pdd # VDR-TFR-PDD — Persistent Drift Detection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-pdd Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VDR-TFR-PDD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Drift Detection","statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days.","force":"SHOULD","affects":["Providers"],"class":"d","num":7,"type":"days","sortKey":168} - {"requirementId":"VDR-TFR-PDD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Drift Detection","statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.","force":"SHOULD","affects":["Providers"],"class":"c","num":14,"type":"days","sortKey":336} - {"requirementId":"VDR-TFR-PDD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Drift Detection","statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month.","force":"SHOULD","affects":["Providers"],"class":"b","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VDR-TFR-PDD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Drift Detection","statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months.","force":"SHOULD","affects":["Providers"],"class":"a","num":3,"type":"months","sortKey":2191.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-psd # VDR-TFR-PSD — Persistent Sample Detection > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-psd Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VDR-TFR-PSD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Sample Detection","statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day.","force":"SHOULD","affects":["Providers"],"class":"d","num":1,"type":"days","sortKey":24} - {"requirementId":"VDR-TFR-PSD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Sample Detection","statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.","force":"SHOULD","affects":["Providers"],"class":"c","num":3,"type":"days","sortKey":72} - {"requirementId":"VDR-TFR-PSD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Sample Detection","statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days.","force":"SHOULD","affects":["Providers"],"class":"b","num":7,"type":"days","sortKey":168} - {"requirementId":"VDR-TFR-PSD","documentKey":"VDR","documentName":"Vulnerability Detection and Response","group":"all","subset":"TFR","name":"Persistent Sample Detection","statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days.","force":"SHOULD","affects":["Providers"],"class":"a","num":14,"type":"days","sortKey":336} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-pvr # VDR-TFR-PVR — Mitigation and Remediation Expectations > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-pvr Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/vdr-tfr-rmn # VDR-TFR-RMN — Remaining Vulnerabilities > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/vdr-tfr-rmn Vulnerability Detection and Response (`VDR`) · group all · subset TFR Force: SHOULD ## Statement Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-agm-map # VER-AGM-MAP — Maintain Agency Plans of Action and Milestones > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-agm-map Vulnerability Evaluation and Reporting (`VER`) · group all · subset AGM Force: SHOULD ## Statement Agencies SHOULD use vulnerability information reported by the Provider to maintain Plans of Action and Milestones for agency security programs when relevant according to agency security policies (such as if the agency takes action to mitigate the risk of exploitation or authorized the continued use of a cloud service with accepted vulnerabilities that put agency information systems at risk). ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-agm-rvr # VER-AGM-RVR — Review Vulnerability Reports > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-agm-rvr Vulnerability Evaluation and Reporting (`VER`) · group all · subset AGM Force: SHOULD ## Statement Agencies SHOULD review the information provided in vulnerability reports at appropriate and reasonable intervals commensurate with the expectations and risk posture indicated by their Authorization to Operate, and SHOULD use automated processing and filtering of machine readable information from cloud service providers. ## Who it binds - Agencies ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-aia # VER-EVA-AIA — Assume It's Automatable > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-aia Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: MUST ## Statement Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-efa # VER-EVA-EFA — Evaluation Factors > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-efa Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: SHOULD ## Statement Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-efp # VER-EVA-EFP — Evaluate False Positives > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-efp Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: SHOULD ## Statement Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-eir # VER-EVA-EIR — Evaluate Internet-Reachability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-eir Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: MUST ## Statement Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-elx # VER-EVA-ELX — Evaluate Exploitability > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-elx Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: MUST ## Statement Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-epa # VER-EVA-EPA — Estimate Potential Agency Impact > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-epa Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: MUST ## Statement Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN): ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-eva-grv # VER-EVA-GRV — Group Vulnerabilities > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-eva-grv Vulnerability Evaluation and Reporting (`VER`) · group all · subset EVA Force: SHOULD ## Statement Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-frp-adv # VER-FRP-ADV — Sensitive Details > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-frp-adv Vulnerability Evaluation and Reporting (`VER`) · group all · subset FRP Force: MAY ## Statement FedRAMP MAY require providers to share additional information or details about vulnerabilities, including sensitive information that would likely lead to exploitation, as part of review, response or investigation by necessary parties. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-frp-arp # VER-FRP-ARP — Additional Requirements > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-frp-arp Vulnerability Evaluation and Reporting (`VER`) · group all · subset FRP Force: MAY ## Statement FedRAMP MAY require providers to share additional vulnerability information, alternative reports, or to report at an alternative frequency as a condition of a FedRAMP Corrective Action Plan or other agreements with federal agencies. ## Who it binds - FedRAMP ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-avi # VER-RPT-AVI — Accepted Vulnerability Info > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-avi Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: MUST ## Statement Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Accepted Vulnerability Info (VER-RPT-AVI) — https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json ## Artifacts - {"text":"A recent vulnerability report or a sample vulnerability report","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-hlo # VER-RPT-HLO — High-Level Overviews > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-hlo Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: SHOULD ## Statement Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-nid # VER-RPT-NID — Responsible Disclosure > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-nid Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: MUST NOT ## Statement Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-per # VER-RPT-PER — Persistent Reporting > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-per Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: MUST ## Statement Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Vulnerability Detail Report (VER-RPT-VDT) — https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-rpd # VER-RPT-RPD — Responsible Public Disclosure > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-rpd Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: MAY ## Statement Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-rpt-vdt # VER-RPT-VDT — Vulnerability Details > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-rpt-vdt Vulnerability Evaluation and Reporting (`VER`) · group all · subset RPT Force: MUST ## Statement Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability: ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Vulnerability Detail Report (VER-RPT-VDT) — https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json ## Artifacts - {"text":"A recent vulnerability report or a sample vulnerability report","scope":"all","class":null,"source":"requirement"} ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-evu # VER-TFR-EVU — Evaluate Vulnerabilities Quickly > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-evu Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection.","force":"SHOULD","affects":["Providers"],"class":"d","num":2,"type":"days","sortKey":48} - {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.","force":"SHOULD","affects":["Providers"],"class":"c","num":5,"type":"days","sortKey":120} - {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.","force":"SHOULD","affects":["Providers"],"class":"b","num":7,"type":"days","sortKey":168} - {"requirementId":"VER-TFR-EVU","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection.","force":"SHOULD","affects":["Providers"],"class":"a","num":14,"type":"days","sortKey":336} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-iri # VER-TFR-IRI — Internet-Reachable Incidents > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-iri Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-mav # VER-TFR-MAV — Mark Accepted Vulnerabilities > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-mav Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: MUST ## Statement Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes - {"requirementId":"VER-TFR-MAV","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Mark Accepted Vulnerabilities","statement":"Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.","force":"MUST","affects":["Providers"],"class":null,"num":192,"type":"days","sortKey":4608} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-mhr # VER-TFR-MHR — Monthly Activity Report > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-mhr Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: MUST ## Statement Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly. ## Who it binds - Providers ## Certification classes _Applies regardless of certification class._ ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts - {"text":"A recent vulnerability report or a sample vulnerability report","scope":"all","class":null,"source":"requirement"} ## Timeframes - {"requirementId":"VER-TFR-MHR","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Monthly Activity Report","statement":"Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.","force":"MUST","affects":["Providers"],"class":null,"num":1,"type":"months","sortKey":730.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-mrh # VER-TFR-MRH — Historical Activity > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-mrh Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH) — https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json ## Artifacts - {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"a","source":"requirement"} - {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"b","source":"requirement"} - {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"b","source":"requirement"} - {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"c","source":"requirement"} - {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"c","source":"requirement"} - {"text":"URL and access instructions for historical vulnerability detection and response activity in machine readable format","scope":"all","class":"d","source":"requirement"} - {"text":"or an explanation of why machine readable content is not being provided","scope":"all","class":"d","source":"requirement"} ## Timeframes - {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.","force":"SHOULD","affects":["Providers"],"class":"d","num":7,"type":"days","sortKey":168} - {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.","force":"SHOULD","affects":["Providers"],"class":"c","num":14,"type":"days","sortKey":336} - {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.","force":"MAY","affects":["Providers"],"class":"a","num":1,"type":"months","sortKey":730.5} - {"requirementId":"VER-TFR-MRH","documentKey":"VER","documentName":"Vulnerability Evaluation and Reporting","group":"all","subset":"TFR","name":"Historical Activity","statement":"Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.","force":"SHOULD","affects":["Providers"],"class":"b","num":1,"type":"months","sortKey":730.5} ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/requirement/ver-tfr-nri # VER-TFR-NRI — Non-Internet-Reachable Incidents > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /requirement/ver-tfr-nri Vulnerability Evaluation and Reporting (`VER`) · group all · subset TFR Force: none stated ## Statement _No statement text is recorded for this requirement._ ## Who it binds - Providers ## Certification classes - class A - class B - class C - class D ## Which certifications it binds Certification type: 20x, Rev5 Path: Program, Agency ## Machine-readable form _This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._ ## Artifacts _No requirement-specific artifact is named._ ## Timeframes _This requirement states no deadline._ ## Notifications _This requirement demands no notification._ --- ## https://ramprules.com/collect/iam-credential-report # Account-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policy > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/iam-credential-report Recipe id: `iam-credential-report` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-APM` - KSI `KSI-IAM-ELP` - control `ia-2` - control `ia-5` ## Collection Kind: `cli` ```sh # generate-credential-report aws iam generate-credential-report # credential-report-generated-time aws iam get-credential-report --query GeneratedTime --output text # credential-report aws iam get-credential-report --query Content --output text | base64 --decode ``` ## Expected output CSV, one row per IAM principal with columns including password_enabled, mfa_active, password_last_changed, access_key_1_active, access_key_1_last_rotated, access_key_2_last_rotated ## Assertions - {"field":"credential-report-generated-time","op":"max_age_days","value":1,"controls":["ia-2","ia-5"],"description":"The report being read was generated within the last day — a stored report is served for up to four hours, and nothing else bounds its age."} - {"field":"credential-report[].mfa_active","op":"eq","value":"TRUE","where":[{"field":"password_enabled","op":"eq","value":"TRUE"}],"controls":["ia-2"],"description":"Every principal with a console password has MFA active."} - {"field":"credential-report[].access_key_1_last_rotated","op":"max_age_days","value":90,"where":[{"field":"access_key_1_active","op":"eq","value":"TRUE"}],"controls":["ia-5"],"description":"Every active first access key was rotated within the last 90 days."} - {"field":"credential-report[].access_key_2_last_rotated","op":"max_age_days","value":90,"where":[{"field":"access_key_2_active","op":"eq","value":"TRUE"}],"controls":["ia-5"],"description":"Every active second access key was rotated within the last 90 days."} ## GovCloud identical API and CSV schema; principal ARNs use partition arn:aws-us-gov ## Notes Assert mfa_active=true for every password_enabled=true principal, and (now - access_key_N_last_rotated) <= 90d for every active key. generate-credential-report is async; poll get-credential-report until State=COMPLETE (report is regenerated at most every 4 hours). mfa_active is TRUE for a virtual TOTP device as well as a FIDO key, and the CSV covers IAM users and the root user only — a human confirms from the identity provider's own report that console authentication is phishing-resistant (the IA-02 (01)/(02) guidance) and that federated Identity Center or external-IdP sign-ins are covered elsewhere. The 90-day threshold is CIS Benchmark 1.14's, not FedRAMP's. Filed under IA-02 and IA-05 base: key age tests IA-05 (g), not AC-02 (01)'s automated account management or IA-05 (01)'s password rules. ## References - {"title":"Generate credential reports for your AWS account (CSV columns; a report can be generated at most once every four hours)","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html"} - {"title":"AWS CLI: iam generate-credential-report","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/generate-credential-report.html"} - {"title":"AWS CLI: iam get-credential-report","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-credential-report.html"} --- ## https://ramprules.com/collect/iam-account-authorization-details # Full snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intent > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/iam-account-authorization-details Recipe id: `iam-account-authorization-details` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - KSI `KSI-IAM-AAM` - control `ac-2` - control `ac-3` - control `ac-6.1` ## Collection Kind: `cli` ```sh # user-details aws iam get-account-authorization-details --query 'UserDetailList[].{User:UserName,Groups:GroupList,Attached:AttachedManagedPolicies[].PolicyName,Inline:UserPolicyList[].PolicyName}' # role-details aws iam get-account-authorization-details --filter Role --query 'RoleDetailList[].{Role:RoleName,Trust:AssumeRolePolicyDocument,Attached:AttachedManagedPolicies[].PolicyName}' ``` ## Expected output JSON with UserDetailList, GroupDetailList, RoleDetailList, and Policies arrays; embedded policy documents are URL-encoded (RFC 3986) and must be decoded before diffing against approved baselines ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud identical API; policy ARNs and principal ARNs use partition arn:aws-us-gov ## Notes The API fully enumerates entitlements (telemetry), but deciding whether a given permission set is 'least privilege' requires human judgement against a documented access baseline. Reviewers should diff this snapshot against the last approved baseline and justify deltas. ## References - {"title":"AWS CLI: iam get-account-authorization-details (UserDetailList / GroupDetailList / RoleDetailList / Policies)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"} - {"title":"Managed policies and inline policies — why an inline-policy review is a separate pass","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"} --- ## https://ramprules.com/collect/iam-access-analyzer-unused-access # Active unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removal > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/iam-access-analyzer-unused-access Recipe id: `iam-access-analyzer-unused-access` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - KSI `KSI-IAM-JIT` - control `ac-2.3` - control `ac-6.7` ## Collection Kind: `cli` ```sh # account-unused-access-analyzers aws accessanalyzer list-analyzers --type ACCOUNT_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}' # organization-unused-access-analyzers aws accessanalyzer list-analyzers --type ORGANIZATION_UNUSED_ACCESS --query 'analyzers[].{arn:arn,status:status,age:configuration.unusedAccess.unusedAccessAge}' # unused-access-findings aws accessanalyzer list-findings-v2 --analyzer-arn --filter '{"status":{"eq":["ACTIVE"]}}' ``` ## Expected output JSON findings array; each finding has a findingType of UnusedIAMRole, UnusedIAMUserAccessKey, UnusedIAMUserPassword, or UnusedPermission, with the affected resource ARN and status ## Assertions - {"field":"account-unused-access-analyzers[].status","op":"eq","value":"ACTIVE","controls":["ac-2.3","ac-6.7"],"description":"Every unused-access analyzer is ACTIVE — a DISABLED or CREATING analyzer also returns zero findings."} - {"field":"account-unused-access-analyzers[].age","op":"lte","value":90,"controls":["ac-2.3","ac-6.7"],"description":"The tracking period is no longer than the 90-day review period, or an entity unused for 91 days is not yet a finding."} - {"field":"unused-access-findings.findings[]","op":"count_eq","value":0,"where":[{"field":"status","op":"eq","value":"ACTIVE"},{"field":"findingType","op":"in","value":["UnusedIAMRole","UnusedIAMUserAccessKey","UnusedIAMUserPassword"]}],"controls":["ac-2.3"],"description":"No role, access key or console password has gone unused past the analyzer's configured age."} - {"field":"unused-access-findings.findings[]","op":"count_eq","value":0,"where":[{"field":"status","op":"eq","value":"ACTIVE"},{"field":"findingType","op":"eq","value":"UnusedPermission"}],"controls":["ac-6.7"],"description":"No principal retains a service or action permission it has not exercised."} ## GovCloud IAM Access Analyzer is available in AWS GovCloud (US); analyzer and resource ARNs use partition arn:aws-us-gov ## Notes Use list-findings-v2 (list-findings is external-access only and does not return unused-access findings). Requires an existing ACCOUNT_UNUSED_ACCESS analyzer; create one with create-analyzer --type ACCOUNT_UNUSED_ACCESS --configuration '{"unusedAccess":{"unusedAccessAge":90}}'. Target zero ACTIVE unused-permission findings for privileged roles. An empty findings list is meaningful only if an analyzer exists, is ACTIVE, and its unusedAccessAge equals the review period the SSP declares; entities younger than the tracking period, and principals or accounts excluded by tag, never appear as findings. UnusedPermission findings are computed for roles, so IAM users' unused permissions are outside this output, and AC-06 (07)(a)'s periodic review is a human record — which is why this is partial. ## References - {"title":"Create an IAM Access Analyzer unused access analyzer (tracking period, 1–365 days)","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-create-unused.html"} - {"title":"IAM Access Analyzer findings","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-findings.html"} - {"title":"AWS CLI: accessanalyzer list-findings-v2 (findingType UnusedIAMRole / UnusedIAMUserAccessKey / UnusedIAMUserPassword / UnusedPermission; status ACTIVE / ARCHIVED / RESOLVED)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-findings-v2.html"} --- ## https://ramprules.com/collect/config-mfa-enabled-console-access # AWS Config compliance result for the managed rule proving every IAM user with a console password has MFA enabled > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-mfa-enabled-console-access Recipe id: `config-mfa-enabled-console-access` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-APM` - control `ia-2` ## Collection Kind: `config-rule` ```sh # mfa-enabled-for-iam-console-access aws configservice get-compliance-details-by-config-rule --config-rule-name mfa-enabled-for-iam-console-access --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # mfa-enabled-for-iam-console-access-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names mfa-enabled-for-iam-console-access ``` ## Expected output EvaluationResults array; empty NON_COMPLIANT set means all console-enabled IAM users have MFA. Managed rule identifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"mfa-enabled-for-iam-console-access.EvaluationResults","op":"count_eq","value":0,"controls":["ia-2"],"description":"No IAM user with console access lacks MFA."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["ia-2"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"mfa-enabled-for-iam-console-access-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["ia-2"],"description":"mfa-enabled-for-iam-console-access has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"mfa-enabled-for-iam-console-access-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["ia-2"],"description":"mfa-enabled-for-iam-console-access has a successful evaluation on record."} ## GovCloud AWS Config and this managed rule are available in AWS GovCloud (US); resource ARNs use partition arn:aws-us-gov ## Notes Substitute your deployed rule name if it differs from the default. An empty NON_COMPLIANT result is the pass condition. Pair with the IAM_USER_MFA_ENABLED rule to also catch programmatic users. MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS is COMPLIANT for any enabled device, including a virtual TOTP app; whether the factor is phishing-resistant (the IA-02 (01)/(02) guidance), and whether workforce console access runs through IAM users at all rather than IAM Identity Center, are judgements outside this output — filed under IA-02 base for that reason, and nothing here partitions privileged from non-privileged accounts. ## References - {"title":"AWS Config managed rule: mfa-enabled-for-iam-console-access (MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS, periodic, AWS::IAM::User)","url":"https://docs.aws.amazon.com/config/latest/developerguide/mfa-enabled-for-iam-console-access.html"} - {"title":"AWS Config managed rule: iam-user-mfa-enabled — the companion rule covering users without console access","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-user-mfa-enabled.html"} --- ## https://ramprules.com/collect/config-access-keys-rotated # AWS Config compliance result proving long-lived IAM access keys (including those used by service/non-user identities) are rotated within the maximum age > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-access-keys-rotated Recipe id: `config-access-keys-rotated` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-SNU` - KSI `KSI-IAM-APM` - control `ia-5` ## Collection Kind: `config-rule` ```sh # access-keys-rotated aws configservice get-compliance-details-by-config-rule --config-rule-name access-keys-rotated --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # access-keys-rotated-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names access-keys-rotated ``` ## Expected output EvaluationResults array; empty NON_COMPLIANT set means every active access key is within maxAccessKeyAge. Managed rule identifier: ACCESS_KEYS_ROTATED (maxAccessKeyAge parameter, e.g. 90) Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"access-keys-rotated.EvaluationResults","op":"count_eq","value":0,"controls":["ia-5"],"description":"No active access key is older than the rule's maxAccessKeyAge."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["ia-5"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"access-keys-rotated-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["ia-5"],"description":"access-keys-rotated has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"access-keys-rotated-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["ia-5"],"description":"access-keys-rotated has a successful evaluation on record."} ## GovCloud AWS Config and this managed rule are available in AWS GovCloud (US); resource ARNs use partition arn:aws-us-gov ## Notes Strongest evidence for non-user auth is the absence of long-lived keys entirely (prefer IAM roles / temporary credentials). Where keys must exist, this rule proves rotation. Set maxAccessKeyAge to your policy (<=90d). The rule's verdict is only as strong as the maxAccessKeyAge an operator set, and the output does not carry the parameter — a human confirms it matches the SSP's rotation period. Root-user access keys are outside the rule by AWS's documented limitation. Filed under IA-05 base: key age tests IA-05 (g), not AC-02 (01). ## References - {"title":"AWS Config managed rule: access-keys-rotated (ACCESS_KEYS_ROTATED, maxAccessKeyAge default 90 days; does not apply to root user access keys)","url":"https://docs.aws.amazon.com/config/latest/developerguide/access-keys-rotated.html"} --- ## https://ramprules.com/collect/config-iam-policy-no-admin-access # AWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*) > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-iam-policy-no-admin-access Recipe id: `config-iam-policy-no-admin-access` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - control `ac-6` ## Collection Kind: `config-rule` ```sh # iam-policy-no-statements-with-admin-access aws configservice get-compliance-details-by-config-rule --config-rule-name iam-policy-no-statements-with-admin-access --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # iam-policy-no-statements-with-admin-access-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names iam-policy-no-statements-with-admin-access ``` ## Expected output EvaluationResults array; empty NON_COMPLIANT set means no evaluated customer-managed policy allows Action:* over Resource:*. Managed rule identifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"iam-policy-no-statements-with-admin-access.EvaluationResults","op":"count_eq","value":0,"controls":["ac-6"],"description":"No evaluated customer-managed policy allows Action:* on Resource:*."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["ac-6"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"iam-policy-no-statements-with-admin-access-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["ac-6"],"description":"iam-policy-no-statements-with-admin-access has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"iam-policy-no-statements-with-admin-access-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["ac-6"],"description":"iam-policy-no-statements-with-admin-access has a successful evaluation on record."} ## GovCloud AWS Config and this managed rule are available in AWS GovCloud (US); policy ARNs use partition arn:aws-us-gov ## Notes Scope caveat: this rule evaluates only customer-managed policies, not inline or AWS-managed policies. Combine with iam-account-authorization-details review to cover inline policies and admin AWS-managed policy attachments (e.g. AdministratorAccess). A human closes that gap by reading iam-account-authorization-details, which is why this is partial; and nothing in the output records the explicit authorizations AC-06 (01) asks for or partitions privileged from non-privileged users as AC-06 (10) does, so neither enhancement is claimed. ## References - {"title":"AWS Config managed rule: iam-policy-no-statements-with-admin-access (IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS — customer-managed policies only, not inline or AWS-managed)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-policy-no-statements-with-admin-access.html"} - {"title":"Managed policies and inline policies","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"} --- ## https://ramprules.com/collect/identity-center-jit-elevation-workflow # Documented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standing > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/identity-center-jit-elevation-workflow Recipe id: `identity-center-jit-elevation-workflow` · cadence quarterly · narrative > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-JIT` - KSI `KSI-IAM-AAM` - control `ac-3` - control `ac-6` - control `ac-6.5` ## Collection _Narrative — a documented process; no API call proves this. The commands below are context, not evidence._ ```sh # aws sso-admin list-instances --query 'Instances[0].InstanceArn' --output text # aws sso-admin list-permission-sets --instance-arn # aws sso-admin describe-permission-set --instance-arn --permission-set-arn --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}' # aws sso-admin list-account-assignments --instance-arn --account-id --permission-set-arn ``` ## Expected output Permission set names with bounded SessionDuration (e.g. PT1H) and current account assignments; combined with the written approval-workflow runbook and ticket/approval records for each elevation ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud IAM Identity Center is available in AWS GovCloud (US); instance and permission-set ARNs use partition arn:aws-us-gov ## Notes The API proves RBAC structure and bounded session duration, but it cannot by itself prove that each elevation was requested, approved, and time-limited just-in-time. The approval/break-glass workflow and its evidence (tickets, approvals, deprovisioning records) are a documented process; attach the runbook and sampled approval records. Do not present the permission-set listing alone as proof of JIT. ## References - {"title":"Manage AWS accounts with permission sets — AWS IAM Identity Center","url":"https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html"} - {"title":"Set session duration for AWS accounts — the time-bound half of a break-glass elevation","url":"https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html"} - {"title":"AWS CLI: sso-admin list-permission-sets","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-permission-sets.html"} - {"title":"AWS CLI: sso-admin list-account-assignments","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-account-assignments.html"} --- ## https://ramprules.com/collect/guardduty-suspicious-iam-activity-response # GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/guardduty-suspicious-iam-activity-response Recipe id: `guardduty-suspicious-iam-activity-response` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-SUS` - control `ac-2.4` - control `ac-2.13` - control `ac-7` ## Collection Kind: `cli` ```sh # list-detectors aws guardduty list-detectors --query 'DetectorIds[0]' --output text # list-findings aws guardduty list-findings --detector-id --finding-criteria '{"Criterion":{"type":{"Eq":["UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS"]}}}' # get-findings aws guardduty get-findings --detector-id --finding-ids # lookup-events-delete-login-profile aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteLoginProfile --max-results 10 ``` ## Expected output GuardDuty finding detail (severity, affected IAM principal, timestamp) plus CloudTrail events (e.g. DeleteLoginProfile, DeleteAccessKey, DeactivateMFADevice, or PutUserPolicy attaching a deny) showing the account was disabled/secured after the finding ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud GuardDuty and CloudTrail are available in AWS GovCloud (US); principal ARNs use partition arn:aws-us-gov. Some IAM-focused GuardDuty finding types depend on CloudTrail management-event coverage ## Notes Detection is pure telemetry; the response (which key/user to disable, whether it was malicious vs. authorized) requires incident-responder judgement, so this is partial. Evidence = finding + a linked responsive CloudTrail event within the IR SLA. cloudtrail lookup-events covers the last 90 days; use the finding type relevant to your workload. ## References - {"title":"GuardDuty IAM finding types (including UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-iam.html"} - {"title":"AWS CLI: guardduty list-findings","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-findings.html"} - {"title":"AWS CLI: guardduty get-findings","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-findings.html"} - {"title":"AWS CLI: cloudtrail lookup-events — the responsive action's record","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} --- ## https://ramprules.com/collect/config-encryption-at-rest # AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-encryption-at-rest Recipe id: `config-encryption-at-rest` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - control `sc-28` ## Collection Kind: `config-rule` ```sh # encrypted-volumes aws configservice get-compliance-details-by-config-rule --config-rule-name encrypted-volumes --compliance-types NON_COMPLIANT # rds-storage-encrypted aws configservice get-compliance-details-by-config-rule --config-rule-name rds-storage-encrypted --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # encrypted-volumes-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names encrypted-volumes # rds-storage-encrypted-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names rds-storage-encrypted # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Two EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket, attached EBS volume, and RDS instance is encrypted at rest. Managed rule identifiers: ENCRYPTED_VOLUMES, RDS_STORAGE_ENCRYPTED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"encrypted-volumes.EvaluationResults","op":"count_eq","value":0,"controls":["sc-28"],"description":"Every attached EBS volume is encrypted."} - {"field":"rds-storage-encrypted.EvaluationResults","op":"count_eq","value":0,"controls":["sc-28"],"description":"Every RDS instance has encrypted storage."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-28"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-28"],"description":"encrypted-volumes has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-28"],"description":"encrypted-volumes has a successful evaluation on record."} - {"field":"rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-28"],"description":"rds-storage-encrypted has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-28"],"description":"rds-storage-encrypted has a successful evaluation on record."} ## GovCloud AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, volume, DB, and KMS key ARNs use partition arn:aws-us-gov ## Notes These rules prove encryption is present, not which key backs it. Pass ENCRYPTED_VOLUMES and RDS_STORAGE_ENCRYPTED a kmsId/kmsKeyId parameter to additionally assert a specific CMK rather than any key. These three cover the dominant data stores; extend with the analogous rules for DynamoDB (dynamodb-table-encrypted-kms), EFS (efs-encrypted-check), SNS (sns-encrypted-kms), and other services you actually run — the recipe is the pattern, not the exhaustive list. The S3 rule was removed from this recipe: S3 has applied SSE-S3 to every bucket since 5 January 2023 and it cannot be disabled, so s3-bucket-server-side-encryption-enabled cannot fail and proved nothing. ENCRYPTED_VOLUMES sees attached volumes only, leaving detached volumes and every snapshot unproven, and no CMK is asserted — a human names the data stores in scope, confirms each has a rule, and reads key ownership for SC-28 (01), which is not claimed. ## References - {"title":"AWS Config managed rule: encrypted-volumes","url":"https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html"} - {"title":"AWS Config managed rule: rds-storage-encrypted","url":"https://docs.aws.amazon.com/config/latest/developerguide/rds-storage-encrypted.html"} --- ## https://ramprules.com/collect/config-encryption-in-transit # AWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSL > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-encryption-in-transit Recipe id: `config-encryption-in-transit` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - control `sc-8` ## Collection Kind: `config-rule` ```sh # s3-bucket-ssl-requests-only aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-ssl-requests-only --compliance-types NON_COMPLIANT # elb-tls-https-listeners-only aws configservice get-compliance-details-by-config-rule --config-rule-name elb-tls-https-listeners-only --compliance-types NON_COMPLIANT # redshift-require-tls-ssl aws configservice get-compliance-details-by-config-rule --config-rule-name redshift-require-tls-ssl --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # s3-bucket-ssl-requests-only-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names s3-bucket-ssl-requests-only # elb-tls-https-listeners-only-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names elb-tls-https-listeners-only # redshift-require-tls-ssl-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names redshift-require-tls-ssl # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Three EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket enforces aws:SecureTransport, every Classic Load Balancer listener is SSL/HTTPS, and every Redshift cluster sets require_SSL=true. Managed rule identifiers: S3_BUCKET_SSL_REQUESTS_ONLY, ELB_TLS_HTTPS_LISTENERS_ONLY, REDSHIFT_REQUIRE_TLS_SSL Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"s3-bucket-ssl-requests-only.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every evaluated S3 bucket policy denies requests without aws:SecureTransport."} - {"field":"elb-tls-https-listeners-only.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every Classic Load Balancer listener terminates SSL/HTTPS."} - {"field":"redshift-require-tls-ssl.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every Redshift cluster requires SSL."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-8"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"s3-bucket-ssl-requests-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"s3-bucket-ssl-requests-only has a successful evaluation on record."} - {"field":"elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"elb-tls-https-listeners-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"elb-tls-https-listeners-only has a successful evaluation on record."} - {"field":"redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"redshift-require-tls-ssl has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"redshift-require-tls-ssl has a successful evaluation on record."} ## GovCloud AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, load-balancer, and cluster ARNs use partition arn:aws-us-gov ## Notes The SC-08.01 enhancement (cryptographic protection in transit) is the TLS requirement these rules assert. ELB_TLS_HTTPS_LISTENERS_ONLY covers Classic Load Balancers only — for Application/Network Load Balancers add elbv2-acm-certificate-required and alb-http-to-https-redirection-check, and pair with acm-certificate-expiration-check so the certs terminating TLS are valid. These three cover the dominant public data paths; extend to the services you actually run (e.g. api-gw-ssl-enabled, elasticsearch-node-to-node-encryption-check). ELB_TLS_HTTPS_LISTENERS_ONLY evaluates Classic Load Balancers only and returns NOT_APPLICABLE where there is no listener, so on an ALB/NLB estate that assertion passes having examined nothing; whether the TLS that terminates is FIPS-validated is carried by the listener's SslPolicy, which no command here reads, and a human confirms it — SC-08 (01) is not claimed. ## References - {"title":"AWS Config managed rule: s3-bucket-ssl-requests-only","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html"} - {"title":"AWS Config managed rule: elb-tls-https-listeners-only","url":"https://docs.aws.amazon.com/config/latest/developerguide/elb-tls-https-listeners-only.html"} - {"title":"AWS Config managed rule: redshift-require-tls-ssl","url":"https://docs.aws.amazon.com/config/latest/developerguide/redshift-require-tls-ssl.html"} --- ## https://ramprules.com/collect/config-kms-key-management # AWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-kms-key-management Recipe id: `config-kms-key-management` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - KSI `KSI-SVC-VRI` - control `sc-13` ## Collection Kind: `config-rule` ```sh # cmk-backing-key-rotation-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cmk-backing-key-rotation-enabled --compliance-types NON_COMPLIANT # kms-cmk-not-scheduled-for-deletion aws configservice get-compliance-details-by-config-rule --config-rule-name kms-cmk-not-scheduled-for-deletion --compliance-types NON_COMPLIANT ``` ## Expected output Two EvaluationResults arrays; empty NON_COMPLIANT sets mean automatic rotation is enabled on every eligible customer-managed CMK and no CMK protecting live data is pending deletion. Managed rule identifiers: CMK_BACKING_KEY_ROTATION_ENABLED, KMS_CMK_NOT_SCHEDULED_FOR_DELETION ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config and both managed rules are available in AWS GovCloud (US); KMS key ARNs use partition arn:aws-us-gov. GovCloud is served by FIPS 140-validated KMS endpoints by default ## Notes Rated partial: these rules prove key management (rotation, retention) as telemetry, but SC-13's core requirement — that the cryptographic module itself is FIPS 140-2/3 validated — is satisfied by using AWS KMS FIPS endpoints (kms-fips..amazonaws.com) and validated modules, which is a documented configuration/architecture assertion the compliance result does not itself carry. Attach the KMS FIPS endpoint usage evidence and the CMP module certificate reference alongside these results. Rotation is not supported for asymmetric/HMAC/imported-material/custom-key-store keys — scope the rotation rule accordingly. ## References - {"title":"AWS Config managed rule: cmk-backing-key-rotation-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cmk-backing-key-rotation-enabled.html"} - {"title":"AWS Config managed rule: kms-cmk-not-scheduled-for-deletion","url":"https://docs.aws.amazon.com/config/latest/developerguide/kms-cmk-not-scheduled-for-deletion.html"} - {"title":"Data protection in AWS KMS — FIPS 140-3 validated HSMs and FIPS endpoints","url":"https://docs.aws.amazon.com/kms/latest/developerguide/data-protection.html"} --- ## https://ramprules.com/collect/config-network-boundary-protection # AWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-network-boundary-protection Recipe id: `config-network-boundary-protection` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-ULN` - KSI `KSI-SVC-EIS` - control `sc-7` ## Collection Kind: `config-rule` ```sh # restricted-ssh aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-ssh --compliance-types NON_COMPLIANT # vpc-sg-open-only-to-authorized-ports aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-sg-open-only-to-authorized-ports --compliance-types NON_COMPLIANT # vpc-default-security-group-closed aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # restricted-ssh-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh # vpc-sg-open-only-to-authorized-ports-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-sg-open-only-to-authorized-ports # vpc-default-security-group-closed-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-default-security-group-closed # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Three EvaluationResults arrays; empty NON_COMPLIANT sets mean no security group leaves SSH (port 22) open to 0.0.0.0/0 or ::/0, any internet-open group is limited to the authorizedTcpPorts/authorizedUdpPorts you set, and every default security group is closed. Managed rule identifiers: INCOMING_SSH_DISABLED (rule name restricted-ssh), VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS, VPC_DEFAULT_SECURITY_GROUP_CLOSED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"restricted-ssh.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"No security group exposes port 22 to 0.0.0.0/0 or ::/0."} - {"field":"vpc-sg-open-only-to-authorized-ports.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"Any internet-open security group is limited to the ports you declared authorized."} - {"field":"vpc-default-security-group-closed.EvaluationResults","op":"count_eq","value":0,"controls":["sc-7"],"description":"Every VPC default security group denies all inbound and outbound traffic."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-7"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"restricted-ssh has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"restricted-ssh has a successful evaluation on record."} - {"field":"vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"vpc-sg-open-only-to-authorized-ports has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"vpc-sg-open-only-to-authorized-ports has a successful evaluation on record."} - {"field":"vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-7"],"description":"vpc-default-security-group-closed has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-7"],"description":"vpc-default-security-group-closed has a successful evaluation on record."} ## GovCloud AWS Config and all three managed rules are available in AWS GovCloud (US); VPC and security-group ARNs use partition arn:aws-us-gov ## Notes Set VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS parameters (authorizedTcpPorts/authorizedUdpPorts) to your documented ingress allow-list, otherwise any 0.0.0.0/0 rule is NON_COMPLIANT. These three cover security-group ingress; for full SC-07 boundary evidence also collect NACL and subnet routing posture and, where used, restricted-common-ports and vpc-flow-logs-enabled. Note VPC_DEFAULT_SECURITY_GROUP_CLOSED may lag on deleted VPCs until the next baselining pass. These three rules read security-group ingress and nothing else; SC-07(b) — the logical separation FedRAMP's own guidance singles out — plus NACLs, route tables, gateways and VPC endpoints are a human's architecture assertion against this output. MAS-CSO-FLO is not claimed: its artifact is the enumeration of permitted connections, and a NON_COMPLIANT filter is empty on a compliant estate. ## References - {"title":"AWS Config managed rule: restricted-ssh (INCOMING_SSH_DISABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html"} - {"title":"AWS Config managed rule: vpc-sg-open-only-to-authorized-ports","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-sg-open-only-to-authorized-ports.html"} - {"title":"AWS Config managed rule: vpc-default-security-group-closed","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"} --- ## https://ramprules.com/collect/config-cloudtrail-audit-logging # AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-cloudtrail-audit-logging Recipe id: `config-cloudtrail-audit-logging` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-OSM` - KSI `KSI-MLA-LET` - control `au-2` - control `au-9` - control `au-12` ## Collection Kind: `config-rule` ```sh # cloudtrail-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cloudtrail-enabled --compliance-types NON_COMPLIANT # multi-region-cloudtrail-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name multi-region-cloudtrail-enabled --compliance-types NON_COMPLIANT # cloud-trail-log-file-validation-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT # cloud-trail-encryption-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-encryption-enabled --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # cloudtrail-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names cloudtrail-enabled # multi-region-cloudtrail-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names multi-region-cloudtrail-enabled # cloud-trail-log-file-validation-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-log-file-validation-enabled # cloud-trail-encryption-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-encryption-enabled # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Four EvaluationResults arrays; empty NON_COMPLIANT sets mean a trail is enabled, at least one trail is multi-region, log-file validation (SHA-256 signed digest) is on, and the trail delivers SSE-KMS-encrypted logs. Managed rule identifiers: CLOUD_TRAIL_ENABLED (rule name cloudtrail-enabled), MULTI_REGION_CLOUD_TRAIL_ENABLED (rule name multi-region-cloudtrail-enabled), CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, CLOUD_TRAIL_ENCRYPTION_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"cloudtrail-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-2","au-12"],"description":"A CloudTrail trail is enabled, so audit records are generated at all."} - {"field":"multi-region-cloudtrail-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-2"],"description":"At least one trail is multi-region, so the record covers management events account-wide rather than in one Region."} - {"field":"cloud-trail-log-file-validation-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-9"],"description":"Log-file validation is on, so delivered logs carry a signed digest and tampering is detectable."} - {"field":"cloud-trail-encryption-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-9"],"description":"The trail delivers SSE-KMS-encrypted logs, protecting the audit information at rest."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloudtrail-enabled has a successful evaluation on record."} - {"field":"multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"multi-region-cloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"multi-region-cloudtrail-enabled has a successful evaluation on record."} - {"field":"cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloud-trail-log-file-validation-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloud-trail-log-file-validation-enabled has a successful evaluation on record."} - {"field":"cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloud-trail-encryption-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloud-trail-encryption-enabled has a successful evaluation on record."} ## GovCloud AWS Config, CloudTrail, and all four managed rules are available in AWS GovCloud (US); trail, bucket, and KMS key ARNs use partition arn:aws-us-gov ## Notes Together these prove audit-record generation (AU-02/AU-12) and protection of the audit information — integrity via log-file validation and confidentiality via SSE-KMS (AU-09). This is the trail's existence and protection, not review of its contents: pair with the log-review/alerting recipe (MLA) for AU-06. Pass the S3/CloudWatch parameters to CLOUD_TRAIL_ENABLED to assert delivery to your specific log destination. A trail existing proves generation, not content — AU-03 is not claimed, because no Config rule reads record content. AU-02's organization-defined event types and AU-12's component list (OS, container and application audit are components) are SSP parameters a human compares this output against, and AU-09's protection from unauthorized access and deletion needs the log bucket's policy, Object Lock and MFA-delete posture, which is not collected here. ## References - {"title":"AWS Config managed rule: cloudtrail-enabled (CLOUD_TRAIL_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-enabled.html"} - {"title":"AWS Config managed rule: multi-region-cloudtrail-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/multi-region-cloudtrail-enabled.html"} - {"title":"AWS Config managed rule: cloud-trail-log-file-validation-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-log-file-validation-enabled.html"} - {"title":"AWS Config managed rule: cloud-trail-encryption-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-encryption-enabled.html"} --- ## https://ramprules.com/collect/config-threat-monitoring-enabled # AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-threat-monitoring-enabled Recipe id: `config-threat-monitoring-enabled` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-RVL` - KSI `KSI-SVC-EIS` - control `si-4` ## Collection Kind: `config-rule` ```sh # guardduty-enabled-centralized aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-enabled-centralized --compliance-types NON_COMPLIANT # securityhub-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-enabled --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # guardduty-enabled-centralized-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names guardduty-enabled-centralized # securityhub-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names securityhub-enabled # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Two EvaluationResults arrays; empty NON_COMPLIANT sets mean GuardDuty is enabled in the account/Region (and results land in the CentralMonitoringAccount if you set one) and Security Hub is enabled. Managed rule identifiers: GUARDDUTY_ENABLED_CENTRALIZED, SECURITYHUB_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"guardduty-enabled-centralized.EvaluationResults","op":"count_eq","value":0,"controls":["si-4"],"description":"GuardDuty is enabled in the account and Region, or in the CentralMonitoringAccount when one is named — the parameter moves where the rule looks; it does not prove this account reports anywhere."} - {"field":"securityhub-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["si-4"],"description":"Security Hub is enabled and aggregating control findings."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["si-4"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["si-4"],"description":"guardduty-enabled-centralized has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["si-4"],"description":"guardduty-enabled-centralized has a successful evaluation on record."} - {"field":"securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["si-4"],"description":"securityhub-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["si-4"],"description":"securityhub-enabled has a successful evaluation on record."} ## GovCloud AWS Config, GuardDuty, and Security Hub are available in AWS GovCloud (US); detector and hub ARNs use partition arn:aws-us-gov ## Notes This proves the monitoring capability is ON, which is the automatable half of SI-04. Whether findings are triaged and acted on within your SLA is the review workflow — surface that with the GuardDuty finding-plus-response recipe (see guardduty-suspicious-iam-activity-response) and AU-06 log review. Set CentralMonitoringAccount to your delegated-administrator account id in a multi-account org so member accounts are evaluated against the aggregation point. Both rules are evaluated per Region, so GuardDuty disabled in any Region other than the one queried is invisible; and whether findings are analyzed and acted on — SI-04(a), (b), (d) — is a human workflow. Partial for both reasons. ## References - {"title":"AWS Config managed rule: guardduty-enabled-centralized","url":"https://docs.aws.amazon.com/config/latest/developerguide/guardduty-enabled-centralized.html"} - {"title":"AWS Config managed rule: securityhub-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/securityhub-enabled.html"} --- ## https://ramprules.com/collect/config-data-backup-enabled # AWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-data-backup-enabled Recipe id: `config-data-backup-enabled` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-RPL-ABO` - control `cp-9` ## Collection Kind: `config-rule` ```sh # db-instance-backup-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name db-instance-backup-enabled --compliance-types NON_COMPLIANT # backup-plan-min-frequency-and-min-retention-check aws configservice get-compliance-details-by-config-rule --config-rule-name backup-plan-min-frequency-and-min-retention-check --compliance-types NON_COMPLIANT # configuration-recorder-status aws configservice describe-configuration-recorder-status # db-instance-backup-enabled-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names db-instance-backup-enabled # backup-plan-min-frequency-and-min-retention-check-evaluation-status aws configservice describe-config-rule-evaluation-status --config-rule-names backup-plan-min-frequency-and-min-retention-check # describe-regions aws ec2 describe-regions --query 'Regions[].RegionName' --output text # list-accounts aws organizations list-accounts --query 'Accounts[].Id' --output text ``` ## Expected output Two EvaluationResults arrays; empty NON_COMPLIANT sets mean every RDS DB instance has automated backups within your backupRetentionMinimum and every AWS Backup plan meets requiredFrequencyValue/requiredRetentionDays. Managed rule identifiers: DB_INSTANCE_BACKUP_ENABLED, BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran. ## Assertions - {"field":"db-instance-backup-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["cp-9"],"description":"Every RDS DB instance has automated backups meeting your retention minimum."} - {"field":"backup-plan-min-frequency-and-min-retention-check.EvaluationResults","op":"count_eq","value":0,"controls":["cp-9"],"description":"Every AWS Backup plan meets your required frequency and retention."} - {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["cp-9"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."} - {"field":"db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["cp-9"],"description":"db-instance-backup-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"db-instance-backup-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["cp-9"],"description":"db-instance-backup-enabled has a successful evaluation on record."} - {"field":"backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["cp-9"],"description":"backup-plan-min-frequency-and-min-retention-check has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."} - {"field":"backup-plan-min-frequency-and-min-retention-check-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["cp-9"],"description":"backup-plan-min-frequency-and-min-retention-check has a successful evaluation on record."} ## GovCloud AWS Config, RDS, and AWS Backup are available in AWS GovCloud (US); DB and backup-plan ARNs use partition arn:aws-us-gov ## Notes Set db-instance-backup-enabled's backupRetentionMinimum and backup-plan's requiredFrequencyValue/requiredFrequencyUnit/requiredRetentionDays to your CP-09 policy (defaults are 1/days and 35 days). These two cover RDS and AWS Backup-managed resources; for the other stores you run, add dynamodb-pitr-enabled, elasticache-redis-cluster-automatic-backup-check, and s3 versioning/replication as applicable. Backup existence is telemetry; the restore test that proves recoverability is CP-10's separate exercise — do not present a backup config as a successful restore. The frequency and retention that carry CP-09's organization-defined values live in the rule parameters, not in the output, so a human confirms they match the SSP; system documentation under CP-09(c) is never AWS telemetry. ## References - {"title":"AWS Config managed rule: db-instance-backup-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/db-instance-backup-enabled.html"} - {"title":"AWS Config managed rule: backup-plan-min-frequency-and-min-retention-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/backup-plan-min-frequency-and-min-retention-check.html"} --- ## https://ramprules.com/collect/ssm-configuration-baseline-enforced # AWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/ssm-configuration-baseline-enforced Recipe id: `ssm-configuration-baseline-enforced` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-ACM` - KSI `KSI-CMT-RMV` - KSI `KSI-MLA-EVC` - KSI `KSI-CNA-IBP` - control `cm-2` - control `cm-6` ## Collection Kind: `cli` ```sh # ec2-instance-managed-by-systems-manager aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-managed-by-systems-manager --compliance-types NON_COMPLIANT # ec2-managedinstance-association-compliance-status-check aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-association-compliance-status-check --compliance-types NON_COMPLIANT # list-associations aws ssm list-associations --query 'Associations[].{Name:Name,AssociationId:AssociationId,Schedule:ScheduleExpression,Targets:Targets,Status:Overview.Status,LastRun:LastExecutionDate}' ``` ## Expected output Two EvaluationResults arrays plus an Associations list. Empty NON_COMPLIANT sets mean every running EC2 instance has a running SSM Agent and every SSM association compliance record reads COMPLIANT after execution; the Associations list names the documents, schedules, and targets that carry the baseline, with Overview.Status and LastExecutionDate showing it ran. Managed rule identifiers: EC2_INSTANCE_MANAGED_BY_SSM (rule name ec2-instance-managed-by-systems-manager), EC2_MANAGEDINSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config and Systems Manager are available in AWS GovCloud (US); instance, document, and association ARNs use partition arn:aws-us-gov ## Notes The telemetry proves a configuration is being enforced and drift corrected — it does not prove the enforced content IS your approved baseline. That the association's SSM document encodes the hardened settings you baselined (CIS/STIG content, approved through your change process) is the human judgement half; keep the document version and its approval record alongside this output. Two limits to state plainly: EC2_INSTANCE_MANAGED_BY_SSM does not flag a stopped instance whose agent is running, and this whole recipe is EC2-only — container images, Lambda, and managed-service settings need their own baseline evidence. CM-08 inventory is a separate recipe, not this one. ## References - {"title":"AWS Config managed rule: ec2-instance-managed-by-systems-manager","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-managed-by-systems-manager.html"} - {"title":"AWS Config managed rule: ec2-managedinstance-association-compliance-status-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-association-compliance-status-check.html"} - {"title":"AWS Systems Manager State Manager (associations define the state to maintain)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.html"} - {"title":"AWS CLI: ssm list-associations","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-associations.html"} --- ## https://ramprules.com/collect/patch-and-vulnerability-remediation # Patch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install) > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/patch-and-vulnerability-remediation Recipe id: `patch-and-vulnerability-remediation` · cadence daily · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-VTD` - KSI `KSI-SCR-MON` - control `si-2` - control `ra-5` ## Collection Kind: `cli` ```sh # ec2-managedinstance-patch-compliance-status-check aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-patch-compliance-status-check --compliance-types NON_COMPLIANT # describe-instance-patch-states aws ssm describe-instance-patch-states --instance-ids i-0123456789abcdef0 --query 'InstancePatchStates[].{Node:InstanceId,Baseline:BaselineId,Missing:MissingCount,Failed:FailedCount,CriticalNonCompliant:CriticalNonCompliantCount,SecurityNonCompliant:SecurityNonCompliantCount,Operation:Operation,EndTime:OperationEndTime}' # batch-get-account-status aws inspector2 batch-get-account-status --account-ids # list-coverage aws inspector2 list-coverage --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_EC2_INSTANCE"}]}' ``` ## Expected output An EvaluationResults array with an empty NON_COMPLIANT set (every SSM patch-compliance record reads COMPLIANT), InstancePatchStates showing MissingCount/FailedCount/CriticalNonCompliantCount/SecurityNonCompliantCount at zero with a recent OperationEndTime, an account status whose resourceState.ec2/ecr/lambda read ENABLED, and coveredResources whose scanStatus.statusCode is ACTIVE with a recent lastScannedAt. Managed rule identifier: EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config, Systems Manager, and Amazon Inspector are available in AWS GovCloud (US-East) and (US-West); instance and finding ARNs use partition arn:aws-us-gov. Two GovCloud differences to record: Lambda code scanning is not available, and the Inspector plugin for Linux deep inspection is not FIPS compliant. ## Notes This proves flaws are detected and shows exactly what is still missing and when patching last ran — it does not prove the remediation clock was met. Whether an open finding sits inside your SI-02 timeframe, or carries an approved deviation or POA&M entry, is a judgement joined against your risk-acceptance record, not an API result. Substitute your real instance ids and account id; describe-instance-patch-states requires --instance-ids (use describe-instance-patch-states-for-patch-group to sweep a patch group). Note also that patch compliance data is a point-in-time snapshot and each successful scan overwrites the previous one, so capture the output at collection time rather than reconstructing history later. ## References - {"title":"AWS Config managed rule: ec2-managedinstance-patch-compliance-status-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-patch-compliance-status-check.html"} - {"title":"AWS CLI: ssm describe-instance-patch-states","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-patch-states.html"} - {"title":"Systems Manager Patch Manager: working with patch compliance reports","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-reports.html"} - {"title":"AWS CLI: inspector2 batch-get-account-status","url":"https://docs.aws.amazon.com/cli/latest/reference/inspector2/batch-get-account-status.html"} - {"title":"AWS CLI: inspector2 list-coverage","url":"https://docs.aws.amazon.com/cli/latest/reference/inspector2/list-coverage.html"} - {"title":"Amazon Inspector in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-inspector2.html"} --- ## https://ramprules.com/collect/cloudwatch-log-review-alerting # The metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/cloudwatch-log-review-alerting Recipe id: `cloudwatch-log-review-alerting` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-RVL` - control `au-6` - control `au-6.1` ## Collection Kind: `cli` ```sh # describe-metric-filters aws logs describe-metric-filters --query 'metricFilters[].{Filter:filterName,LogGroup:logGroupName,Pattern:filterPattern,Metric:metricTransformations[0].metricName}' # describe-alarms aws cloudwatch describe-alarms --alarm-types MetricAlarm CompositeAlarm --query 'MetricAlarms[].{Name:AlarmName,Metric:MetricName,State:StateValue,Actions:AlarmActions}' # cloudwatch-alarm-action-check aws configservice get-compliance-details-by-config-rule --config-rule-name cloudwatch-alarm-action-check --compliance-types NON_COMPLIANT ``` ## Expected output A metricFilters list showing each audit pattern you watch for and the metric it publishes, a matching alarm for each with a non-empty AlarmActions (the SNS topic or response action it fires), and an empty NON_COMPLIANT EvaluationResults set meaning no alarm is configured without an action. Managed rule identifier: CLOUDWATCH_ALARM_ACTION_CHECK ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud CloudWatch, CloudWatch Logs, and AWS Config are available in AWS GovCloud (US); log-group, alarm, and SNS topic ARNs use partition arn:aws-us-gov ## Notes AU-06 asks that audit records be reviewed and analysed and findings reported; AU-06.01 asks that the review use automated mechanisms. What these calls prove is the automated half — the pipeline exists, it fires, and it reaches a human. No API proves a person read the alert, judged it, and reported the finding, so pair this with your ticket or case record; do not present an alarm list as a completed review. Metric filters only publish for events after the filter was created and are supported only on Standard-class log groups, so a filter created yesterday says nothing about last month. cloudwatch-alarm-action-check defaults to requiring an ALARM and INSUFFICIENT_DATA action; pass action1..action5 to assert alarms route to a specific SNS topic. Trail existence and protection is the separate cloudtrail recipe (AU-02/03/09/12). ## References - {"title":"Creating metrics from log events using filters (CloudWatch Logs metric filters)","url":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html"} - {"title":"AWS CLI: logs describe-metric-filters","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"} - {"title":"AWS CLI: cloudwatch describe-alarms","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"} - {"title":"AWS Config managed rule: cloudwatch-alarm-action-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudwatch-alarm-action-check.html"} --- ## https://ramprules.com/collect/config-asset-inventory # The machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-asset-inventory Recipe id: `config-asset-inventory` · cadence daily · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-PIY-GIV` - KSI `KSI-CMT-RMV` - KSI `KSI-SVC-ACM` - control `cm-2.2` - control `cm-8` - control `cm-8.1` ## Collection Kind: `cli` ```sh # configuration-recorder-status aws configservice describe-configuration-recorder-status --query 'ConfigurationRecordersStatus[].{Name:name,Recording:recording,LastStatus:lastStatus,LastStart:lastStartTime,Error:lastErrorMessage}' # get-discovered-resource-counts aws configservice get-discovered-resource-counts # select-resource-config aws configservice select-resource-config --expression "SELECT resourceId, resourceType, awsRegion WHERE resourceType = 'AWS::EC2::Instance'" # get-inventory aws ssm get-inventory --aggregators Expression=AWS:InstanceInformation.PlatformType # list-inventory-entries aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:Application ``` ## Expected output A recorder status with recording true and lastStatus SUCCESS — read this first, because a stopped or failing recorder makes everything below stale — then a resourceCounts array giving a count per resourceType alongside totalDiscoveredResources, a Results list naming each recorded resource of the type you queried, an aggregation of managed nodes grouped by platform, and an Entries list of installed applications stamped with the CaptureTime they were collected. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config and Systems Manager Inventory are available in AWS GovCloud (US-East) and (US-West); resource and node ARNs use partition arn:aws-us-gov ## Notes This proves the inventory is machine-maintained and current (CM-08.01, and the automated-currency half of CM-02.02) — it does not prove the inventory is complete. Config sees only supported resource types, only in the regions and accounts where a recorder runs, and only within the recording group you configured; unsupported types, an un-recorded region, on-premises hosts, SaaS components and in-container software are invisible here and need their own source. SSM Inventory covers only managed nodes with a running agent and an inventory association, collects no more often than every 30 minutes, and the console's Inventory cards hide stopped and terminated nodes even though the API still returns them. The accountability attributes CM-08 asks for — system owner, function, criticality — live in your tags or CMDB, not in a resource count, so join them before calling this an inventory. Substitute your real instance id. Detecting unauthorized components (CM-08.03) is a different question; the prohibited-software half is in the least-functionality recipe. ## References - {"title":"AWS CLI: configservice describe-configuration-recorder-status","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-configuration-recorder-status.html"} - {"title":"AWS CLI: configservice get-discovered-resource-counts","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/get-discovered-resource-counts.html"} - {"title":"AWS CLI: configservice select-resource-config","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/select-resource-config.html"} - {"title":"AWS Config advanced query: SELECT query components","url":"https://docs.aws.amazon.com/config/latest/developerguide/query-components.html"} - {"title":"AWS Systems Manager Inventory","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html"} - {"title":"AWS CLI: ssm get-inventory","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/get-inventory.html"} - {"title":"AWS CLI: ssm list-inventory-entries","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-inventory-entries.html"} --- ## https://ramprules.com/collect/cloudtrail-config-change-history # Who changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approval > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/cloudtrail-config-change-history Recipe id: `cloudtrail-config-change-history` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-LMC` - KSI `KSI-CMT-RVP` - KSI `KSI-CMT-RMV` - KSI `KSI-CMT-VTD` - control `cm-3` ## Collection Kind: `cli` ```sh # lookup-events-false aws cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false --start-time --end-time 2026-07-31T23:59:59Z --query 'Events[].{Event:EventName,Time:EventTime,User:Username,Source:EventSource,Resources:Resources}' # get-resource-config-history aws configservice get-resource-config-history --resource-type AWS::EC2::SecurityGroup --resource-id sg-0123456789abcdef0 --chronological-order Reverse # describe-automation-executions aws ssm describe-automation-executions --filters Key=AutomationSubtype,Values=ChangeRequest --query 'AutomationExecutionMetadataList[].{Id:AutomationExecutionId,Document:DocumentName,Status:AutomationExecutionStatus,Mode:Mode,By:ExecutedBy,Start:ExecutionStartTime,End:ExecutionEndTime}' ``` ## Expected output An Events list in which each entry names the EventName, EventTime, Username, EventSource and the resources touched, with CloudTrailEvent carrying the full request parameters; a configurationItems list ordered newest-first whose configurationItemCaptureTime and configurationStateId let you diff the resource across the change and whose relationships show what else it touched; and, where Change Manager applies, an AutomationExecutionMetadataList of AutomationSubtype ChangeRequest showing the runbook, Mode, ExecutedBy and the start and end of the workflow. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud CloudTrail and AWS Config are available in AWS GovCloud (US); trail, resource, and automation ARNs use partition arn:aws-us-gov. Systems Manager Change Manager is NOT available in the AWS GovCloud (US) Regions — drop the third command there and evidence approvals from your own change-management system instead. ## Notes CloudTrail and Config prove a change was recorded and is reconstructable — actor, time, parameters, and the before/after configuration state — which is CM-03's record-retention and monitoring half. They do not prove the change was proposed, reviewed and approved before it happened; that decision lives in your CCB or ticketing system and has to be joined by ticket or change id. State the retention limits plainly rather than implying full history: lookup-events reaches back only 90 days and returns management (and Insights) events only, so anything older must be read from the trail's S3 objects or a CloudTrail Lake event data store, and get-resource-config-history honours your Config retention period (30 days minimum, up to 7 years) but each call spans at most 7 days, so a long window needs paging by time. Substitute your real resource type, resource id and time window. Change Manager has also been closed to new customers since 2025-11-07, so treat that command as available only if you were already signed up. Whether the post-change configuration is still compliant is a different question answered by the Config rule recipes. ## References - {"title":"AWS CLI: cloudtrail lookup-events (90-day lookup window)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} - {"title":"AWS CLI: configservice get-resource-config-history","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/get-resource-config-history.html"} - {"title":"AWS Systems Manager Change Manager (change templates, approvals, auditing)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/change-manager.html"} - {"title":"AWS CLI: ssm describe-automation-executions (AutomationSubtype filter)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-automation-executions.html"} - {"title":"AWS Systems Manager in AWS GovCloud (US) — Change Manager not available","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ssm.html"} --- ## https://ramprules.com/collect/config-least-functionality # Config compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to read > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/config-least-functionality Recipe id: `config-least-functionality` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-RMV` - KSI `KSI-SVC-EIS` - KSI `KSI-CNA-RNT` - control `cm-7` - control `cm-7.1` ## Collection Kind: `cli` ```sh # restricted-common-ports aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-common-ports --compliance-types NON_COMPLIANT # ec2-managedinstance-applications-blacklisted aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-applications-blacklisted --compliance-types NON_COMPLIANT # list-inventory-entries aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:Application ``` ## Expected output Two EvaluationResults arrays plus an inventory listing. Empty NON_COMPLIANT sets mean no security group opens a blocked TCP port to 0.0.0.0/0 or ::/0 and none of the denylisted applications is installed on any evaluated managed node; the Entries list, stamped with its CaptureTime, is the installed-software set your periodic review actually reads. Managed rule identifiers: RESTRICTED_INCOMING_TRAFFIC (rule name restricted-common-ports), EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config, both managed rules, and Systems Manager Inventory are available in AWS GovCloud (US); security-group and node ARNs use partition arn:aws-us-gov ## Notes These prove the negatives you asserted and hand the reviewer the real installed-application set — they do not prove least functionality. That the functions, ports, protocols and services still enabled are the minimum necessary is a judgement against your documented essential-capability list, and CM-07.01's periodic review is a decision someone makes and records, not an API result; keep the review record next to this output. Both rules are only as strong as their parameters. RESTRICTED_INCOMING_TRAFFIC defaults to blocking TCP 20, 21, 3389, 3306 and 4333 — set blockedPorts to your real denylist or you are testing AWS's defaults, not your policy. EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED needs exact application names (no wildcards, and the name differs per distro) and evaluates AWS::SSM::ManagedInstanceInventory, so a node with no running agent or inventory association is simply not evaluated rather than flagged — pair it with the inventory recipe's coverage check. Security-group ingress deliberately overlaps the SC-07 boundary recipe: there it proves boundary protection, here it proves unnecessary ports are closed. ## References - {"title":"AWS Config managed rule: restricted-common-ports (RESTRICTED_INCOMING_TRAFFIC)","url":"https://docs.aws.amazon.com/config/latest/developerguide/restricted-common-ports.html"} - {"title":"AWS Config managed rule: ec2-managedinstance-applications-blacklisted","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-applications-blacklisted.html"} - {"title":"AWS CLI: ssm list-inventory-entries","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-inventory-entries.html"} --- ## https://ramprules.com/collect/backup-restore-testing # Restore jobs that actually ran — the schedule they ran on, whether each one completed, how long it took, and what it produced — plus the point-in-time recovery window that makes transaction-level recovery possible > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/backup-restore-testing Recipe id: `backup-restore-testing` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-RPL-ABO` - KSI `KSI-RPL-ARP` - KSI `KSI-RPL-RRO` - KSI `KSI-RPL-TRC` - control `cp-10` - control `cp-10.2` ## Collection Kind: `cli` ```sh # list-restore-testing-plans aws backup list-restore-testing-plans --query 'RestoreTestingPlans[].{Plan:RestoreTestingPlanName,Schedule:ScheduleExpression,LastRun:LastExecutionTime,StartWindowHours:StartWindowHours}' # list-restore-jobs aws backup list-restore-jobs --by-created-after 2026-04-01T00:00:00Z --query 'RestoreJobs[].{Id:RestoreJobId,Type:ResourceType,Status:Status,Message:StatusMessage,Created:CreationDate,Completed:CompletionDate,Validation:ValidationStatus,Restored:CreatedResourceArn}' # list-protected-resources aws backup list-protected-resources --query 'Results[].{Arn:ResourceArn,Type:ResourceType,LastBackup:LastBackupTime,LastRecoveryPoint:LastRecoveryPointArn}' # aurora-resources-protected-by-backup-plan aws configservice get-compliance-details-by-config-rule --config-rule-name aurora-resources-protected-by-backup-plan --compliance-types NON_COMPLIANT # rds-in-backup-plan aws configservice get-compliance-details-by-config-rule --config-rule-name rds-in-backup-plan --compliance-types NON_COMPLIANT # describe-db-instances aws rds describe-db-instances --query 'DBInstances[].{Db:DBInstanceIdentifier,RetentionDays:BackupRetentionPeriod,LatestRestorable:LatestRestorableTime}' # dynamodb-pitr-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name dynamodb-pitr-enabled --compliance-types NON_COMPLIANT ``` ## Expected output A RestoreTestingPlans list whose ScheduleExpression is the cron your recovery policy claims and whose LastExecutionTime proves the schedule is actually firing; a RestoreJobs list in which each job carries a Status of COMPLETED (the other states are PENDING, RUNNING, ABORTED and FAILED, with StatusMessage explaining a failure), a CreationDate and CompletionDate whose difference is the measured restore time, a CreatedResourceArn naming what was rebuilt, and a ValidationStatus of SUCCESSFUL, FAILED, TIMED_OUT or VALIDATING only where you wired validation; a Results list of protected resources each stamped with LastBackupTime; two empty NON_COMPLIANT sets; and a DB instance list whose LatestRestorableTime — the most recent point a PITR restore can target — sits within minutes of now, bounded by BackupRetentionPeriod days of history. Managed rule identifiers: AURORA_RESOURCES_PROTECTED_BY_BACKUP_PLAN, RDS_IN_BACKUP_PLAN, DYNAMODB_PITR_ENABLED ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Backup, AWS Config, RDS and DynamoDB are available in AWS GovCloud (US-East) and (US-West); resource, plan and recovery-point ARNs use partition arn:aws-us-gov. Restore testing is NOT available in AWS GovCloud (US) — drop the first command there, run your restore exercises on demand with backup start-restore-job, and evidence them from the same list-restore-jobs output (the jobs simply will not carry a restore testing plan ARN). Backup Audit Manager multi-account, multi-Region reporting is also unavailable, and cross-Region copy works only between the two GovCloud Regions, never in or out of them. ## Notes A completed restore job is the strongest recovery evidence AWS emits, and it is still not the whole of CP-10. It proves a recovery point could be materialised into a resource and how long that took; it does not prove the restored system is functionally correct, that the data inside it is intact, or that the reconstitution ran to a known operational state. ValidationStatus does not close that gap either — restore testing validation is an EventBridge-triggered workflow you write, and PutRestoreValidationResult records whatever your own Lambda asserted, so treat it as your test result, not AWS's verdict (and note it cannot be set from the console, and once set it cannot be changed). RTO and RPO conformance is arithmetic you perform, not a field: compare CompletionDate minus CreationDate against your RTO, and the gap between LastBackupTime (or LatestRestorableTime) and the incident against your RPO. Restore testing also deletes the restored resource when the retention window closes, tagging it awsbackup-restore-test, so there is no lasting artifact beyond the job record — capture the output at collection time. Scope caveats: restore testing supports a fixed resource-type list (Aurora, DocumentDB, DynamoDB, EBS, EC2, EFS, FSx, Neptune, RDS, S3), rds-in-backup-plan evaluates AWS::RDS::DBInstance and AWS's own documentation notes it applies only to Aurora DB instances with clusters unsupported (aurora-resources-protected-by-backup-plan is the DB-cluster rule), and aurora-resources-protected-by-backup-plan is unavailable in a handful of Regions, none of them GovCloud. Backup existence is the CP-09 recipe's job; this recipe deliberately starts where that one stops. ## References - {"title":"AWS Backup: Restore testing (plans, jobs, validation window, resource types)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing.html"} - {"title":"AWS Backup: Restore testing validation (PutRestoreValidationResult)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/restore-testing-validation.html"} - {"title":"AWS CLI: backup list-restore-testing-plans","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-restore-testing-plans.html"} - {"title":"AWS CLI: backup list-restore-jobs (status and validation fields)","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-restore-jobs.html"} - {"title":"AWS CLI: backup list-protected-resources","url":"https://docs.aws.amazon.com/cli/latest/reference/backup/list-protected-resources.html"} - {"title":"AWS Config managed rule: aurora-resources-protected-by-backup-plan","url":"https://docs.aws.amazon.com/config/latest/developerguide/aurora-resources-protected-by-backup-plan.html"} - {"title":"AWS Config managed rule: rds-in-backup-plan","url":"https://docs.aws.amazon.com/config/latest/developerguide/rds-in-backup-plan.html"} - {"title":"AWS Config managed rule: dynamodb-pitr-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/dynamodb-pitr-enabled.html"} - {"title":"AWS CLI: rds describe-db-instances (LatestRestorableTime, BackupRetentionPeriod)","url":"https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-instances.html"} - {"title":"AWS Backup in AWS GovCloud (US) — restore testing not available","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-bkp.html"} --- ## https://ramprules.com/collect/audit-log-retention-and-delivery-failure # How long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/audit-log-retention-and-delivery-failure Recipe id: `audit-log-retention-and-delivery-failure` · cadence daily · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-OSM` - control `au-4` - control `au-5` - control `au-11` ## Collection Kind: `cli` ```sh # describe-log-groups aws logs describe-log-groups --query 'logGroups[].{Group:logGroupName,RetentionDays:retentionInDays,StoredBytes:storedBytes,Class:logGroupClass}' # cw-loggroup-retention-period-check aws configservice get-compliance-details-by-config-rule --config-rule-name cw-loggroup-retention-period-check --compliance-types NON_COMPLIANT # get-bucket-lifecycle-configuration aws s3api get-bucket-lifecycle-configuration --bucket # s3-lifecycle-policy-check aws configservice get-compliance-details-by-config-rule --config-rule-name s3-lifecycle-policy-check --compliance-types NON_COMPLIANT # get-metric-statistics aws cloudwatch get-metric-statistics --namespace AWS/S3 --metric-name BucketSizeBytes --dimensions Name=BucketName,Value= Name=StorageType,Value=StandardStorage --start-time --end-time --period 86400 --statistics Average # get-trail-status aws cloudtrail get-trail-status --name --query '{Logging:IsLogging,LastDelivery:LatestDeliveryTime,DeliveryError:LatestDeliveryError,DigestDelivery:LatestDigestDeliveryTime,DigestError:LatestDigestDeliveryError,NotificationError:LatestNotificationError}' # cloud-trail-cloud-watch-logs-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-cloud-watch-logs-enabled --compliance-types NON_COMPLIANT ``` ## Expected output A log-group list in which every group carries the retentionInDays your policy requires and a storedBytes you can trend — a group with no retentionInDays at all never expires; an empty NON_COMPLIANT set from the retention rule, meaning no group falls below MinRetentionTime (default 365 days); a Rules array on the log bucket with an Enabled rule whose Transitions and Expiration match your archive and deletion policy, or a NoSuchLifecycleConfiguration error if none is set; a daily BucketSizeBytes series showing the log store's growth curve against whatever headroom you provisioned; and a trail status with IsLogging true, a LatestDeliveryTime within the last few minutes, and LatestDeliveryError, LatestDigestDeliveryError and LatestNotificationError all absent — a populated error field is the audit-logging-process failure AU-05 is about. Managed rule identifiers: CW_LOGGROUP_RETENTION_PERIOD_CHECK, S3_LIFECYCLE_POLICY_CHECK, CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud CloudWatch Logs, Amazon S3, CloudTrail, AWS Config and CloudWatch metrics are all available in AWS GovCloud (US); log-group, bucket and trail ARNs use partition arn:aws-us-gov ## Notes This is the capacity and durability of the audit pipeline, not proof that it is adequate. AU-04 asks that storage capacity be sufficient for your defined requirement — S3 has no fixed ceiling to report, so the honest evidence is the consumption trend plus the retention and lifecycle settings that bound it, and the judgement that the headroom is enough stays yours. AU-05 is answered here only in its detection half: get-trail-status surfaces the delivery failure, and the alerting and the real-time response — notify these people, shut down or overwrite oldest records — is process, with the alarm-side telemetry living in the AU-06 log-review recipe (CLOUDWATCH_ALARM_ACTION_CHECK). AU-11 is the retention setting, which these commands read directly, but conformance to your record-retention period is a comparison against policy: note that cw-loggroup-retention-period-check marks a Never-expire group COMPLIANT, so an unbounded group passes the rule while potentially violating a maximum-retention or data-disposal requirement — read the raw retentionInDays, not just the rule verdict. Substitute your real bucket, trail and window; run get-trail-status per trail (it is a single-trail call) and against the trail's home Region. BucketSizeBytes is a once-daily storage metric and CloudWatch metric delivery is best-effort, so a missing data point is not by itself an incident. Pass expectedDeliveryWindowAge to cloud-trail-cloud-watch-logs-enabled if you want the rule to fail on stale delivery rather than only on an unconfigured CloudWatch Logs destination; the trail's existence, integrity and encryption are the AU-02/03/09/12 recipe's job. ## References - {"title":"AWS CLI: logs describe-log-groups (retentionInDays, storedBytes, logGroupClass)","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html"} - {"title":"AWS Config managed rule: cw-loggroup-retention-period-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/cw-loggroup-retention-period-check.html"} - {"title":"AWS CLI: s3api get-bucket-lifecycle-configuration","url":"https://docs.aws.amazon.com/cli/latest/reference/s3api/get-bucket-lifecycle-configuration.html"} - {"title":"AWS Config managed rule: s3-lifecycle-policy-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-lifecycle-policy-check.html"} - {"title":"Amazon S3 CloudWatch metrics and dimensions (BucketSizeBytes, daily storage metrics)","url":"https://docs.aws.amazon.com/AmazonS3/latest/userguide/metrics-dimensions.html"} - {"title":"AWS CLI: cloudtrail get-trail-status (LatestDeliveryError, LatestDigestDeliveryError)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/get-trail-status.html"} - {"title":"AWS Config managed rule: cloud-trail-cloud-watch-logs-enabled (expectedDeliveryWindowAge)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-cloud-watch-logs-enabled.html"} --- ## https://ramprules.com/collect/boundary-access-points-and-default-deny # Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/boundary-access-points-and-default-deny Recipe id: `boundary-access-points-and-default-deny` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-MAT` - KSI `KSI-CNA-RNT` - control `sc-7.3` - control `sc-7.4` - control `sc-7.5` ## Collection Kind: `cli` ```sh # describe-internet-gateways aws ec2 describe-internet-gateways --query 'InternetGateways[].{Igw:InternetGatewayId,Attachments:Attachments[].{Vpc:VpcId,State:State}}' # describe-nat-gateways aws ec2 describe-nat-gateways --query 'NatGateways[].{Nat:NatGatewayId,State:State,Vpc:VpcId,Subnet:SubnetId,Connectivity:ConnectivityType}' # describe-vpc-endpoints aws ec2 describe-vpc-endpoints --query 'VpcEndpoints[].{Endpoint:VpcEndpointId,Type:VpcEndpointType,Service:ServiceName,Vpc:VpcId,State:State}' # describe-vpn-connections aws ec2 describe-vpn-connections --query 'VpnConnections[].{Vpn:VpnConnectionId,State:State,Category:Category,Tunnels:VgwTelemetry[].{Ip:OutsideIpAddress,Status:Status,Changed:LastStatusChange}}' # describe-network-acls aws ec2 describe-network-acls --query 'NetworkAcls[].{Acl:NetworkAclId,Default:IsDefault,Vpc:VpcId,Entries:Entries[].{Rule:RuleNumber,Action:RuleAction,Egress:Egress,Cidr:CidrBlock,Protocol:Protocol}}' # describe-firewall-policy aws network-firewall describe-firewall-policy --firewall-policy-name --query 'FirewallPolicy.{Stateless:StatelessDefaultActions,Fragments:StatelessFragmentDefaultActions,Stateful:StatefulDefaultActions}' # vpc-default-security-group-closed aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT # subnet-auto-assign-public-ip-disabled aws configservice get-compliance-details-by-config-rule --config-rule-name subnet-auto-assign-public-ip-disabled --compliance-types NON_COMPLIANT # netfw-policy-default-action-full-packets aws configservice get-compliance-details-by-config-rule --config-rule-name netfw-policy-default-action-full-packets --compliance-types NON_COMPLIANT ``` ## Expected output A short, closed list of access points you can put next to your documented boundary: one internet gateway per VPC that is meant to have one and none attached to a VPC that is not, NAT gateways whose ConnectivityType matches whether that subnet is supposed to reach the internet at all, VPC endpoints that keep service traffic off the internet, and VPN connections whose VgwTelemetry shows both tunnels UP with a LastStatusChange that is not flapping. On the deny side: network ACL Entries in which no allow rule opens a CIDR wider than your documented exceptions, an empty NON_COMPLIANT set from vpc-default-security-group-closed meaning every VPC's default security group carries no inbound or outbound rule at all, an empty set from subnet-auto-assign-public-ip-disabled meaning no subnet hands instances a public address on launch, and a firewall policy whose StatelessDefaultActions and StatelessFragmentDefaultActions are aws:drop (or aws:forward_to_sfe into a stateful engine whose StatefulDefaultActions is aws:drop_strict) rather than aws:pass. Managed rule identifiers: VPC_DEFAULT_SECURITY_GROUP_CLOSED, SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED, NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS, NETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETS ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Amazon VPC, Amazon EC2, AWS Config and AWS Network Firewall are all available in AWS GovCloud (US) — the GovCloud user guide records no differences for Network Firewall — but the two Network Firewall managed rules (NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS and NETFW_POLICY_DEFAULT_ACTION_FRAGMENT_PACKETS) are explicitly unavailable in AWS GovCloud (US-East) and AWS GovCloud (US-West), so read the default actions straight from describe-firewall-policy there and drop the rule call; gateway, endpoint and firewall ARNs use partition arn:aws-us-gov ## Notes The inventory is telemetry; the limit is policy. SC-07.03 asks that external connections be held to the minimum needed and each one routed through a managed interface — these calls enumerate every gateway, endpoint and tunnel exactly, but whether that count is the minimum is a comparison against your documented architecture, and nothing in the API tells you a gateway is unnecessary. SC-07.04 is the weakest half here: describe-vpn-connections proves the tunnels exist and are up, but the control also wants each external telecommunications interface documented with its business need and traffic-flow policy, exceptions reviewed and removed — that record is a document, not a call. This recipe also does not cover carrier links terminated outside these APIs (AWS Direct Connect connections, Transit Gateway peering to another network); enumerate those separately if you use them. SC-07.05 is the closest to full: the default-deny posture of security groups, network ACLs and the firewall policy is directly readable, and vpc-default-security-group-closed is a clean pass/fail. Read the ACL Entries yourself rather than trusting a rule verdict — an allow entry with a low rule number can shadow everything below it, and no managed rule scores ordering. Substitute your real firewall policy name; describe-firewall-policy is one policy per call. Security-group ingress is covered by the SC-07 recipe (restricted-ssh, vpc-sg-open-only-to-authorized-ports) and not repeated here. ## References - {"title":"AWS CLI: ec2 describe-internet-gateways","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-internet-gateways.html"} - {"title":"AWS CLI: ec2 describe-nat-gateways (ConnectivityType)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-nat-gateways.html"} - {"title":"AWS CLI: ec2 describe-vpc-endpoints","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html"} - {"title":"AWS CLI: ec2 describe-vpn-connections (VgwTelemetry tunnel status)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpn-connections.html"} - {"title":"AWS CLI: ec2 describe-network-acls (Entries, RuleAction)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-network-acls.html"} - {"title":"AWS CLI: network-firewall describe-firewall-policy (StatelessDefaultActions)","url":"https://docs.aws.amazon.com/cli/latest/reference/network-firewall/describe-firewall-policy.html"} - {"title":"AWS Config managed rule: vpc-default-security-group-closed","url":"https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html"} - {"title":"AWS Config managed rule: subnet-auto-assign-public-ip-disabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/subnet-auto-assign-public-ip-disabled.html"} - {"title":"AWS Config managed rule: netfw-policy-default-action-full-packets (not available in GovCloud)","url":"https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-full-packets.html"} - {"title":"AWS Config managed rule: netfw-policy-default-action-fragment-packets (not available in GovCloud)","url":"https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-fragment-packets.html"} - {"title":"AWS Network Firewall in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-nf.html"} --- ## https://ramprules.com/collect/ddos-protection-and-rate-limiting # The denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath them > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/ddos-protection-and-rate-limiting Recipe id: `ddos-protection-and-rate-limiting` · cadence daily · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-RVP` - control `sc-5` ## Collection Kind: `cli` ```sh # describe-subscription aws shield describe-subscription --region us-east-1 --query 'Subscription.{Start:StartTime,End:EndTime,AutoRenew:AutoRenew,ProactiveEngagement:ProactiveEngagementStatus}' # list-protections aws shield list-protections --region us-east-1 --query 'Protections[].{Name:Name,Resource:ResourceArn,AutoAppLayerResponse:ApplicationLayerAutomaticResponseConfiguration.Status}' # list-attacks aws shield list-attacks --region us-east-1 --start-time FromInclusive=2026-04-27T00:00:00Z,ToExclusive=2026-07-27T00:00:00Z --query 'AttackSummaries[].{Attack:AttackId,Resource:ResourceArn,Start:StartTime,End:EndTime,Vectors:AttackVectors}' # list-web-acls aws wafv2 list-web-acls --scope REGIONAL --query 'WebACLs[].{Name:Name,Id:Id,Arn:ARN}' # get-web-acl aws wafv2 get-web-acl --name --scope REGIONAL --id --query 'WebACL.{Default:DefaultAction,Rules:Rules[].{Name:Name,Priority:Priority,Action:Action,RateBased:Statement.RateBasedStatement}}' # wafv2-logging-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name wafv2-logging-enabled --compliance-types NON_COMPLIANT # ddos-detected-metric aws cloudwatch get-metric-statistics --namespace AWS/DDoSProtection --metric-name DDoSDetected --dimensions Name=ResourceArn,Value= --start-time --end-time --period 3600 --statistics Maximum # waf-blocked-requests-metric aws cloudwatch get-metric-statistics --namespace AWS/WAFV2 --metric-name BlockedRequests --dimensions Name=WebACL,Value= Name=Rule,Value= Name=Region,Value= --start-time --end-time --period 3600 --statistics Sum ``` ## Expected output A Shield Advanced subscription whose EndTime is in the future and AutoRenew is ENABLED, and a Protections list that names every internet-facing resource in your boundary — a resource missing from that list has Shield Standard only and no protection record to show an assessor. A web ACL whose Rules include at least one RateBasedStatement carrying the Limit, EvaluationWindowSec and aggregation you documented, with a Block action rather than Count, and a DefaultAction you meant. An empty NON_COMPLIANT set from wafv2-logging-enabled, meaning every web ACL is logging (and, if you passed KinesisFirehoseDeliveryStreamArns, to the destination you named). Then the observation half: an AttackSummaries array — often empty, which is itself the finding for a quiet quarter — and CloudWatch series in which DDoSDetected stays at 0 except during events, and BlockedRequests shows the rate-based rule doing work. Managed rule identifiers: WAFV2_LOGGING_ENABLED, SHIELD_ADVANCED_ENABLED_AUTORENEW. Namespaces: AWS/DDoSProtection (DDoSDetected, DDoSAttackBitsPerSecond, DDoSAttackPacketsPerSecond, DDoSAttackRequestsPerSecond), AWS/WAFV2 (AllowedRequests, BlockedRequests, CountedRequests) ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS WAF is available in both AWS GovCloud (US) Regions, with one documented difference: only AWS-provided managed rule groups are usable — AWS Marketplace third-party rule groups are not. Shield is the awkward one: the Shield Response Team documentation states the SRT serves customers in AWS GovCloud (US-East) and (US-West), but the AWS General Reference lists a single Shield endpoint, shield.us-east-1.amazonaws.com, with no GovCloud entry, and the shield-advanced-enabled-autorenew managed rule is documented as available only in US East (N. Virginia) — so run the aws shield calls and that Config rule against us-east-1 and confirm your own account's GovCloud Shield coverage before you claim it. Web ACL and load-balancer ARNs use partition arn:aws-us-gov ## Notes This proves the mechanism, not the outcome. SC-5 asks that denial-of-service attacks be protected against or their effects limited: the configuration calls prove rate limiting and Shield are attached to the right resources, and list-attacks plus the DDoSProtection metrics prove detection and mitigation fired — but 'the effect on availability was limited' is a judgement you make against your own application health, error rates and capacity headroom, which are not in this output. Two honest gaps. Shield Standard, which protects every AWS customer automatically, has no API and no record to collect; if you are not subscribed to Shield Advanced there is nothing here to show beyond the WAF half, and describe-subscription simply errors. And the rate limit itself is a number you chose: a RateBasedStatement set far above real traffic passes every check while limiting nothing, so put the documented threshold next to the configured Limit. Note also that Shield Advanced reports metrics once a minute during an event but only once a day when nothing is happening, so a sparse series is normal and a missing data point is not an outage; and that engaging the SRT requires a Business or Enterprise Support plan. list-attacks covers the window you pass — keep the collected output, since the API's own history is not your retention policy. ## References - {"title":"AWS CLI: shield describe-subscription (AutoRenew, ProactiveEngagementStatus)","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/describe-subscription.html"} - {"title":"AWS CLI: shield list-protections","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/list-protections.html"} - {"title":"AWS CLI: shield list-attacks (AttackSummaries, AttackVectors)","url":"https://docs.aws.amazon.com/cli/latest/reference/shield/list-attacks.html"} - {"title":"AWS CLI: wafv2 list-web-acls","url":"https://docs.aws.amazon.com/cli/latest/reference/wafv2/list-web-acls.html"} - {"title":"AWS CLI: wafv2 get-web-acl (Rules, DefaultAction)","url":"https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl.html"} - {"title":"AWS WAF: using rate-based rule statements","url":"https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html"} - {"title":"AWS Config managed rule: wafv2-logging-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/wafv2-logging-enabled.html"} - {"title":"AWS Config managed rule: shield-advanced-enabled-autorenew (us-east-1 only)","url":"https://docs.aws.amazon.com/config/latest/developerguide/shield-advanced-enabled-autorenew.html"} - {"title":"AWS Shield Advanced metrics (AWS/DDoSProtection namespace)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/shield-metrics.html"} - {"title":"AWS WAF metrics and dimensions (AWS/WAFV2 namespace)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/waf-metrics.html"} - {"title":"Managed DDoS event response with the Shield Response Team (GovCloud Regions)","url":"https://docs.aws.amazon.com/waf/latest/developerguide/ddos-srt-support.html"} - {"title":"AWS Shield Advanced endpoints and quotas","url":"https://docs.aws.amazon.com/general/latest/gr/shield.html"} - {"title":"AWS WAF in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-waf.html"} --- ## https://ramprules.com/collect/clock-synchronization-and-timestamps # What each instance's clock is actually locked to and how far off it is right now — the chrony daemon's reference source, offset and leap status collected fleet-wide through Run Command — together with the configured time source in chrony.conf and the UTC time stamps CloudTrail already writes on every audit record > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/clock-synchronization-and-timestamps Recipe id: `clock-synchronization-and-timestamps` · cadence daily · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-OSM` - control `au-8` ## Collection Kind: `cli` ```sh # send-command aws ssm send-command --document-name AWS-RunShellScript --targets Key=tag:Environment,Values= --parameters 'commands=["chronyc tracking","chronyc sources -v | grep -F ^*","grep -E \"^(server|pool|refclock)\" /etc/chrony.conf"]' --output-s3-bucket-name --output-s3-key-prefix au-08 # list-command-invocations aws ssm list-command-invocations --command-id 11111111-2222-3333-4444-555555555555 --details --query 'CommandInvocations[].{Instance:InstanceId,Status:Status,Output:CommandPlugins[].Output}' # lookup-events aws cloudtrail lookup-events --max-results 5 --query 'Events[].{Name:EventName,Time:EventTime,Source:EventSource}' ``` ## Expected output For every managed instance, a chronyc tracking block whose Reference ID is A9FEA97B (169.254.169.123) — the local Amazon Time Sync Service — with System time within your documented granularity of NTP time (microseconds on a healthy instance), a small RMS offset, and Leap status Normal; a chronyc sources line beginning ^*, which marks the preferred source, pointing at 169.254.169.123 (or fd00:ec2::123 on a Nitro instance using the IPv6 endpoint); and a chrony.conf that names that endpoint and no unapproved public NTP pool. Every invocation should come back Status Success — an instance that returns nothing is an instance whose clock you have not evidenced. From CloudTrail, EventTime values in UTC, which is what the record format guarantees: eventTime is documented as 'the date and time the request was completed, in coordinated universal time (UTC)'. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud The local Amazon Time Sync Service is reachable from any AWS Region, GovCloud included, at the link-local addresses 169.254.169.123 (IPv4) and fd00:ec2::123 (IPv6, Nitro instances only), and Systems Manager and CloudTrail are both available in AWS GovCloud (US); instance, document and trail ARNs use partition arn:aws-us-gov. One difference to plan around: precision time placement groups — the route to the enhanced Amazon Time Sync Service and the PTP hardware clock — are documented as available in all AWS Commercial Regions, so expect NTP-level accuracy rather than microsecond PHC accuracy in GovCloud ## Notes The clock is telemetry; the mapping and the granularity are not. AU-8 wants time stamps for audit records that use an internal clock mapped to UTC and meet a granularity you defined — chrony proves the host clock is disciplined to an authoritative UTC source and by how much it is off, and CloudTrail's eventTime is UTC by contract, so the AWS-generated half of your audit trail satisfies the mapping without any work of yours. What no command proves is that your own application writes its records from that clock in UTC: chrony can be flawless while code stamps local time or truncates to the second, and comparing the measured offset against your defined granularity is a judgement against a policy number. Scope honesty matters here too — this is a point-in-time sample of the instances Run Command could reach, so an unmanaged, stopped or unreachable instance is silently absent; join the results against your managed-instance inventory before calling the fleet covered, and remember containers and serverless compute have no chrony to query. If you claim sub-millisecond granularity, note that a PTP hardware clock passes no error bound to chrony (chrony then assumes an error bound of 0): read /sys/bus/pci/devices//phc_error_bound and add it, or run ClockBound. Leap seconds are smeared on the NTP endpoints but not on the PHC, so do not configure both smeared and non-smeared sources. Substitute your real targets, bucket and command id; send-command returns the CommandId that the second call consumes, and plugin Output is truncated at 2500 characters, which is why the S3 output bucket is worth setting. ## References - {"title":"Amazon EC2: precision clock and time synchronization (Amazon Time Sync Service, leap smearing)","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html"} - {"title":"Amazon EC2: set the time reference to the local Amazon Time Sync Service (169.254.169.123, fd00:ec2::123, chronyc tracking)","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configure-ec2-ntp.html"} - {"title":"Amazon EC2: compare timestamps with ClockBound (clock error bound, phc_error_bound)","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/compare-timestamps-with-clockbound.html"} - {"title":"AWS CLI: ssm send-command (AWS-RunShellScript)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/send-command.html"} - {"title":"AWS CLI: ssm list-command-invocations (--details, CommandPlugins Output)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-command-invocations.html"} - {"title":"CloudTrail record contents: eventTime is recorded in UTC","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html"} - {"title":"AWS CLI: cloudtrail lookup-events (90-day window)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} --- ## https://ramprules.com/collect/integrity-verification-and-immutability # Cryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/integrity-verification-and-immutability Recipe id: `integrity-verification-and-immutability` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-VRI` - KSI `KSI-SVC-VCM` - KSI `KSI-SCR-MIT` - control `si-7` - control `si-7.1` ## Collection Kind: `cli` ```sh # cloud-trail-log-file-validation-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT # validate-logs aws cloudtrail validate-logs --trail-arn --start-time --verbose # s3-bucket-default-lock-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-default-lock-enabled --compliance-types NON_COMPLIANT # describe-backup-vault aws backup describe-backup-vault --backup-vault-name evidence-vault --query '{Locked:Locked,LockDate:LockDate,MinRetentionDays:MinRetentionDays,MaxRetentionDays:MaxRetentionDays}' # ecr-private-tag-immutability-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name ecr-private-tag-immutability-enabled --compliance-types NON_COMPLIANT ``` ## Expected output Three EvaluationResults arrays, a validation run and a vault description. Empty NON_COMPLIANT sets mean every trail signs digest files, every evaluated bucket has Object Lock on by default and every private ECR repository refuses to move a tag. validate-logs prints the window it actually found and two ratios — for example '3/3 digest files valid' and '15/15 log files valid'; any shortfall names the file. describe-backup-vault returns Locked true with a LockDate, the UTC instant the compliance-mode grace time ends. Managed rule identifiers: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, S3_BUCKET_DEFAULT_LOCK_ENABLED, ECR_PRIVATE_TAG_IMMUTABILITY_ENABLED ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud All five calls work in AWS GovCloud (US): none of the three managed rules names a GovCloud Region in its exclusion list, and AWS Backup Vault Lock is documented among the features offered for all supported resources with no Region carve-out — unlike restore testing and logically air-gapped vaults, which are blank for both GovCloud rows in the feature-availability table. Trail, bucket, vault and repository ARNs use partition arn:aws-us-gov, and because CloudTrail uses a different key pair per Region, validate the logs in the Region that produced them ## Notes The strong claim here is narrow and worth stating precisely. validate-logs is real cryptography — SHA-256 hashing with SHA-256/RSA signing, an hourly digest file that references the last hour's log files and carries the signature of the previous digest — so a clean run positively asserts that the delivered log files were not modified or deleted, and can even assert that no log files were delivered in a window you believed was empty. What it will not do: validate files you moved, since they must stay where CloudTrail put them; and it cannot report tampering across a gap — disable validation for an hour and no digest exists for that hour, so the chain simply breaks. Enabling the feature is not the same as checking it, which is why both the Config rule and the CLI run belong here: the rule proves digests are being produced, the run is the only thing that verifies them. Object Lock and Vault Lock are prevention, not detection — they make a deletion fail rather than proving none happened, and Object Lock only counts if the mode and period match your policy: the rule's optional mode parameter is what pins GOVERNANCE versus COMPLIANCE, and unset it passes either. Vault Lock in governance mode can be removed by anyone holding the IAM permission, so read Locked together with LockDate — before that date even a compliance-mode lock is still removable. The honest gap is the host: SI-7 asks for integrity verification of software, firmware and information, and nothing above watches a filesystem. ECR tag immutability stops a tag being repointed at a different image but says nothing about drift inside a running instance; file integrity monitoring is third-party or self-built on AWS, and SI-7(1)'s ‘defined frequency’ is a policy number you compare against, not an API result. Finally, a NON_COMPLIANT-only query returns an empty array on success and says nothing about resources Config never evaluated — join it against recorder coverage before reading emptiness as compliance. ## References - {"title":"AWS Config managed rule: cloud-trail-log-file-validation-enabled (CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-log-file-validation-enabled.html"} - {"title":"CloudTrail: validating log file integrity (SHA-256, SHA-256 with RSA, hourly digest files, per-Region key pairs)","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html"} - {"title":"AWS CLI: cloudtrail validate-logs (syntax, output ratios, documented limitations)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/validate-logs.html"} - {"title":"AWS Config managed rule: s3-bucket-default-lock-enabled (optional mode parameter GOVERNANCE|COMPLIANCE)","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-default-lock-enabled.html"} - {"title":"AWS Backup Vault Lock (governance vs compliance mode, grace time, DescribeBackupVault Locked and LockDate)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html"} - {"title":"AWS Backup feature availability (Vault Lock offered for all supported resources; GovCloud rows for restore testing and air-gapped vaults)","url":"https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-feature-availability.html"} - {"title":"AWS Config managed rule: ecr-private-tag-immutability-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/ecr-private-tag-immutability-enabled.html"} --- ## https://ramprules.com/collect/unauthorized-component-detection-and-response # Every running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one fired > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/unauthorized-component-detection-and-response Recipe id: `unauthorized-component-detection-and-response` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-LMC` - KSI `KSI-SVC-VRI` - control `cm-8.3` ## Collection Kind: `cli` ```sh # approved-amis-by-tag aws configservice get-compliance-details-by-config-rule --config-rule-name approved-amis-by-tag --compliance-types NON_COMPLIANT # ec2-managedinstance-applications-blacklisted aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-applications-blacklisted --compliance-types NON_COMPLIANT # approved-amis-by-tag-remediation aws configservice describe-remediation-configurations --config-rule-names approved-amis-by-tag ec2-managedinstance-applications-blacklisted # describe-remediation-execution-status aws configservice describe-remediation-execution-status --config-rule-name approved-amis-by-tag ``` ## Expected output Two EvaluationResults arrays naming each unauthorized component by resource id, then the response half: RemediationConfigurations showing TargetType SSM_DOCUMENT, the TargetId document and version, Automatic true or false, MaximumAutomaticAttempts and RetryAttemptSeconds; and RemediationExecutionStatuses with State QUEUED, IN_PROGRESS, SUCCEEDED, FAILED or UNKNOWN plus per-step StepDetails, InvocationTime and LastUpdatedTime. An empty RemediationConfigurations list is the finding: detection with no configured action does not satisfy CM-8(3)b. Managed rule identifiers: APPROVED_AMIS_BY_TAG, EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud AWS Config and both managed rules are available in AWS GovCloud (US) — neither rule's Region list excludes a GovCloud Region — and config.us-gov-east-1 and config.us-gov-west-1 are both listed in the Region-support table for Config remediation actions. But the GovCloud user guide states flatly that AWS Systems Manager documents (SSM documents) for AWS Config remediation actions are not available, so expect to author your own SSM Automation document rather than attach an AWS-managed one, and confirm the document resolves in your Region before you claim the automated half. Instance and document ARNs use partition arn:aws-us-gov ## Notes CM-8(3) has two halves and only one comes free. Detection is genuine: APPROVED_AMIS_BY_TAG is configuration-change triggered, so an instance launched from an unapproved image is flagged as it appears rather than at the next sweep, and the remediation records are real evidence of action — TargetId names the document that ran, Automatic separates auto-remediation from a button a human pressed, and StepDetails timestamps each step and quotes the error when one fails. What telemetry cannot supply is the definition of ‘unauthorized’. APPROVED_AMIS_BY_TAG matches on up to ten AMI tag keys or key:value pairs that you assert mean approved, so it tests your tagging discipline as much as your fleet — tag an unvetted image and it becomes compliant. The applications denylist needs exact application names with no wildcards, and the name differs per distribution; it evaluates AWS::SSM::ManagedInstanceInventory, so a node with no agent or no inventory association is simply not evaluated rather than flagged — read it beside the inventory-coverage recipe or you will mistake blindness for cleanliness. Neither rule sees firmware, and neither sees what a container image runs. The response side also carries a judgement someone must record: CM-8(3)b wants a chosen action — disable network access, isolate the component, notify defined personnel — and choosing to isolate a production instance automatically is a risk decision, not a default. Deliberate overlap: EC2_MANAGEDINSTANCE_APPLICATIONS_BLACKLISTED also carries CM-7 and CM-7.01 in the least-functionality recipe, where it proves prohibited software is absent; here the same signal is read as detection of an unauthorized component, with the remediation record attached. ## References - {"title":"AWS Config managed rule: approved-amis-by-tag (APPROVED_AMIS_BY_TAG, amisByTagKeyAndValue, up to 10 tags)","url":"https://docs.aws.amazon.com/config/latest/developerguide/approved-amis-by-tag.html"} - {"title":"AWS Config managed rule: ec2-managedinstance-applications-blacklisted","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-applications-blacklisted.html"} - {"title":"Remediating noncompliant resources with AWS Config (SSM Automation documents; Region support includes both GovCloud Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/remediation.html"} - {"title":"AWS CLI: configservice describe-remediation-configurations (TargetId, TargetType, Automatic, MaximumAutomaticAttempts)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-remediation-configurations.html"} - {"title":"AWS CLI: configservice describe-remediation-execution-status (State, StepDetails, InvocationTime)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-remediation-execution-status.html"} - {"title":"AWS Config in AWS GovCloud (US) — differences (SSM documents for Config remediation actions not available)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-config.html"} --- ## https://ramprules.com/collect/information-location-and-classification # A Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/information-location-and-classification Recipe id: `information-location-and-classification` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-PIY-GIV` - KSI `KSI-SVC-EIS` - control `cm-12` - control `cm-12.1` ## Collection Kind: `cli` ```sh # select-aggregate-resource-config aws configservice select-aggregate-resource-config --configuration-aggregator-name --expression "SELECT awsRegion, resourceType, COUNT(*) WHERE resourceType IN ('AWS::S3::Bucket', 'AWS::RDS::DBInstance', 'AWS::DynamoDB::Table', 'AWS::EFS::FileSystem') GROUP BY awsRegion, resourceType" # get-resources aws resourcegroupstaggingapi get-resources --tag-filters Key=DataClassification --region us-gov-west-1 # get-automated-discovery-configuration aws macie2 get-automated-discovery-configuration # describe-buckets aws macie2 describe-buckets --query 'buckets[].{bucket:bucketName,region:region,score:sensitivityScore,monitored:automatedDiscoveryMonitoringStatus,lastAnalyzed:lastAutomatedDiscoveryTime,unclassifiable:unclassifiableObjectCount.total}' ``` ## Expected output A per-Region, per-type count of information-bearing resources across every account in the aggregator — aggregation queries page at 500 rows by default and plain SELECTs at 25, so page or raise --max-results before treating a result set as the whole estate. Then a ResourceTagMappingList of ARNs carrying your DataClassification key, one Region per call. Then Macie's status ENABLED or DISABLED with firstEnabledAt, lastUpdatedAt, classificationScopeId and sensitivityInspectionTemplateId; and per bucket a sensitivityScore — documented as -1 for a classification error, 1 for an empty bucket, 50 for a bucket excluded from recent analyses, up to 100 for sensitive — alongside automatedDiscoveryMonitoringStatus MONITORED or NOT_MONITORED, lastAutomatedDiscoveryTime and the unclassifiable object count ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Amazon Macie is not available in AWS GovCloud (US): the AWS General Reference lists no macie2 endpoint for us-gov-east-1 or us-gov-west-1, and the macie-status-check Config rule is excluded from both GovCloud Regions. In GovCloud the last two commands have nothing to call and CM-12(1)'s automated identification by information type needs another tool. The first two do work — AWS Config in both Regions, and the Resource Groups Tagging API at tagging.us-gov-east-1.amazonaws.com and tagging.us-gov-west-1.amazonaws.com — but Config in GovCloud does not record third-party or custom resource types, so anything you model that way is invisible to the aggregate query. ARNs use partition arn:aws-us-gov ## Notes Three different qualities of evidence are stacked here, and conflating them is the trap. The Config aggregate query is solid on where storage lives — resource type by Region, across accounts — and that is the part of CM-12 most often undocumented. The tag query is only as true as your tagging: GetResources by design never returns untagged resources, so an unclassified bucket is absent from the answer rather than flagged, which is precisely backwards for an inventory control; run it beside the aggregate count and treat the difference as your unclassified population. Macie is the only machine-derived opinion about information type, and it is a sample rather than a census — automated sensitive data discovery continually selects representative objects from your buckets and scores each bucket from those, so a MONITORED bucket with a low score means ‘nothing sensitive in what was sampled’, never ‘no sensitive data here’. The unclassifiable object count is the population Macie could not read at all because of storage class or file format, and per-file size quotas mean a large archive can be skipped entirely, so read coverage before reading scores. Macie also only looks at S3: nothing above inspects an RDS table, an EFS volume, a DynamoDB item or a Parameter Store value, and the Region field tells you where a bucket is, which is the CM-12 question, not what is in it. What no command produces is CM-12 itself — the documented location of each information type, the users authorized to access it and the purpose it is held for. That is a record you write and then check against this telemetry, not one you derive from it. ## References - {"title":"AWS CLI: configservice select-aggregate-resource-config (aggregator queries, 500 vs 25 default page size)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/select-aggregate-resource-config.html"} - {"title":"AWS CLI: resourcegroupstaggingapi get-resources (per-Region; does not return untagged resources)","url":"https://docs.aws.amazon.com/cli/latest/reference/resourcegroupstaggingapi/get-resources.html"} - {"title":"Amazon Macie: performing automated sensitive data discovery (sampling, sensitive data findings and discovery results)","url":"https://docs.aws.amazon.com/macie/latest/user/discovery-asdd.html"} - {"title":"AWS CLI: macie2 get-automated-discovery-configuration (status, classificationScopeId, sensitivityInspectionTemplateId)","url":"https://docs.aws.amazon.com/cli/latest/reference/macie2/get-automated-discovery-configuration.html"} - {"title":"AWS CLI: macie2 describe-buckets (sensitivityScore, automatedDiscoveryMonitoringStatus, unclassifiableObjectCount)","url":"https://docs.aws.amazon.com/cli/latest/reference/macie2/describe-buckets.html"} - {"title":"Amazon Macie endpoints and quotas (no AWS GovCloud (US) endpoint listed; per-file size quotas)","url":"https://docs.aws.amazon.com/general/latest/gr/macie.html"} - {"title":"AWS Config managed rule: macie-status-check (excluded from AWS GovCloud (US-East) and (US-West))","url":"https://docs.aws.amazon.com/config/latest/developerguide/macie-status-check.html"} - {"title":"AWS Resource Groups and Tagging endpoints and quotas (tagging.us-gov-east-1, tagging.us-gov-west-1)","url":"https://docs.aws.amazon.com/general/latest/gr/arg.html"} - {"title":"AWS Config in AWS GovCloud (US) — differences (no recording of third-party or custom resource types)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-config.html"} --- ## https://ramprules.com/collect/remote-access-authorization-and-monitoring # How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/remote-access-authorization-and-monitoring Recipe id: `remote-access-authorization-and-monitoring` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - KSI `KSI-MLA-LET` - KSI `KSI-SVC-ASM` - KSI `KSI-CNA-ULN` - control `ac-17` - control `ac-17.1` - control `ac-17.2` - control `ac-17.3` ## Collection Kind: `cli` ```sh # get-document aws ssm get-document --name SSM-SessionManagerRunShell --document-version '$LATEST' --query Content --output text # describe-sessions aws ssm describe-sessions --state History --query 'Sessions[].{owner:Owner,target:Target,start:StartDate,end:EndDate,document:DocumentName,accessType:AccessType,maxDuration:MaxSessionDuration}' # describe-client-vpn-endpoints aws ec2 describe-client-vpn-endpoints --query 'ClientVpnEndpoints[].{id:ClientVpnEndpointId,transport:TransportProtocol,auth:AuthenticationOptions[].Type,connectionLog:ConnectionLogOptions,splitTunnel:SplitTunnel,sessionTimeoutHours:SessionTimeoutHours,serverCert:ServerCertificateArn,selfServicePortal:SelfServicePortalUrl}' # describe-client-vpn-connections aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id --query 'Connections[].{user:Username,commonName:CommonName,clientIp:ClientIp,established:ConnectionEstablishedTime,ended:ConnectionEndTime,status:Status,posture:PostureComplianceStatuses}' # ec2-instance-no-public-ip aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-no-public-ip --compliance-types NON_COMPLIANT ``` ## Expected output The Session Manager preferences document as JSON — s3BucketName, s3KeyPrefix, s3EncryptionEnabled, cloudWatchLogGroupName, cloudWatchEncryptionEnabled, cloudWatchStreamingEnabled, kmsKeyId, runAsEnabled, idleSessionTimeout and maxSessionDuration — which is your Region's entire remote-access logging and encryption configuration in one object. Then one row per terminated session from the past 30 days carrying Owner, Target, StartDate, EndDate, DocumentName, MaxSessionDuration and AccessType of Standard or JustInTime. Then per Client VPN endpoint the transport protocol tcp or udp, the authentication types in use (certificate-authentication, directory-service-authentication or federated-authentication), ConnectionLogOptions with Enabled plus CloudwatchLogGroup and CloudwatchLogStream, SplitTunnel, SessionTimeoutHours of 8, 10, 12 or 24 (default 24) and the server certificate ARN. Then per connection Username (Active Directory authentication only), CommonName, ClientIp, ConnectionEstablishedTime, ConnectionEndTime, Status and any PostureComplianceStatuses — active connections plus only those terminated within the last 60 minutes. Finally the EC2 instances AWS Config evaluated NON_COMPLIANT because a publicIp field is present in their configuration item. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Both access paths exist in AWS GovCloud (US-East) and (US-West). Client VPN endpoints there operate using FIPS 140-3 validated cryptographic modules and a fixed cipher set — TLS 1.3 TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256; TLS 1.2 TLS-ECDHE-RSA/ECDSA-WITH-AES-256-GCM-SHA384 and the AES-128-GCM-SHA256 variants; data channel AES-256-GCM — and AWS advises using the exported client configuration file unmodified rather than configuring other ciphers, which makes AC-17(2) there largely a matter of not breaking the default. Systems Manager runs in both Regions; Change Manager and Incident Manager do not, and State Manager association history cannot be viewed, none of which this recipe touches. ec2-instance-no-public-ip is documented for all supported AWS Regions. Calls to these services must use SSL (HTTPS), and ARNs use partition arn:aws-us-gov ## Notes The commands split cleanly across the control family, and the gap in the middle is the one to be honest about. AC-17(1) — automated monitoring and control of remote access — is what session history and connection logs deliver, with two documented blind spots. Session Manager does not log sessions that connect through port forwarding or SSH, because SSH encrypts the session data inside the TLS connection and Session Manager is only the tunnel; an operator who port-forwards leaves a session record with no command content behind it. And describe-sessions reaches back 30 days only, so anything longer is an S3 or CloudWatch Logs query against the destinations named in the preferences document, not an SSM call. Client VPN retention is shorter still — terminated connections drop out of the API after 60 minutes, which makes the log group named in ConnectionLogOptions the only durable record, and Username is populated only for Active Directory authentication, so certificate-authenticated users are identified by CommonName or not at all. AC-17(2) is the strongest link in GovCloud, where the endpoints are FIPS 140-3 modules by construction; the Session Manager equivalent is kmsKeyId in the preferences document, and it is empty unless you set it, so an empty kmsKeyId is a finding rather than a default. AC-17(3) — routing remote access through managed network access control points — is the one nothing here proves. Session Manager and a Client VPN endpoint are managed access points, and ec2-instance-no-public-ip is the closest negative check, but that rule applies only to IPv4 and only to AWS::EC2::Instance: an IPv6-reachable instance, a load balancer fronting SSH, or a third-party jump host is invisible to it. Read the result as 'no EC2 instance carries a public IPv4 address', which is a useful sentence and not the control. AC-17 itself — the documented usage restrictions, configuration requirements and per-type authorization — is a record you write, and this telemetry only shows whether the estate matches it. One warning to carry into the evidence package: Session Manager logs the commands entered and their output, so a credential typed into a session lands in the log group you are about to hand an assessor. ## References - {"title":"AWS Systems Manager: enabling and disabling session logging (no logging for port forwarding or SSH sessions)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-logging.html"} - {"title":"AWS Systems Manager: update Session Manager preferences (SSM-SessionManagerRunShell inputs — kmsKeyId, s3/cloudWatch logging, timeouts)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-configure-preferences-cli.html"} - {"title":"AWS Systems Manager: configure session preferences (KMS key encryption of session data, session history logs, timeouts)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-configure-preferences.html"} - {"title":"AWS CLI: ssm get-document (returns Content for a named document version)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/get-document.html"} - {"title":"AWS CLI: ssm describe-sessions (--state Active|History; history covers the past 30 days)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-sessions.html"} - {"title":"AWS CLI: ec2 describe-client-vpn-endpoints (ConnectionLogOptions, AuthenticationOptions, SessionTimeoutHours, SplitTunnel)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-client-vpn-endpoints.html"} - {"title":"AWS CLI: ec2 describe-client-vpn-connections (active plus connections terminated in the last 60 minutes)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-client-vpn-connections.html"} - {"title":"AWS Config managed rule: ec2-instance-no-public-ip (EC2_INSTANCE_NO_PUBLIC_IP, IPv4 only, all supported Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-no-public-ip.html"} - {"title":"AWS Client VPN in AWS GovCloud (US) — FIPS 140-3 validated modules and the permitted cipher list","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-vpnclient.html"} - {"title":"AWS Systems Manager in AWS GovCloud (US) — capability and feature differences","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ssm.html"} --- ## https://ramprules.com/collect/malicious-code-protection # Whether malware scanning is switched on for compute and for the buckets that accept uploads, plus the scan-by-scan record of what was actually examined and what came back INFECTED > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/malicious-code-protection Recipe id: `malicious-code-protection` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-DFP` - KSI `KSI-CMT-RMV` - control `si-3` ## Collection Kind: `cli` ```sh # list-detectors aws guardduty list-detectors # get-detector aws guardduty get-detector --detector-id --query '{status:Status,publishingFrequency:FindingPublishingFrequency,features:Features[].{name:Name,status:Status,additional:AdditionalConfiguration}}' # describe-malware-scans aws guardduty describe-malware-scans --detector-id --query 'Scans[].{id:ScanId,type:ScanType,status:ScanStatus,result:ScanResultDetails,started:ScanStartTime,ended:ScanEndTime,files:FileCount,bytes:TotalBytes,resource:ResourceDetails,trigger:TriggerDetails,failure:FailureReason}' # list-malware-protection-plans aws guardduty list-malware-protection-plans # get-malware-protection-plan aws guardduty get-malware-protection-plan --malware-protection-plan-id --query '{protected:ProtectedResource,status:Status,statusReasons:StatusReasons,actions:Actions,role:Role,created:CreatedAt}' # guardduty-malware-protection-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-malware-protection-enabled --compliance-types NON_COMPLIANT ``` ## Expected output A detector id per Region — an empty list means GuardDuty was never enabled there, which is itself the finding. Then the detector's Status ENABLED or DISABLED, its FindingPublishingFrequency of FIFTEEN_MINUTES, ONE_HOUR or SIX_HOURS, and the Features list in which EBS_MALWARE_PROTECTION is the entry that matters, alongside FLOW_LOGS, CLOUD_TRAIL, DNS_LOGS, S3_DATA_EVENTS, EKS_AUDIT_LOGS, RDS_LOGIN_EVENTS, LAMBDA_NETWORK_LOGS, EKS_RUNTIME_MONITORING and RUNTIME_MONITORING with its EC2_AGENT_MANAGEMENT, EKS_ADDON_MANAGEMENT and ECS_FARGATE_AGENT_MANAGEMENT sub-configuration. Then one row per malware scan: ScanId, ScanType GUARDDUTY_INITIATED or ON_DEMAND, ScanStatus RUNNING, COMPLETED, FAILED or SKIPPED, a FailureReason when it failed, ScanStartTime and ScanEndTime, the scanned InstanceArn and its attached volumes, FileCount and TotalBytes actually examined, TriggerDetails carrying the GuardDutyFindingId and a TriggerType of GUARDDUTY or BACKUP, and a ScanResultDetails of CLEAN or INFECTED. Then the Malware Protection plan ids, and per plan the protected S3 bucket with its object prefixes, the scanning role, whether result tagging is on, and a Status of ACTIVE, WARNING or ERROR with StatusReasons naming the problem. Finally, outside GovCloud, the detectors AWS Config marks NON_COMPLIANT for GUARDDUTY_MALWARE_PROTECTION_ENABLED. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud GuardDuty runs in both AWS GovCloud (US) Regions and Malware Protection for EC2 works there with one documented gap: instances whose productCode is marketplace are not scanned — GuardDuty skips them and logs the skip reason UNSUPPORTED_PRODUCT_CODE_TYPE, so a SKIPPED scan in GovCloud may be that rather than a misconfiguration. Malware Protection for Backup cannot scan EC2 or EBS recovery points there. The GovCloud differences page records no carve-out for Malware Protection for S3. The last command has nothing to call: GUARDDUTY_MALWARE_PROTECTION_ENABLED is excluded from both AWS GovCloud (US-East) and (US-West) — as it is from the China Regions, Mexico (Central), Asia Pacific (Thailand), (Malaysia) and (Taipei) — so drop it and take the enablement fact from the EBS_MALWARE_PROTECTION feature status in get-detector instead. Also unavailable in GovCloud: the entity lists customisation (IP address lists still work) and the GuardDuty Investigation preview. ARNs use partition arn:aws-us-gov ## Notes The trap in SI-3 is reading GuardDuty Malware Protection as antivirus. It is not a scheduled sweep of your file systems. A GuardDuty-initiated scan fires only after GuardDuty has already produced a finding indicative of malware on that resource, at most once every 24 hours per resource, and it works agentlessly against snapshots of the attached EBS volumes — so an empty describe-malware-scans list is the expected steady state of a healthy estate and proves nothing about coverage. The two enablement reads prove capability; the scan list proves exercise; neither proves protection. Coverage has a second silent hole: the global GuardDutyExcluded:true tag and your own inclusion or exclusion scan-option tags make GuardDuty initiate a scan and then skip it, so read the scan options next to the tag inventory or a deliberately excluded estate looks like a clean one, and Fargate workloads under EKS or ECS are not scanned at all. Malware Protection for S3 is the closest thing here to SI-3's entry-point requirement — it scans each newly uploaded object and each new version in a configured bucket — but it covers only buckets with an active plan, in the same Region as the plan, in your own account (a delegated GuardDuty administrator cannot enable it on a member account's bucket), and when run independently of GuardDuty there is no detector, so malware produces an EventBridge event, a CloudWatch metric and the optional object tag rather than a GuardDuty finding. What no command here produces is the rest of SI-3: signature or engine currency, since AWS operates the scan engines and exposes no version for you to attest to; periodic full scans; false-positive handling; and the documented response when malicious code is found. Rate those from the plan and the incident record, and keep these reads as the machine half of the answer. ## References - {"title":"Amazon GuardDuty: Malware Protection for EC2 (GuardDuty-initiated vs on-demand scans, Fargate unsupported)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/malware-protection.html"} - {"title":"Amazon GuardDuty: GuardDuty-initiated malware scan (fires only on a malware-indicative finding, 24-hour interval, GuardDutyExcluded tag)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/gdu-initiated-malware-scan.html"} - {"title":"Amazon GuardDuty: Malware Protection for S3 (scans newly uploaded objects; independent mode has no detector and so no finding)","url":"https://docs.aws.amazon.com/guardduty/latest/ug/gdu-malware-protection-s3.html"} - {"title":"AWS CLI: guardduty get-detector (Features list including EBS_MALWARE_PROTECTION and its status)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-detector.html"} - {"title":"AWS CLI: guardduty describe-malware-scans (ScanStatus, ScanType, TriggerDetails, ScanResultDetails, FileCount, TotalBytes)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/describe-malware-scans.html"} - {"title":"AWS CLI: guardduty list-malware-protection-plans (plan ids for protected resources)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-malware-protection-plans.html"} - {"title":"AWS CLI: guardduty get-malware-protection-plan (ProtectedResource, Status ACTIVE/WARNING/ERROR, StatusReasons)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-malware-protection-plan.html"} - {"title":"AWS Config managed rule: guardduty-malware-protection-enabled (GUARDDUTY_MALWARE_PROTECTION_ENABLED, excluded from both AWS GovCloud (US) Regions)","url":"https://docs.aws.amazon.com/config/latest/developerguide/guardduty-malware-protection-enabled.html"} - {"title":"Amazon GuardDuty in AWS GovCloud (US) — Malware Protection for EC2 marketplace productCode skip, Backup recovery point limits","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-guardduty.html"} --- ## https://ramprules.com/collect/audit-reduction-and-report-generation # A demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returned > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/audit-reduction-and-report-generation Recipe id: `audit-reduction-and-report-generation` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-OSM` - KSI `KSI-MLA-LET` - control `au-7` - control `au-7.1` ## Collection Kind: `cli` ```sh # describe-query-definitions aws logs describe-query-definitions --query 'queryDefinitions[].{id:queryDefinitionId,name:name,language:queryLanguage,logGroups:logGroupNames}' # logs-insights-start-query aws logs start-query --log-group-names --start-time --end-time --query-string 'fields @timestamp, userIdentity.arn, eventName, sourceIPAddress | filter eventName = "ConsoleLogin" | sort @timestamp desc | limit 1000' # get-query-results aws logs get-query-results --query-id # list-event-data-stores aws cloudtrail list-event-data-stores --query 'EventDataStores[].{name:Name,arn:EventDataStoreArn,status:Status,retentionDays:RetentionPeriod,multiRegion:MultiRegionEnabled,organization:OrganizationEnabled,terminationProtection:TerminationProtectionEnabled}' # lake-start-query aws cloudtrail start-query --query-statement "SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress FROM WHERE eventName = 'ConsoleLogin' ORDER BY eventTime DESC LIMIT 1000" --delivery-s3-uri s3:// # start-query-execution aws athena start-query-execution --work-group primary --query-execution-context Database=cloudtrail_logs --result-configuration OutputLocation=s3://audit-reports-bucket/athena/ --query-string "SELECT eventtime, useridentity.arn, eventname, sourceipaddress FROM cloudtrail_logs WHERE eventname = 'ConsoleLogin' ORDER BY eventtime DESC LIMIT 1000" ``` ## Expected output First the saved CloudWatch Logs Insights query definitions — queryDefinitionId, name, queryLanguage of CWLI, SQL or PPL, the queryString itself and the log groups each is scoped to — which is the standing reduction-and-reporting capability as configured rather than as claimed. Then a queryId, and against it the matching records: at most 100,000 log events per query and 10,000 returned per get-query-results call, one query spanning at most 50 log groups, a 60-minute runtime ceiling and a Region-wide limit of 100 concurrent Insights queries. Then the event data stores with Status (CREATED, ENABLED, PENDING_DELETION, STARTING_INGESTION, STOPPING_INGESTION or STOPPED_INGESTION), RetentionPeriod in days from 7 to 3,653, MultiRegionEnabled, OrganizationEnabled and TerminationProtectionEnabled. Then a QueryId from CloudTrail Lake whose results are delivered to the S3 URI you named, and a QueryExecutionId from Athena whose results land in the workgroup's OutputLocation. Keep the query text beside its output — the pair is the evidence and neither half is evidence alone. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud All three query paths run in both AWS GovCloud (US) Regions. Athena's only documented difference is that granting AWS Lake Formation permissions to Athena users who authenticate through the JDBC or ODBC driver with a SAML identity provider is unavailable. CloudWatch Logs is available with Live Tail missing and the logGroupNamePattern parameter unsupported on DescribeLogGroups — neither affects an Insights query. CloudTrail Lake is available, but Lake integrations, query generation, query results summarization, event data stores for AWS Config configuration items, AWS Audit Manager evidence and events from outside AWS, and the Activity summary widget are not: you write the SQL yourself, and non-AWS audit records cannot be pulled into the same store for reduction. One scoping trap: since 22 November 2021 CloudFront, IAM and AWS STS events are recorded in AWS GovCloud (US-West), so a single-Region search from US-East silently misses every global-service event unless the trail is multi-Region. Calls must use SSL (HTTPS) and ARNs use partition arn:aws-us-gov ## Notes AU-7 asks for a capability, so the honest evidence is a query that ran rather than a configuration that exists — run one and keep the query text beside its output. AU-7(1), processing and sorting records by event criteria, is exactly what the filter and sort clauses in the Insights query and the WHERE and ORDER BY in the Lake and Athena statements demonstrate; pick criteria an assessor cares about — a named principal, a source IP, an event name, a bounded window — rather than a bare SELECT *. The half of AU-7 that no output proves is the requirement that reduction not alter the original content or time ordering of the records: these are read APIs, and Athena queries the CloudTrail objects in place in S3 rather than rewriting them, but that is an argument from the API contract, not a line in the result set — the property is actually carried by log file validation and object immutability, which belong to the integrity recipe, not this one. Two limits deserve to be read before the query power is. A query can only reduce records that reached the log group or the event data store, so a 90-day retention makes an annual report impossible no matter how good the SQL, which is why the retention fields are pulled alongside. And the Insights ceilings — 100,000 events per query, 10,000 per page, 50 log groups, 60 minutes — mean a broad search across a year of CloudTrail truncates silently rather than failing, so a result set sitting exactly at the limit is a truncated report and must not be filed as a complete one; Athena and CloudTrail Lake have no such row ceiling and are the right tools for a long look-back. Whether the resulting report actually supports after-the-fact investigation is a human judgement about the query, which is what keeps this partial rather than full. ## References - {"title":"AWS CLI: logs start-query (log group and time-range parameters, queryId, 100 concurrent queries, 100,000 event and 10,000 page limits, 50 log groups, 60-minute timeout)","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/start-query.html"} - {"title":"AWS CLI: logs describe-query-definitions (saved Insights queries — queryDefinitionId, name, queryLanguage, queryString, logGroupNames)","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/describe-query-definitions.html"} - {"title":"AWS CLI: cloudtrail start-query (CloudTrail Lake SQL query against an event data store, --delivery-s3-uri, returns QueryId)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/start-query.html"} - {"title":"AWS CLI: cloudtrail list-event-data-stores (Status, RetentionPeriod 7–3653 days, MultiRegionEnabled, OrganizationEnabled, TerminationProtectionEnabled)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/list-event-data-stores.html"} - {"title":"AWS CLI: athena start-query-execution (--query-string, --work-group, --query-execution-context, OutputLocation; returns QueryExecutionId)","url":"https://docs.aws.amazon.com/cli/latest/reference/athena/start-query-execution.html"} - {"title":"Amazon Athena: query AWS CloudTrail logs (query log files directly from Amazon S3 by LOCATION)","url":"https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html"} - {"title":"Amazon Athena in AWS GovCloud (US) — Region availability and documented differences","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-athena.html"} - {"title":"Amazon CloudWatch Logs in AWS GovCloud (US) — Live Tail and logGroupNamePattern unavailable","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-cwl.html"} - {"title":"AWS CloudTrail in AWS GovCloud (US) — CloudTrail Lake feature carve-outs and global service events recorded in us-gov-west-1","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ct.html"} --- ## https://ramprules.com/collect/guardduty-incident-after-action # GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/guardduty-incident-after-action Recipe id: `guardduty-incident-after-action` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-INR-AAR` - control `ir-3` - control `ir-4` - control `ir-4.1` - control `ir-8` ## Collection Kind: `cli` ```sh # guardduty-list-findings aws guardduty list-findings --detector-id --finding-criteria '{"Criterion":{"severity":{"Gte":[4]},"updatedAt":{"Gte":[""]}}}' --query 'FindingIds[]' # guardduty-finding-detail aws guardduty get-findings --detector-id --finding-ids --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Time:UpdatedAt,Desc:Description}' # securityhub-insights aws securityhub get-insights --query 'Insights[].{Arn:InsightArn,Name:Name,Filters:Filters,GroupBy:GroupByAttr}' # securityhub-insight-results aws securityhub get-insight-results --insight-arn # after-action-reports aws s3api list-objects-v2 --bucket --prefix after-action-reports/ --query 'Contents[].{Key:Key,Size:Size,Modified:LastModified}' ``` ## Expected output A list of GuardDuty findings with severity >= 4 (medium+), their IDs, types, affected resource types and update timestamps; Security Hub insight names and result counts showing which insights are actively matching; and a non-empty S3 object list under after-action-reports/ whose keys include finding IDs or incident reference numbers, proving findings are linked to AARs rather than reviewed in isolation and forgotten. ## Assertions - {"field":"after-action-reports","op":"exists","controls":["ir-3","ir-4","ir-8"],"description":"At least one after-action report exists as a versioned S3 object, proving findings were reviewed beyond the event itself."} ## GovCloud GuardDuty, Security Hub and S3 are available in both AWS GovCloud (US-East) and (US-West); detector, hub and bucket ARNs use partition arn:aws-us-gov. ## Notes IR-3 wants incident response tested, IR-4 wants incidents handled and lessons learned applied, IR-4.1 wants automated handling support, and IR-8 wants an incident response plan. GuardDuty findings and Security Hub insights are telemetry, not proof that anyone acted on them. The S3 AAR objects close the loop: they show someone reviewed the finding, and that the review produced a document. What the API cannot prove is that the lessons were actually incorporated into the plan — that is a human judgement from the AAR content. An after-action report without a recommendation-to-plan-change linkage is a finding without a fix. If no AARs exist yet, this recipe is the trigger to create them, not evidence that the control is satisfied. Substitute your detector ID, evidence bucket name and insight ARNs. GuardDuty list-findings returns at most 50 findings per page; add --max-results and --next-token pagination for a full quarter. ## References - {"title":"AWS CLI: guardduty list-findings (severity and date filters)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/list-findings.html"} - {"title":"AWS CLI: securityhub get-insights","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-insights.html"} - {"title":"AWS CLI: s3api list-objects-v2","url":"https://docs.aws.amazon.com/cli/latest/reference/s3api/list-objects-v2.html"} --- ## https://ramprules.com/collect/securityhub-incident-review-procedures # Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/securityhub-incident-review-procedures Recipe id: `securityhub-incident-review-procedures` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-INR-RIR` - control `ir-4` - control `ir-4.1` - control `ir-6` - control `ir-6.1` - control `ir-6.3` - control `ir-7` - control `ir-7.1` - control `ir-8` - control `ir-8.1` - control `si-4.5` ## Collection Kind: `cli` ```sh # resolved-high-findings aws securityhub get-findings --filters '{"WorkflowStatus":[{"Value":"RESOLVED","Comparison":"EQUALS"}],"SeverityLabel":[{"Value":"HIGH","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Id,Updated:UpdatedAt}' # guardduty-detector-id aws guardduty list-detectors --query 'DetectorIds[0]' # guardduty-detector aws guardduty get-detector --detector-id --query '{Status:Status,Features:Features[].{Name:Name,Status:Status}}' # guardduty-event-rules aws events list-rules --name-prefix guardduty --query 'Rules[].{Name:Name,Pattern:EventPattern,Targets:State}' # automation-documents aws ssm list-documents --filters Key=Owner,Values=Self --filters Key=DocumentType,Values=Automation --query 'DocumentIdentifiers[].{Name:Name,Owner:Owner,Version:DocumentVersion,Type:DocumentType}' # securityhub-alarms aws cloudwatch describe-alarms --alarm-name-prefix SecurityHub --query 'MetricAlarms[].{Name:AlarmName,State:StateValue,Actions:AlarmActions,Metric:MetricName}' ``` ## Expected output Security Hub findings that reached RESOLVED status (proving the workflow was exercised end-to-end), GuardDuty detector status with features showing which data sources are enabled, EventBridge rules prefixed with guardduty that route findings to targets, Systems Manager Automation documents owned by the account that encode response steps, and CloudWatch alarms that fire on Security Hub metrics. ## Assertions - {"field":"resolved-high-findings.Findings","op":"exists","controls":["ir-4","ir-4.1","ir-8"],"description":"The RESOLVED/HIGH get-findings call returns a non-empty Findings array within the review window, proving the incident response workflow was exercised end to end rather than merely configured."} ## GovCloud Security Hub, GuardDuty, EventBridge, Systems Manager and CloudWatch are available in both AWS GovCloud (US-East) and (US-West); findings and document ARNs use partition arn:aws-us-gov. GovCloud FIPS endpoints are used by default for all services. ## Notes IR-4 wants incident handling capability, IR-4.1 wants automated incident handling, IR-6/6.1/6.3 want reporting to authorities with automated support, IR-7/7.1 want response assistance/coordination, IR-8/8.1 want the incident response plan and its updates, and SI-4.5 wants system monitoring. The evidence here is the infrastructure of response, not the act of responding: resolved findings show the workflow was used, enabled GuardDuty features show detection is active, EventBridge rules show automated routing exists, SSM Automation documents show response steps are encoded as code, and CloudWatch alarms show monitoring. What none of this proves is that the procedures are effective, that notifications reached the right authorities within SLA, or that the incident response plan was actually updated after the event. Those are narrative gaps filled by the plan document, notification records, and AARs. The workflow status is the only pass/fail field here — a finding stuck in NEW or NOTIFIED rather than RESOLVED is a control failure. Substitute your detector ID. ## References - {"title":"AWS CLI: securityhub get-findings (WorkflowStatus and SeverityLabel filters)","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html"} - {"title":"AWS CLI: events list-rules (EventBridge guardduty rules)","url":"https://docs.aws.amazon.com/cli/latest/reference/events/list-rules.html"} - {"title":"AWS CLI: ssm list-documents (Automation documents)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-documents.html"} - {"title":"AWS CLI: cloudwatch describe-alarms","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"} --- ## https://ramprules.com/collect/guardduty-pattern-review-past-incidents # Recurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/guardduty-pattern-review-past-incidents Recipe id: `guardduty-pattern-review-past-incidents` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-INR-RPI` - control `ir-3` - control `ir-4` - control `ir-4.1` - control `ir-5` - control `ir-8` ## Collection Kind: `cli` ```sh # list-findings aws guardduty list-findings --detector-id --finding-criteria '{"Criterion":{"updatedAt":{"Gte":[""]}}}' --query 'FindingIds[]' # guardduty-finding-detail aws guardduty get-findings --detector-id --finding-ids --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Count:Service.Count,Account:AccountId}' # securityhub-active-findings aws securityhub get-findings --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Type,First:FirstObservedAt,Last:LastObservedAt}' # lookup-events-signin-amazonaws-com aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=signin.amazonaws.com --start-time 2024-01-01T00:00:00Z --end-time 2024-12-31T23:59:59Z --max-results 50 --query 'Events[].{Name:EventName,Time:EventTime,User:Username}' ``` ## Expected output GuardDuty findings showing their findingType and Count fields (indicating repeat occurrences of the same threat), Security Hub ACTIVE findings with FirstObservedAt and LastObservedAt showing persistence windows, and CloudTrail signin events showing authentication patterns over the year that may indicate repeated lateral-movement or credential-abuse attempts. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud GuardDuty, Security Hub, CloudTrail, Athena and S3 are available in both AWS GovCloud (US-East) and (US-West); findings and trail ARNs use partition arn:aws-us-gov. CloudTrail lookup-events covers 90 days only; older data must come from Athena queries against the trail S3 bucket. ## Notes IR-3 wants testing for repeated flaws, IR-4/4.1 wants incident handling, IR-5 wants incident monitoring, and IR-8 wants the response plan. The pattern review is the quarterly audit of whether the environment is getting healthier or sicker: a recurring finding type across quarters means the root cause was not fixed, and a high Count on a GuardDuty finding means the same attack vector struck multiple times. The honest gap: finding telemetry does not prove anyone reviewed the pattern — the review is the human step of comparing this quarter against last quarter and recording the conclusion. If the same finding type appears in every quarterly pull, the control is failing even when the telemetry is clean, because the root cause is unaddressed. The CloudTrail signin query is a sample, not exhaustive — replace with an Athena query against your trail S3 bucket for a full year of authentication events. Security Hub FirstObservedAt and LastObservedAt show how long a finding has persisted; a gap between them and the current date means the finding was fixed and then reintroduced. This recipe deliberately states no assertion: the check that matters — this quarter's finding types compared against last quarter's, read against the prior after-action report's root-cause fix — spans two collections and a document, so no single command output decides it. A quarter-over-quarter diff is the reviewer's work, and writing it down as a machine assertion would claim a check nothing can run. ## References - {"title":"AWS CLI: guardduty get-findings (Type, Severity, Service.Count for repeat detection)","url":"https://docs.aws.amazon.com/cli/latest/reference/guardduty/get-findings.html"} - {"title":"AWS CLI: securityhub get-findings (FirstObservedAt, LastObservedAt for persistence)","url":"https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-findings.html"} - {"title":"AWS CLI: cloudtrail lookup-events (90-day window, signin events)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} --- ## https://ramprules.com/collect/route53-dnssec-signing # DNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parent > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/route53-dnssec-signing Recipe id: `route53-dnssec-signing` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - control `sc-20` ## Collection Kind: `cli` ```sh # public-hosted-zones aws route53 list-hosted-zones --query 'HostedZones[?Config.PrivateZone==`false`].{Id:Id,Name:Name}' # public-zone-dnssec aws route53 get-dnssec --hosted-zone-id # domain-dnssec-keys aws route53domains get-domain-detail --region us-east-1 --domain-name --query 'DnssecKeys' ``` ## Expected output One get-dnssec response per public hosted zone under the projection root public-zone-dnssec: Status.ServeSignature (SIGNING | NOT_SIGNING | DELETING | ACTION_NEEDED | INTERNAL_FAILURE) and KeySigningKeys[] with Status (ACTIVE | INACTIVE | DELETING | ACTION_NEEDED | INTERNAL_FAILURE), DSRecord, DNSKEYRecord, KeyTag and KmsArn. get-domain-detail returns DnssecKeys[] with the Digest, KeyTag, Algorithm and Flags actually lodged at the registry. ## Assertions - {"field":"public-zone-dnssec.Status.ServeSignature","op":"eq","value":"SIGNING","controls":["sc-20"],"description":"Every public hosted zone is serving DNSSEC signatures, so authoritative responses carry data-origin authentication and integrity artifacts."} - {"field":"public-zone-dnssec.KeySigningKeys[].Status","op":"eq","value":"ACTIVE","controls":["sc-20"],"description":"Every key-signing key on a signed zone is ACTIVE, so the signatures are being produced by a live key rather than by one left INACTIVE or in ACTION_NEEDED."} - {"field":"public-zone-dnssec.KeySigningKeys[].DSRecord","op":"exists","controls":["sc-20"],"description":"Every signed zone emits a delegation signer record — the means by which a parent indicates the security status of this zone and a resolver verifies the chain of trust."} ## GovCloud Route 53 public and private DNS are available in both GovCloud (US) Regions and DNSSEC signing is supported, with two placement constraints AWS documents: the customer managed key used for signing must be in GovCloud (US-West), and the Route 53 control plane for GovCloud is in GovCloud (US-West). Zone ARNs use partition arn:aws-us-gov. route53domains is a commercial-partition registrar service, so the third command applies only where the domain is registered with Route 53 Domains. ## Notes Private hosted zones cannot be DNSSEC-signed, which is why the first command narrows to Config.PrivateZone==false before the per-zone loop; asserting SIGNING over every hosted zone would fail on private zones for a reason that is not a finding. Drive the loop from list-hosted-zones rather than from whatever get-dnssec happens to return, so a zone that was never configured is a visible failure instead of an absent row. SC-20's second limb — the means to indicate the security status of child zones and enable verification of a chain of trust — is carried by KeySigningKeys[].DSRecord, which get-dnssec returns and the assertions cover. Whether that DS record has actually been published by the parent is a fact about the registrar, not about the zone: where the domain is registered with Route 53 Domains, get-domain-detail's DnssecKeys evidences it directly, and where it is registered elsewhere the registrar's own DS confirmation is the artifact to attach. No assertion is written against the third command for that reason — it is decisive for some tenants and inapplicable to others, and an assertion that silently does not apply is worse than a named gap. ACTION_NEEDED on either the zone status or a KSK is an outage risk, not a paperwork state; AWS recommends a CloudWatch alarm on DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction, and a collector that only samples weekly should not be the first thing to notice it. list-hosted-zones returning no public zones passes all three assertions vacuously — a human confirms this account is the authoritative DNS for the offering's names, and confirms registrar-side DS publication where the registrar is not Route 53 Domains. Partial for the second limb of SC-20. ## References - {"title":"AWS CLI: route53 get-dnssec (Status.ServeSignature and KeySigningKeys[].Status value sets, DSRecord)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53/get-dnssec.html"} - {"title":"Configuring DNSSEC signing in Amazon Route 53 (KSK is an asymmetric KMS key you own; parent zone must support DS records; alarm on DNSSECInternalFailure and DNSSECKeySigningKeysNeedingAction)","url":"https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html"} - {"title":"AWS CLI: route53domains get-domain-detail (DnssecKeys — the DS information passed to the registry to establish the chain of trust)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53domains/get-domain-detail.html"} - {"title":"Amazon Route 53 in AWS GovCloud (US) — DNSSEC signing KMS key must be in GovCloud (US-West); control plane is in GovCloud (US-West)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html"} --- ## https://ramprules.com/collect/route53-resolver-dnssec-validation # Per-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absent > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/route53-resolver-dnssec-validation Recipe id: `route53-resolver-dnssec-validation` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - control `sc-21` ## Collection Kind: `cli` ```sh # describe-vpcs aws ec2 describe-vpcs --query 'Vpcs[].VpcId' # list-resolver-dnssec-configs aws route53resolver list-resolver-dnssec-configs ``` ## Expected output describe-vpcs yields the VpcId inventory for the Region. list-resolver-dnssec-configs yields ResolverDnssecConfigs[] with Id, OwnerId, ResourceId and ValidationStatus (ENABLING | ENABLED | DISABLING | DISABLED | UPDATING_TO_USE_LOCAL_RESOURCE_SETTING | USE_LOCAL_RESOURCE_SETTING); the array is paginated and carries NextToken. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Route 53 is available in both GovCloud (US) Regions and the GovCloud difference page documents no carve-out for Resolver DNSSEC validation; it does record that Route 53 Resolver delegation is unavailable for private hosted zones, which is a different feature. The Route 53 control plane for GovCloud is in GovCloud (US-West). VPC ARNs use partition arn:aws-us-gov. ## Notes Rated partial for a reason that is in AWS's own words rather than in our judgement of the control: ListResolverDnssecConfigs returns one element per DNSSEC validation configuration associated with the account and "doesn't contain disabled DNSSEC configurations for the resource". A VPC with validation off is therefore ABSENT from the array, not reported as DISABLED — so a check of the form "every returned entry is ENABLED" is vacuously true on an account that has enabled validation nowhere. That is the exact shape of a check that passes while proving nothing, so it is not written as an assertion. The decidable question is a set comparison: every VpcId from describe-vpcs must appear as a ResourceId in ResolverDnssecConfigs with ValidationStatus ENABLED. That spans two collections, and the assertion vocabulary compares a field against a constant rather than one command's output against another's, so the completeness half is a human read. The telemetry is real and specific; what it cannot do by itself is prove coverage. Two further limits worth attaching to the evidence. Validation is applied by the VPC Resolver when it performs recursive resolution, so if the VPC forwards to another resolver, that resolver is the one doing recursion and must validate — the AWS status says nothing about it. And the VPC Resolver ignores the DO and CD bits and does not set AD or return DNSSEC records, so a workload cannot perform its own validation downstream of it; where a system owes that, the artifact is the resolver it runs instead. ## References - {"title":"ListResolverDnssecConfigs API — \"It doesn't contain disabled DNSSEC configurations for the resource\"; paginated with NextToken","url":"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverDnssecConfigs.html"} - {"title":"AWS CLI: route53resolver get-resolver-dnssec-config (ResolverDNSSECConfig fields and the ValidationStatus value set)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53resolver/get-resolver-dnssec-config.html"} - {"title":"Enabling DNSSEC validation in Amazon Route 53 (applied by the VPC Resolver during recursion; a forwarding resolver must validate itself; the VPC Resolver ignores DO/CD and does not set AD)","url":"https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html"} - {"title":"Amazon Route 53 in AWS GovCloud (US) — Region availability and documented differences","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html"} --- ## https://ramprules.com/collect/identity-sources-and-root-credential-lockdown # Every way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificate > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/identity-sources-and-root-credential-lockdown Recipe id: `identity-sources-and-root-credential-lockdown` · cadence monthly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-APM` - KSI `KSI-IAM-ELP` - control `ia-2` ## Collection Kind: `cli` ```sh # get-account-summary aws iam get-account-summary --query 'SummaryMap.{Users:Users,Providers:Providers,MFADevices:MFADevices,MFADevicesInUse:MFADevicesInUse,AccountAccessKeysPresent:AccountAccessKeysPresent,AccountSigningCertificatesPresent:AccountSigningCertificatesPresent}' # list-saml-providers aws iam list-saml-providers --query 'SAMLProviderList[].{Arn:Arn,ValidUntil:ValidUntil,CreateDate:CreateDate}' # list-open-id-connect-providers aws iam list-open-id-connect-providers # list-instances aws sso-admin list-instances --query 'Instances[].{InstanceArn:InstanceArn,IdentityStoreId:IdentityStoreId,Status:Status}' # iam-user-mfa-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name iam-user-mfa-enabled --compliance-types NON_COMPLIANT # iam-root-access-key-check aws configservice get-compliance-details-by-config-rule --config-rule-name iam-root-access-key-check --compliance-types NON_COMPLIANT ``` ## Expected output Under the projection root account-summary, a SummaryMap of integers: Users and Providers size the two populations that can authenticate, MFADevices and MFADevicesInUse size the authenticator estate, and AccountAccessKeysPresent and AccountSigningCertificatesPresent are 0/1 flags for account-level credentials. Under saml-providers and oidc-providers, one entry per registered federation trust — SAMLProviderList carries Arn, ValidUntil and CreateDate (tags are not returned; GetSAMLProvider is the call for those). Under identity-center, zero or one instance with InstanceArn, IdentityStoreId and Status (CREATE_IN_PROGRESS | CREATE_FAILED | DELETE_IN_PROGRESS | ACTIVE). From AWS Config, two EvaluationResults arrays; empty NON_COMPLIANT sets mean every IAM user has an MFA device and the root user holds no access key. Managed rule identifiers: IAM_USER_MFA_ENABLED (rule name iam-user-mfa-enabled) and IAM_ROOT_ACCESS_KEY_CHECK (rule name iam-root-access-key-check). ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud IAM, IAM Identity Center and AWS Config are all available in both GovCloud (US) Regions, and both managed rules used here are in their supported-Region lists; user, provider and instance ARNs use partition arn:aws-us-gov, and an Identity Center instance ARN takes the form arn:aws-us-gov:sso:::instance/. Two GovCloud facts to plan around: the Identity Center administrative console, SDK and CLI must be reached over FIPS endpoints, and multi-Region Identity Center support is not available there, so one instance is the whole answer rather than one per Region. Note also that ROOT_ACCOUNT_MFA_ENABLED — the obvious companion rule — is explicitly NOT available in AWS GovCloud (US-East) or (US-West), which is why root MFA is not asserted here from AWS Config; evidence it from the IAM credential report's row instead. ## Notes This enumerates the authentication paths and closes the credentials that belong to nobody. What it cannot do is the word IA-02 turns on: unique. No API reports that an IAM user is one named human rather than a login three engineers share, or that a federated subject maps one-to-one onto a person on the roster — that binding lives in the personnel record and the joiner/mover/leaver process, and a reviewer establishes it by joining this output against the account inventory (see the AC-02 account-authorization-details recipe), not by reading this output alone. Rated partial for that reason: the authentication half is decided here outright, the identification half is not. Providers counts SAML and OIDC providers together, so the two list calls are what tell you which is which. An account with Users at 0 and one Identity Center instance is the strong shape — no standing workforce credentials at all — and an account with both is the one worth explaining. Substitute nothing here: every command runs as written. The two AWS Config rules are periodic and evaluate global IAM resource types, so deploy them in exactly one Region; adding them in several does not add coverage and does add duplicate evaluations. ## References - {"title":"IAM API: GetAccountSummary — the SummaryMap key set (AccountAccessKeysPresent, AccountSigningCertificatesPresent, Providers, MFADevicesInUse)","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html"} - {"title":"AWS CLI: iam list-saml-providers (SAMLProviderList — Arn, ValidUntil, CreateDate; tags are not returned)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-saml-providers.html"} - {"title":"AWS CLI: sso-admin list-instances (InstanceArn, IdentityStoreId, Status)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-instances.html"} - {"title":"AWS Config managed rule: iam-user-mfa-enabled (IAM_USER_MFA_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-user-mfa-enabled.html"} - {"title":"AWS Config managed rule: iam-root-access-key-check (IAM_ROOT_ACCESS_KEY_CHECK — COMPLIANT when the root user access key does not exist)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-root-access-key-check.html"} - {"title":"AWS Config managed rule: root-account-mfa-enabled — Region list excludes AWS GovCloud (US-East) and (US-West)","url":"https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html"} - {"title":"AWS IAM Identity Center in AWS GovCloud (US) — FIPS endpoints for console/SDK/CLI, arn:aws-us-gov:sso:::instance/ pattern, no multi-Region support","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"} --- ## https://ramprules.com/collect/cognito-external-user-authentication # For every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token for > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/cognito-external-user-authentication Recipe id: `cognito-external-user-authentication` · cadence weekly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-APM` - control `ia-8` ## Collection Kind: `cli` ```sh # user-pools aws cognito-idp list-user-pools --max-results 60 --query 'UserPools[].{Id:Id,Name:Name,Status:Status}' # user-pool-mfa aws cognito-idp get-user-pool-mfa-config --user-pool-id # identity-pools aws cognito-identity list-identity-pools --max-results 60 --query 'IdentityPools[].{Id:IdentityPoolId,Name:IdentityPoolName}' # identity-pool aws cognito-identity describe-identity-pool --identity-pool-id --query '{Id:IdentityPoolId,AllowUnauthenticatedIdentities:AllowUnauthenticatedIdentities,AllowClassicFlow:AllowClassicFlow,Cognito:CognitoIdentityProviders,Login:SupportedLoginProviders,Saml:SamlProviderARNs,Oidc:OpenIdConnectProviderARNs}' ``` ## Expected output One get-user-pool-mfa-config response per user pool under the projection root user-pool-mfa: MfaConfiguration (OFF | ON | OPTIONAL) plus whichever factor blocks are configured — SoftwareTokenMfaConfiguration.Enabled for TOTP, SmsMfaConfiguration for SMS, EmailMfaConfiguration for email OTP. One describe-identity-pool response per identity pool under the projection root identity-pool: AllowUnauthenticatedIdentities (TRUE if the pool supports unauthenticated logins), AllowClassicFlow, and the four trust fields — CognitoIdentityProviders, SupportedLoginProviders (provider name to app id), SamlProviderARNs and OpenIdConnectProviderARNs. ## Assertions - {"field":"identity-pool.AllowUnauthenticatedIdentities","op":"eq","value":false,"controls":["ia-8"],"description":"No identity pool supports unauthenticated logins, so every non-organizational principal holding AWS credentials authenticated to get them."} - {"field":"user-pool-mfa.MfaConfiguration","op":"eq","value":"ON","controls":["ia-8"],"description":"Every user pool the assessor names as serving non-organizational users requires MFA, so an external identity authenticates with a second factor rather than a password alone. This is the authentication limb of IA-08 only — uniqueness is not in this output."} ## GovCloud Amazon Cognito user pools and identity pools are available in both GovCloud (US) Regions, with differences that change what this collection sees and how it is wired: Cognito in GovCloud uses FIPS endpoints only (cognito-idp-fips.us-gov-west-1.amazonaws.com and cognito-idp-fips.us-gov-east-1.amazonaws.com), custom domains for user pools are not available, and Amazon Cognito Sync is absent. Identity-pool role trust policies must grant AssumeRoleWithWebIdentity to the cognito-identity-us-gov.amazonaws.com service principal in GovCloud (US-West) and to cognito-identity.us-gov-east-1.amazonaws.com in GovCloud (US-East) — a trust policy copied from a commercial account names the wrong principal and the pool silently issues nothing. In GovCloud (US-East), role name plus role session name longer than 24 characters can stop an identity pool assuming the role at all. Pool and provider ARNs use partition arn:aws-us-gov. ## Notes Drive both loops from the list calls, not from whatever the describe calls happen to return, so a pool nobody configured is a visible failure rather than an absent row. AllowUnauthenticatedIdentities is the assertion that carries the control: an identity pool with guest access on hands AWS credentials to a caller who never authenticated, which is precisely the population IA-08 exists to exclude. It is the one setting here that can silently undo everything upstream, which is why the cadence is weekly rather than quarterly. MfaConfiguration is asserted against ON rather than merely not-OFF on purpose. OPTIONAL does not require anything — it delegates the decision to the client application, so a pool set to OPTIONAL and an application that never prompts is indistinguishable from OFF in this output. Scope the loop to the pools that actually serve non-organizational users: a pool used only as a directory for an internal service has no external population and asserting ON over it is a finding about the wrong thing. That scoping sentence is why this recipe is partial rather than full, and the reason is worth stating plainly. Both assertions range over lists, and no AWS call reports which directory serves the external population — or whether external users reach the system through Cognito at all rather than through an API Gateway authorizer or an ALB fronting an IdP. On an account with no user pools and no identity pools, both assertions are vacuously true and the control is unevidenced. The second gap is the control's first verb: MfaConfiguration decides how strongly an external identity authenticates, never that it is UNIQUE to one human, and a pool with MFA ON and self-service sign-up admits as many accounts per person as they care to open. Both gaps close with a human naming the external population and the registration path, which is the definition of partial. What this does not reach is the external identity provider's own registration and proofing — whether the SAML or OIDC provider behind SamlProviderARNs vetted the human before issuing them a subject. That is IA-08(1), (2) and (4) territory and is evidenced by the provider's assurance-level attestation, not by any AWS call. ## References - {"title":"AWS CLI: cognito-idp get-user-pool-mfa-config (MfaConfiguration OFF | ON | OPTIONAL; SoftwareTokenMfaConfiguration, SmsMfaConfiguration, EmailMfaConfiguration)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/get-user-pool-mfa-config.html"} - {"title":"AWS CLI: cognito-idp list-user-pools","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-user-pools.html"} - {"title":"AWS CLI: cognito-identity describe-identity-pool (AllowUnauthenticatedIdentities — TRUE if the identity pool supports unauthenticated logins; SamlProviderARNs, OpenIdConnectProviderARNs, SupportedLoginProviders)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/describe-identity-pool.html"} - {"title":"AWS CLI: cognito-identity list-identity-pools (IdentityPoolId, IdentityPoolName)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/list-identity-pools.html"} - {"title":"Amazon Cognito in AWS GovCloud (US) — FIPS-only endpoints, no custom user pool domains, cognito-identity-us-gov.amazonaws.com trust principal, US-East role/session name length limit","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-cog.html"} --- ## https://ramprules.com/collect/session-lifetime-and-reauthentication # The configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itself > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/session-lifetime-and-reauthentication Recipe id: `session-lifetime-and-reauthentication` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - control `ia-11` ## Collection Kind: `cli` ```sh # list-roles aws iam list-roles --query 'Roles[].{Role:RoleName,MaxSessionDuration:MaxSessionDuration}' # list-instances aws sso-admin list-instances --query 'Instances[].InstanceArn' # list-permission-sets aws sso-admin list-permission-sets --instance-arn # describe-permission-set aws sso-admin describe-permission-set --instance-arn --permission-set-arn --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}' # get-account-authorization-details aws iam get-account-authorization-details --query '{Managed:Policies[].PolicyVersionList[?IsDefaultVersion].Document,UserInline:UserDetailList[].UserPolicyList[].PolicyDocument,RoleInline:RoleDetailList[].RolePolicyList[].PolicyDocument,GroupInline:GroupDetailList[].GroupPolicyList[].PolicyDocument}' ``` ## Expected output Under the projection root roles, one row per IAM role with MaxSessionDuration in SECONDS — the API floor is 3600 and the ceiling 43200, and the value caps what DurationSeconds an AssumeRole call may ask for. Under permission-sets, one row per permission set with SessionDuration as an ISO-8601 duration string (PT1H, PT12H). From get-account-authorization-details, four blocks of policy documents — the default version of every managed policy under Managed, and every INLINE policy under UserInline, RoleInline and GroupInline — each URL-encoded per RFC 3986 and needing a decode before you can search it for aws:MultiFactorAuthAge, a numeric condition key measured in SECONDS since the principal was authorized using MFA. The inline blocks are the reason for the projection: an MFA-age condition written inline on one role is invisible to a query that reads managed policies alone, and reads as an absence rather than as a miss. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud IAM, STS and IAM Identity Center are available in both GovCloud (US) Regions; role and permission-set ARNs use partition arn:aws-us-gov, with permission sets taking the form arn:aws-us-gov:sso:::permissionSet//. The Identity Center console, SDK and CLI must be reached over FIPS endpoints in GovCloud, and multi-Region Identity Center is not available there, so a single instance holds every permission set in scope. ## Notes IA-11 asks for re-authentication under organization-defined circumstances. Only one of those circumstances — elapsed time — is in any of these outputs, and even that arrives as a ceiling rather than as an event: MaxSessionDuration caps what a caller may request, it does not report that a session ended or that a human presented an authenticator again. The other circumstances FedRAMP expects an organization to name — a change of role, a change of authenticator, before executing a privileged function, after a defined idle period — have no field here at all. Deciding whether the configured ceilings match the documented circumstances is the human judgement, which is why this is partial and not full. Two scope gaps worth writing into the assessment rather than discovering later. A console session reached through an external identity provider ends on that provider's session policy, and no AWS API reports it: the IdP's own configuration is the artifact. And aws:MultiFactorAuthAge is absent from the request context for federated identities and for requests signed with long-term access keys, so a policy that expires an MFA session governs exactly the principals using temporary MFA-backed credentials and silently governs nobody else — pair it with BoolIfExists on aws:MultiFactorAuthPresent so the not-present case denies rather than passes. A role left at the 3600-second default is not evidence of a decision; a role at 43200 is a decision someone should have written down. Read the distribution, not the extremes. Substitute the instance and permission-set ARNs, which the two list calls supply. ## References - {"title":"AWS CLI: iam list-roles (MaxSessionDuration in seconds; 3600 minimum, 43200 maximum)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-roles.html"} - {"title":"AWS CLI: sso-admin describe-permission-set (SessionDuration — the length of time application user sessions are valid for, in the ISO-8601 standard)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/describe-permission-set.html"} - {"title":"AWS CLI: sso-admin list-instances (InstanceArn)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-instances.html"} - {"title":"IAM global condition keys: aws:MultiFactorAuthAge (seconds since the principal was authorized using MFA) and aws:MultiFactorAuthPresent (absent for federated identities and access-key-signed requests; use BoolIfExists)","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html"} - {"title":"AWS CLI: iam get-account-authorization-details (policy documents are URL-encoded and must be decoded before inspection)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"} - {"title":"AWS IAM Identity Center in AWS GovCloud (US) — permission set ARN pattern arn:aws-us-gov:sso:::permissionSet/, FIPS endpoints, no multi-Region support","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"} --- ## https://ramprules.com/collect/temporary-account-automatic-revocation # The mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the period > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/temporary-account-automatic-revocation Recipe id: `temporary-account-automatic-revocation` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-AAM` - KSI `KSI-IAM-SNU` - control `ac-2.2` ## Collection Kind: `config-rule` ```sh # iam-user-unused-credentials-check-rule aws configservice describe-config-rules --config-rule-names iam-user-unused-credentials-check # iam-user-unused-credentials-check aws configservice get-compliance-details-by-config-rule --config-rule-name iam-user-unused-credentials-check --compliance-types NON_COMPLIANT # iam-user-unused-credentials-check-remediation aws configservice describe-remediation-configurations --config-rule-names iam-user-unused-credentials-check # get-account-authorization-details aws iam get-account-authorization-details --filter User ``` ## Expected output The four responses are collected unprojected, so every field below is the name AWS returns and the name the assertions address. From describe-config-rules, ConfigRules[] with one entry: Source.SourceIdentifier IAM_USER_UNUSED_CREDENTIALS_CHECK, ConfigRuleState ACTIVE, and InputParameters as a JSON-formatted STRING (not an object) that must be parsed before maxCredentialUsageAge can be read from it — an int, a number of DAYS, defaulting to 90. From get-compliance-details-by-config-rule, an EvaluationResults array whose every entry is one IAM user still holding a password or an active access key unused beyond that period; empty is the passing shape. From describe-remediation-configurations, RemediationConfigurations[] — a list whose minimum length is ZERO, so a rule with no remediation attached returns an empty array rather than an error, which is why one assertion tests that the first entry exists at all before the others read Automatic, TargetType SSM_DOCUMENT and TargetId. From get-account-authorization-details, UserDetailList[] with one entry per IAM user carrying UserName, CreateDate as an ISO-8601 timestamp, and Tags as a list of key/value pairs. ## Assertions - {"field":"iam-user-unused-credentials-check-rule.ConfigRules[].ConfigRuleState","op":"eq","value":"ACTIVE","controls":["ac-2.2"],"description":"The rule that measures credential dormancy is evaluating, not deleting or stopped."} - {"field":"iam-user-unused-credentials-check-rule.ConfigRules[].InputParameters.maxCredentialUsageAge","op":"lte","value":90,"controls":["ac-2.2"],"description":"The configured period is no longer than the organization-defined maximum; 90 is the AWS default — substitute the shorter period if your SSP states one. InputParameters arrives as a JSON string and must be parsed before this field exists."} - {"field":"iam-user-unused-credentials-check.EvaluationResults","op":"count_eq","value":0,"controls":["ac-2.2"],"description":"No IAM user holds a password or an active access key that has gone unused beyond that period."} - {"field":"iam-user-unused-credentials-check-remediation.RemediationConfigurations[0].TargetId","op":"exists","controls":["ac-2.2"],"description":"A remediation configuration is attached to the rule at all — the list is empty when none is, and every clause below it passes vacuously over an empty list."} - {"field":"iam-user-unused-credentials-check-remediation.RemediationConfigurations[].Automatic","op":"eq","value":true,"controls":["ac-2.2"],"description":"The revocation fires on non-compliance without a human starting it — the word 'automatically' in the control, as a field."} - {"field":"iam-user-unused-credentials-check-remediation.RemediationConfigurations[].TargetId","op":"eq","value":"AWSConfigRemediation-RevokeUnusedIAMUserCredentials","controls":["ac-2.2"],"description":"What fires is the runbook that deactivates expired access keys and deletes expired login profiles, not an alert that someone has to read."} - {"field":"get-account-authorization-details.UserDetailList[].CreateDate","op":"max_age_days","value":90,"where":[{"field":"Tags[?Key=='AccountType'].Value","op":"in","value":["temporary","emergency"]}],"controls":["ac-2.2"],"description":"No IAM user your tagging marks as temporary or emergency is older than the same organization-defined period — the still-active account the dormancy rule cannot see."} ## GovCloud AWS Config and IAM_USER_UNUSED_CREDENTIALS_CHECK are available in both GovCloud (US) Regions — the rule's published exclusion list names no GovCloud Region — as is Systems Manager Automation. User and role ARNs, and the AutomationAssumeRole the runbook assumes, use partition arn:aws-us-gov. The rule reports on a global IAM resource type, so deploy it in exactly one Region: a periodic rule on a global type evaluates in every Region it is added to, and duplicating it duplicates the evaluations rather than the coverage. ## Notes AC-02 (02) asks for something narrower than it looks: not that temporary and emergency accounts are reviewed, but that they END on their own after a stated period. Most of that sentence is in this output. The period is the rule's maxCredentialUsageAge. The ending is the remediation configuration — Automatic true and TargetId AWSConfigRemediation-RevokeUnusedIAMUserCredentials, a runbook whose documented behaviour is to deactivate expired access keys and delete expired login profiles. That nothing has outlived the period is the empty NON_COMPLIANT set. A screenshot of a console page proves none of those; these four calls prove all of them. What they do not prove is the control's subject. The Config rule measures every IAM user in the account; nothing in this output says WHICH users are the temporary and emergency ones, and the control is about those. A human names that population — which is exactly why this recipe is partial and not full, and why the CreateDate assertion is written as a filter over your own tagging rather than as a claim over the account. Two scope edges to write into the assessment rather than discover during it. The rule sees IAM users, so an account whose privileges live in an assumed role or an IAM Identity Center permission set is out of its reach — those expire by session duration instead, which is a different artifact (see the IA-11 recipe). And the rule measures INACTIVITY, not age: a temporary account that is used every day is compliant no matter how long ago it should have been closed. The fourth call is what narrows that gap, by reading CreateDate against your own tagging of which accounts were meant to be temporary. That last check is only as complete as the tagging behind it, and no AWS Config rule can make it complete: REQUIRED_TAGS does not support AWS::IAM::User, so tag coverage over IAM users cannot be asserted from Config at all. Treat the tagging standard as a written control with a manual sample. Read the CreateDate assertion for what it is — a check over exactly the accounts your tagging labels, which passes without saying anything on an estate that labels none. The first remediation assertion is not redundant with the two that follow it. describe-remediation-configurations returns a list whose minimum length is zero, so a rule with NO remediation attached returns an empty array, and a clause of the form 'every entry is Automatic' is true over it. Testing that the first entry exists is what turns 'the revocation fires by itself' from a claim into a field. The 90 in the assertions is the AWS default, not a FedRAMP number. Replace it in both places with the period your SSP commits to, and keep the runbook's own MaxCredentialUsageAge parameter equal to the period of the rule that triggers it — AWS documents that discipline for the access-keys-rotated pairing (match MaxCredentialUsageAge to that rule's maxAccessKeyAge) rather than for this rule, but the failure it prevents is the same one: a mismatch means the detection window and the revocation window disagree silently. Re-evaluating the rule within 4 hours of its last evaluation returns the previous result, so collect on the rule's own cadence rather than on demand. ## References - {"title":"AWS Config managed rule: iam-user-unused-credentials-check (IAM_USER_UNUSED_CREDENTIALS_CHECK; periodic; maxCredentialUsageAge default 90 days; re-evaluation within 4 hours has no effect)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-user-unused-credentials-check.html"} - {"title":"AWSConfigRemediation-RevokeUnusedIAMUserCredentials — revokes unused IAM passwords and active access keys, deactivates expired access keys, deletes expired login profiles; its documented parameter pairing is MaxCredentialUsageAge to the access-keys-rotated rule's maxAccessKeyAge","url":"https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-revoke-iam-user.html"} - {"title":"AWS CLI: configservice describe-remediation-configurations (Automatic, TargetType SSM_DOCUMENT, TargetId, MaximumAutomaticAttempts)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-remediation-configurations.html"} - {"title":"AWS CLI: configservice describe-config-rules (InputParameters is a JSON-formatted string; ConfigRuleState; Source.SourceIdentifier)","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/describe-config-rules.html"} - {"title":"AWS Config managed rule: required-tags (REQUIRED_TAGS) — its supported resource types do not include AWS::IAM::User","url":"https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html"} - {"title":"IAM API: UserDetail (CreateDate and Tags on every user returned by GetAccountAuthorizationDetails)","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_UserDetail.html"} --- ## https://ramprules.com/collect/external-access-inventory-and-trust-boundary # The machine-generated inventory of every resource an external entity can reach — IAM Access Analyzer's active ExternalAccess findings — read against the declared zone of trust, so the terms-and-conditions review has a list to work from rather than a memory > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/external-access-inventory-and-trust-boundary Recipe id: `external-access-inventory-and-trust-boundary` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MIT` - KSI `KSI-IAM-ELP` - control `ac-20` ## Collection Kind: `cli` ```sh # list-analyzers aws accessanalyzer list-analyzers --query 'analyzers[].{Name:name,Type:type,Status:status,Arn:arn,LastAnalyzedAt:lastResourceAnalyzedAt}' # list-findings-v2 aws accessanalyzer list-findings-v2 --analyzer-arn --filter '{"status":{"eq":["ACTIVE"]},"findingType":{"eq":["ExternalAccess"]}}' # describe-organization aws organizations describe-organization --query 'Organization.{Id:Id,FeatureSet:FeatureSet,ManagementAccount:MasterAccountId}' # iam-external-access-analyzer-enabled aws configservice get-compliance-details-by-config-rule --config-rule-name iam-external-access-analyzer-enabled --compliance-types NON_COMPLIANT ``` ## Expected output From list-analyzers, one row per analyzer with type ACCOUNT or ORGANIZATION for external access (the ACCOUNT_UNUSED_ACCESS, ORGANIZATION_UNUSED_ACCESS, ACCOUNT_INTERNAL_ACCESS and ORGANIZATION_INTERNAL_ACCESS types answer different questions and do not produce ExternalAccess findings) and status one of ACTIVE, CREATING, DISABLED, FAILED. From list-findings-v2, one finding per resource shared outside the zone of trust, each with resource, resourceType, resourceOwnerAccount, findingType, status, createdAt and analyzedAt. From describe-organization, the organization id, FeatureSet ALL or CONSOLIDATED_BILLING, and the management account id — the boundary an ORGANIZATION analyzer treats as internal. From the Config rule, an empty NON_COMPLIANT set means an external-access analyzer is enabled and ACTIVE in that Region. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud IAM Access Analyzer and Organizations operate in GovCloud (US); analyzer and resource ARNs use partition arn:aws-us-gov. The Config managed rule IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED is NOT available in either GovCloud (US) Region — its published availability excludes GovCloud (US-East) and GovCloud (US-West) — so in GovCloud the fourth call has no rule to query and the analyzer's own status field from list-analyzers is the evidence that it is enabled. ## Notes AC-20 is a two-limb control and only one limb is in this output. The limb that is here: which external entities can reach organization-controlled information. Access Analyzer answers that by logic-based reasoning over resource-based policies, and every access by a principal INSIDE the zone of trust is trusted by definition, so a finding is exactly an access that crosses the boundary the organization declared. The limb that is not here: whether each of those crossings is covered by terms and conditions consistent with the trust relationship. That is an agreement — a contract, an interconnection security agreement, an authorization to connect — and no call returns it. Attach the agreement register and reconcile it finding by finding; the reconciliation, not the finding list, is the AC-20 artifact. The inventory also has a direction. Access Analyzer sees resources you share OUT. It does not see an external system your people use to process organization information — a SaaS tool reached from a workstation leaves no resource policy in your account and produces no finding. That half of AC-20 has to come from your own third-party register, and inventing a join between the two would make the coverage claim wider than the evidence. Three scope facts worth pinning down before the count is quoted. External-access analysis is REGIONAL: an analyzer evaluates only resources in the Region where it is enabled, so one analyzer per Region in use, or the inventory is silently partial. Fifteen resource types are analyzed for external access — S3 buckets and directory buckets, IAM roles, KMS keys, Lambda functions and layers, SQS queues, Secrets Manager secrets, SNS topics, EBS volume snapshots, RDS DB and DB cluster snapshots, ECR repositories, EFS file systems, DynamoDB streams and tables — and a resource type outside that list is not covered by the analyzer at all. And findings refresh within about 30 minutes of a policy change but can lag up to 24 hours when a change notification is missed, so a finding list is a recent state, not a live one. ## References - {"title":"Using IAM Access Analyzer — zone of trust, ExternalAccess findings, the fifteen analyzed resource types, and the regional scope of external-access analysis","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html"} - {"title":"AWS CLI: accessanalyzer list-analyzers (type ACCOUNT | ORGANIZATION | *_UNUSED_ACCESS | *_INTERNAL_ACCESS; status ACTIVE | CREATING | DISABLED | FAILED)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-analyzers.html"} - {"title":"AWS CLI: accessanalyzer list-findings-v2 (filterable on status and findingType; returns resource, resourceType, resourceOwnerAccount, analyzedAt)","url":"https://docs.aws.amazon.com/cli/latest/reference/accessanalyzer/list-findings-v2.html"} - {"title":"AWS Config managed rule: iam-external-access-analyzer-enabled (IAM_EXTERNAL_ACCESS_ANALYZER_ENABLED) — unavailable in both AWS GovCloud (US) Regions","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-external-access-analyzer-enabled.html"} - {"title":"AWS CLI: organizations describe-organization (Id, FeatureSet, management account; AvailablePolicyTypes is deprecated — use list-roots instead)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/describe-organization.html"} --- ## https://ramprules.com/collect/session-authenticity-tls-termination # Every place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTP > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/session-authenticity-tls-termination Recipe id: `session-authenticity-tls-termination` · cadence quarterly · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - KSI `KSI-SVC-VCM` - control `sc-23` ## Collection Kind: `cli` ```sh # describe-load-balancers aws elbv2 describe-load-balancers --query 'LoadBalancers[].{LB:LoadBalancerName,Arn:LoadBalancerArn,Type:Type,Scheme:Scheme}' # describe-listeners aws elbv2 describe-listeners --load-balancer-arn --query 'Listeners[].{Port:Port,Protocol:Protocol,SslPolicy:SslPolicy,Certificates:Certificates[].CertificateArn,Action:DefaultActions[0].Type,Redirect:DefaultActions[0].RedirectConfig}' # describe-ssl-policies aws elbv2 describe-ssl-policies --query "SslPolicies[?contains(Name,'FIPS')].Name" # alb-http-to-https-redirection-check aws configservice get-compliance-details-by-config-rule --config-rule-name alb-http-to-https-redirection-check --compliance-types NON_COMPLIANT # cloudfront-viewer-policy-https aws configservice get-compliance-details-by-config-rule --config-rule-name cloudfront-viewer-policy-https --compliance-types NON_COMPLIANT ``` ## Expected output From describe-listeners, one row per listener: Protocol from HTTP, HTTPS, TCP, TLS, UDP, TCP_UDP, GENEVE, QUIC or TCP_QUIC; SslPolicy present only on HTTPS and TLS listeners and naming a policy such as ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.3 and 1.2 only) or ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04; Certificates carrying the default certificate ARN; and for a plain HTTP listener a DefaultActions entry of Type redirect whose RedirectConfig names Protocol HTTPS with StatusCode HTTP_301. Note the CLI default: a listener created by CLI, CloudFormation or CDK without an explicit policy gets ELBSecurityPolicy-2016-08, which still negotiates TLS 1.0. From the two Config rules, empty NON_COMPLIANT sets mean no Application Load Balancer serves an HTTP listener without redirection and no CloudFront distribution leaves ViewerProtocolPolicy at allow-all. Run the CloudFront call in US East (N. Virginia): CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only there, matching CloudFront's global scope, so the same command in any other Region returns nothing at all — a silence that reads exactly like a pass and is not one. ## Assertions _No machine-checkable assertion is authored for this recipe._ ## GovCloud Elastic Load Balancing, the security policies including the FIPS families, and AWS Certificate Manager are available in GovCloud (US); load-balancer and certificate ARNs use partition arn:aws-us-gov. ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is available in all supported Regions. Two rules in this family are not usable there: CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only in US East (N. Virginia), matching CloudFront's global scope and leaving GovCloud with no CloudFront distributions to evaluate, and ELBV2_ACM_CERTIFICATE_REQUIRED is excluded from both GovCloud (US) Regions — so in GovCloud the certificate check comes from the Certificates field of describe-listeners directly, not from Config. ## Notes SC-23 says protect the authenticity of communications sessions, and authenticity has a floor and a ceiling. The floor is transport: a session that can be read or injected into on the wire is not authentic in any sense, and the floor is entirely in this output — which listeners terminate TLS, under which negotiated policy, with which certificate, and whether the HTTP door redirects instead of answering. The ceiling is session identity above the transport: regenerating a session identifier on privilege change, invalidating it at logout, binding it to the principal it was issued to, refusing one that was replayed. That lives in application code and emits no AWS telemetry, which is what keeps this partial. Say which half you are evidencing, or a reader will assume the larger one. Read SslPolicy as a version floor, not a checkmark. The policy name encodes the oldest protocol it will negotiate: ELBSecurityPolicy-TLS13-1-2-2021-06 admits TLS 1.3 and 1.2 only, while ELBSecurityPolicy-TLS13-1-0-2021-06 and the 2016-08 default still admit TLS 1.0. The FIPS families — listed by the describe-ssl-policies query above — use the AWS-LC FIPS validated module, and AWS marks ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04 and ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04 as legacy compatibility only, FIPS cryptography that, in AWS's own words, may not conform to the latest NIST guidance for TLS configuration. FIPS in the name is therefore not by itself the answer to a FIPS question. The redirection rule is narrower than it sounds: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is NON_COMPLIANT both when an HTTP listener has no redirect and when it forwards to another HTTP listener instead of redirecting — but it covers Application Load Balancers only. Network Load Balancer TLS listeners, API Gateway, and anything terminating TLS on an instance are outside it and have to be enumerated by hand. ## References - {"title":"AWS CLI: elbv2 describe-listeners (Protocol, SslPolicy, Certificates, DefaultActions with RedirectConfig Protocol/Port/StatusCode)","url":"https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-listeners.html"} - {"title":"Security policies for your Application Load Balancer — protocols by policy, the FIPS families on the AWS-LC validated module, the legacy-only TLS13-1-1/1-0 FIPS policies, and the ELBSecurityPolicy-2016-08 CLI default","url":"https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html"} - {"title":"AWS Config managed rule: alb-http-to-https-redirection-check (ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK; also NON_COMPLIANT when an HTTP listener forwards to an HTTP listener)","url":"https://docs.aws.amazon.com/config/latest/developerguide/alb-http-to-https-redirection-check.html"} - {"title":"AWS Config managed rule: cloudfront-viewer-policy-https (CLOUDFRONT_VIEWER_POLICY_HTTPS; NON_COMPLIANT when ViewerProtocolPolicy is allow-all; evaluates only in US East (N. Virginia))","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudfront-viewer-policy-https.html"} - {"title":"AWS Config managed rule: elbv2-acm-certificate-required (ELBV2_ACM_CERTIFICATE_REQUIRED) — excluded from both AWS GovCloud (US) Regions","url":"https://docs.aws.amazon.com/config/latest/developerguide/elbv2-acm-certificate-required.html"} --- ## https://ramprules.com/collect/change-authority-restrictions-and-enforcement # The enforced half of who may change what: the service control policy type actually enabled in the organization root, the customer-authored SCPs and the roots, OUs and accounts each one is attached to, and the permissions boundary carried by every principal your own tagging marks as a change authority > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/change-authority-restrictions-and-enforcement Recipe id: `change-authority-restrictions-and-enforcement` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-RMV` - KSI `KSI-IAM-JIT` - control `cm-5` ## Collection Kind: `cli` ```sh # describe-organization aws organizations describe-organization # list-roots aws organizations list-roots # list-policies aws organizations list-policies --filter SERVICE_CONTROL_POLICY # describe-policy aws organizations describe-policy --policy-id # list-targets-for-policy aws organizations list-targets-for-policy --policy-id # get-account-authorization-details aws iam get-account-authorization-details --filter User Role ``` ## Expected output All six responses are collected unprojected, so every field below is the name AWS returns and the name the assertions address. The first three calls take no argument; calls four and five take a policy id that MUST be one of the AwsManaged false ids returned by call three — a human substitution the assertion grammar cannot make, and the reason the placeholder is named CUSTOMER_AUTHORED_SCP_ID rather than POLICY_ID. Call six must be issued with MANAGEMENT-ACCOUNT credentials: Organizations operations may also be called from a member account designated as a delegated administrator, and a collection run there returns that member account's principals while reading exactly like the management account's. From describe-organization, an Organization object with Id, Arn, MasterAccountId, MasterAccountEmail and FeatureSet, which is ALL or CONSOLIDATED_BILLING; AvailablePolicyTypes is also returned and is DEPRECATED by AWS, which documents that it omits every policy type other than SCPs and directs you to ListRoots instead. From list-roots, Roots[] with Id, Arn, Name and PolicyTypes[], each entry carrying Type and a Status that is ENABLED, PENDING_ENABLE or PENDING_DISABLE — there is no DISABLED value, because a policy type that is off is ABSENT from the list rather than reported as off. From list-policies, Policies[] with Id, Arn, Name, Description, Type and AwsManaged, a boolean that is true for policies you cannot edit; AWS attaches the managed FullAWSAccess policy to every root, OU and account when it is created, so the list is never empty on an organization with SCPs enabled and its length says nothing about whether anyone has authored a restriction. From describe-policy, a Policy object with a PolicySummary carrying the same six fields as a list entry, and Content — the policy document itself, returned as a JSON-formatted STRING that must be parsed before any statement in it can be read. From list-targets-for-policy, Targets[] with TargetId, Arn, Name and a Type of ACCOUNT, ORGANIZATIONAL_UNIT or ROOT. From get-account-authorization-details, UserDetailList[] and RoleDetailList[] with UserName/RoleName, CreateDate, Tags, the attached and inline policy lists, and PermissionsBoundary — an optional AttachedPermissionsBoundary object carrying PermissionsBoundaryType and PermissionsBoundaryArn, absent entirely on a principal that has none. ## Assertions - {"field":"describe-organization.Organization.FeatureSet","op":"eq","value":"ALL","controls":["cm-5"],"description":"The organization has all features enabled. SCPs are available only in an organization with all features enabled; on CONSOLIDATED_BILLING every policy this recipe collects is inert. Mandatory, and therefore uninformative, in GovCloud."} - {"field":"list-roots.Roots[0].PolicyTypes[?Type=='SERVICE_CONTROL_POLICY'] | [0].Status","op":"exists","controls":["cm-5"],"description":"The SCP policy type appears in the root at all. A policy type that is off is absent from PolicyTypes[] rather than carrying a DISABLED status — the enum has no such value — so the clause below passes vacuously over an organization where SCPs were never enabled. The pipe is load-bearing: without it the [0] indexes each matched string rather than the filtered list, and the expression is empty whether the entry is present or not."} - {"field":"list-roots.Roots[].PolicyTypes[?Type=='SERVICE_CONTROL_POLICY'].Status","op":"eq","value":"ENABLED","controls":["cm-5"],"description":"The SCP policy type is enabled rather than mid-transition; PENDING_DISABLE is an organization on its way to enforcing nothing."} - {"field":"list-policies.Policies[?AwsManaged==`false`] | [0].Id","op":"exists","controls":["cm-5"],"description":"At least one SCP in the organization was authored by you. AWS attaches the managed FullAWSAccess policy to every root, OU and account at creation, so a non-empty Policies[] is the default state of a working organization and not a restriction anyone wrote. The pipe is load-bearing for the same reason as the root clause above."} - {"field":"list-targets-for-policy.Targets[0].TargetId","op":"exists","controls":["cm-5"],"description":"The customer-authored SCP passed to call five is attached to a root, an OU or an account. This clause proves attachment ONLY because the command is bound to an AwsManaged false id: run against any policy id it is satisfied by FullAWSAccess, which AWS attaches to every root, OU and account at creation. Binding it is a human step — the grammar compares a field to a constant, never one command's output to another's — so a collector that substitutes an arbitrary policy id has produced a green result about the AWS default."} - {"field":"get-account-authorization-details.RoleDetailList[?not_null(Tags[?Key=='ChangeAuthority' && Value=='true'] | [0]) && !PermissionsBoundary]","op":"count_eq","controls":["cm-5"],"description":"No role your own tagging marks as a change authority is missing a permissions boundary — the per-principal ceiling that applies inside the management account, where SCPs do not reach. Written as an OFFENDER LIST rather than as 'every role has a boundary', because a field projection over a list DROPS the rows that lack the field instead of reporting them false, so the every-row form silently answers about the compliant rows only. Zero on an estate that tags no roles, so read it beside the tag count. The call must be run with management-account credentials or it describes a different account's roles.","value":0} ## GovCloud AWS Organizations is available in both AWS GovCloud (US) Regions and SCPs are one of the policy types a GovCloud organization may use, alongside RCPs, tag policies and declarative policies for EC2 and S3; backup, chat application and AI services opt-out policies cannot be created there. Organization, root, OU, account, policy and IAM ARNs use partition arn:aws-us-gov. Three GovCloud facts change how this recipe is run rather than what it means. All features are MANDATORY — the consolidated billing feature set is not offered — so FeatureSet reads ALL in every GovCloud organization and the first assertion is satisfied by the Region rather than by a decision anyone made. The SECOND call is the one with a Region constraint: AWS restricts any operation that references the organization root, naming ListRoots as its example, to the AWS GovCloud (US-West) Region, so list-roots must be issued against us-gov-west-1 regardless of where the workload runs. The other five calls carry no such restriction. And a GovCloud organization is INDEPENDENT of the commercial organization its accounts are paired with: SCPs attached in the commercial organization do not restrict the GovCloud accounts, and an assessor handed a commercial organization's policy list has been handed evidence about a different boundary. ## Notes CM-5 asks for physical AND logical access restrictions associated with changes that are defined, documented, approved and enforced. This recipe reaches one adjective and one verb. The adjective it does not reach is PHYSICAL. No AWS API returns anything about physical access to the hardware a change is made on; under the shared responsibility model that half belongs to the IaaS provider and is inherited — read it from the provider's own authorization package and the FedRAMP customer responsibility matrix, not from this output. A collection that presents these six calls as CM-5 evidence without saying so has answered half a control and labelled it whole. The verb it does reach is ENFORCE, and it reaches it properly: an SCP is not a description of a restriction, it is the restriction, evaluated by AWS on every request from every member account, and list-targets-for-policy is the difference between a policy that exists and a policy that applies to something. Two gaps keep this partial, not one. The first is approval — that the enforced set IS the documented and approved set is a comparison against a change-management record, and no call returns it. The second is subject matter, and it is the easier one to miss: the assertions below show THAT a customer-authored SCP is enforced, never WHAT it restricts. An SCP denying mechanicalturk:* satisfies every clause here exactly as well as one denying ec2:ModifyInstanceAttribute. The fourth call exists to close that by putting the policy document in the evidence — Content is returned as a JSON string and must be parsed — but no assertion can grade a policy document, so the phrase that makes this CM-5 rather than AC-3, 'associated with changes', stays a human read. Both gaps are reconciliations against your own records; the reconciliation is the CM-5 artifact and this output is the column it is reconciled against. Four ways this evidence is vacuous if it is read naively. Three are behaviour AWS documents in as many words; the fourth is an inference from a field being a list, flagged as such rather than dressed up as a citation. A policy type that has never been enabled is ABSENT from Roots[].PolicyTypes rather than present with a Status of DISABLED — the enum has no such value — so a clause of the form 'every SCP policy type entry is ENABLED' is true over an organization where SCPs were never turned on at all, which is why one assertion tests that the entry exists before another reads it. AWS attaches the managed FullAWSAccess policy to EVERY root, OU and account when it is created, so both a non-empty Policies[] and a non-empty Targets[] are the default state of a working organization rather than a restriction anyone wrote — which is why one assertion counts only the AwsManaged false subset, and why calls four and five are bound to a customer-authored policy id instead of any policy id. FeatureSet CONSOLIDATED_BILLING makes SCPs unavailable outright, so on such an organization every policy in the list is inert. And an SCP attached to nothing returns an empty Targets[]: that one AWS does not state, it follows from Targets being a list, and the assertion that rests on it should be read as an inference. The scope edge that matters most to an assessor is that SCPs do not restrict the management account. AWS states this three times on its own page and lists it first among the tasks SCPs cannot restrict: SCPs affect only member accounts, including member accounts designated as delegated administrators, and they have no effect on users or roles in the management account. The account with the broadest reach over the organization is the one account this evidence says nothing about, and its change restrictions have to come from identity-based policy and permission boundaries inside it — which is what the sixth call collects, and why the sixth call has to be run there. SCPs also do not affect service-linked roles at all, and they do not affect principals from accounts outside the organization even when a resource-based policy in your account grants those principals access. Read an SCP for what it is: a ceiling, never a grant. AWS is explicit that no permissions are granted by an SCP and that effective permissions are the intersection of what the SCP allows with what identity-based and resource-based policies allow — a principal with no IAM permissions has no access under the most permissive SCP in the world. Where a permissions boundary is also present, AWS documents that the boundary, the SCP and the identity-based policy must ALL allow the action, which is why the sixth call is collected beside the first five rather than instead of them. One failure mode worth writing into the assessment because it is silent and total: disabling the SCP policy type in a root automatically detaches every SCP from every OU, account and organization in that root, and re-enabling it does not restore the attachments — the root reverts to FullAWSAccess alone and the previous attachments are lost and not automatically recoverable. After such an event list-policies still returns every authored policy, unchanged, while nothing is enforced anywhere. The Roots[].PolicyTypes reading and the Targets[] reading are what separate those two worlds, and a collection that skips them cannot tell them apart. The permissions-boundary assertion is scoped by your own tagging rather than written as a claim over the account, for the same reason as in the AC-02 (02) recipe: no AWS call knows which of your roles are supposed to be the change authorities. It passes without saying anything on an estate that tags none, so treat the tagging standard as a written control with a manual sample rather than as coverage. What actually happened, as opposed to what was permitted, is a different recipe: CloudTrail's non-read-only event history, collected under CM-03 alongside the Config resource timeline and the Systems Manager change-request records. This one is about the restriction; that one is about the change. ## References - {"title":"AWS Organizations User Guide: service control policies — SCPs require all features enabled, never grant permissions, do not affect the management account or service-linked roles, and disabling the policy type detaches every SCP irrecoverably","url":"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html"} - {"title":"AWS Organizations User Guide: SCP evaluation — AWS attaches the managed FullAWSAccess policy to every root, OU and account when it is created, and SCP evaluation is deny-by-default with allow required at every level","url":"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html"} - {"title":"AWS CLI: organizations list-roots (Roots[].PolicyTypes[] with Type and Status ENABLED | PENDING_ENABLE | PENDING_DISABLE — no DISABLED value)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/list-roots.html"} - {"title":"AWS CLI: organizations list-policies (--filter SERVICE_CONTROL_POLICY; Policies[] carries AwsManaged, true for policies you can attach but cannot edit)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/list-policies.html"} - {"title":"AWS CLI: organizations list-targets-for-policy (Targets[] with TargetId, Arn, Name and Type ACCOUNT | ORGANIZATIONAL_UNIT | ROOT)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/list-targets-for-policy.html"} - {"title":"AWS CLI: organizations describe-organization (FeatureSet ALL | CONSOLIDATED_BILLING; AvailablePolicyTypes is deprecated — use ListRoots)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/describe-organization.html"} - {"title":"IAM API: RoleDetail — PermissionsBoundary is an optional AttachedPermissionsBoundary (PermissionsBoundaryType, PermissionsBoundaryArn) returned by GetAccountAuthorizationDetails","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleDetail.html"} - {"title":"AWS GovCloud (US) User Guide: AWS Organizations — all features mandatory, ListRoots and root-referencing operations only in GovCloud (US-West), GovCloud organizations independent of commercial ones, and the permitted policy types","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-organizations.html"} - {"title":"AWS CLI: organizations describe-policy (Policy.PolicySummary with Id, Arn, Name, Description, Type, AwsManaged; Policy.Content is the policy document as a string)","url":"https://docs.aws.amazon.com/cli/latest/reference/organizations/describe-policy.html"} - {"title":"AWS CLI: iam get-account-authorization-details (--filter possible values User | Role | Group | LocalManagedPolicy | AWSManagedPolicy; the page describes the parameter as a comma-separated list while the CLI synopsis passes them space-separated, which is the form used here)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"} --- ## https://ramprules.com/collect/internal-connection-inventory-and-authorization # The machine-generated inventory of every plane on which one part of the system reaches another — VPC peering connections, Transit Gateway attachments, the interface and gateway endpoints this account consumes, the endpoint connections other accounts have made INTO your endpoint service, and the security-group rules that name another group rather than a CIDR — each narrowed to the states that are actually live > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/internal-connection-inventory-and-authorization Recipe id: `internal-connection-inventory-and-authorization` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-ULN` - control `ca-9` ## Collection Kind: `cli` ```sh # describe-vpc-peering-connections aws ec2 describe-vpc-peering-connections # describe-transit-gateway-attachments aws ec2 describe-transit-gateway-attachments # describe-vpc-endpoints aws ec2 describe-vpc-endpoints # describe-vpc-endpoint-connections aws ec2 describe-vpc-endpoint-connections # describe-security-group-rules aws ec2 describe-security-group-rules ``` ## Expected output All five responses are collected unprojected and per-Region — every one of these is a Regional call, so an inventory taken in one Region is an inventory of one Region. From describe-vpc-peering-connections, VpcPeeringConnections[] with VpcPeeringConnectionId, Tags, ExpirationTime, and RequesterVpcInfo and AccepterVpcInfo each carrying OwnerId, VpcId, Region, CidrBlock and CidrBlockSet — the account on the far side is OwnerId, and it is the field that says whether a connection is internal at all. Status.Code is one of initiating-request, pending-acceptance, active, deleted, rejected, failed, expired, provisioning, deleting: the list is a history, not a live inventory, and only `active` is a connection. From describe-transit-gateway-attachments, TransitGatewayAttachments[] with TransitGatewayAttachmentId, TransitGatewayId, TransitGatewayOwnerId, ResourceOwnerId, ResourceId, CreationTime, Tags, an Association carrying TransitGatewayRouteTableId and its own State, a ResourceType of vpc, vpn, vpn-concentrator, direct-connect-gateway, connect, peering, tgw-peering (deprecated) or client-vpn, and a State among initiating (deprecated), initiatingRequest, pendingAcceptance, rollingBack, pending, available, modifying, deleting, deleted, failed, rejected, rejecting and failing — `available` is the live one, and `pendingAcceptance` is a cross-account attachment nobody has adjudicated. From describe-vpc-endpoints, VpcEndpoints[] with VpcEndpointId, VpcEndpointType (Interface, Gateway, GatewayLoadBalancer, Resource, ServiceNetwork), VpcId, ServiceName, OwnerId, CreationTimestamp, PolicyDocument, PrivateDnsEnabled, RouteTableIds for gateway endpoints, SubnetIds and Groups for interface endpoints, Tags, and a State among PendingAcceptance, Pending, Available, Deleting, Deleted, Rejected, Failed, Expired and Partial. From describe-vpc-endpoint-connections — the provider side, and the only one of the five that shows connections INTO you — VpcEndpointConnections[] with ServiceId, VpcEndpointId, VpcEndpointOwner (the consumer's account id), CreationTimestamp, DnsEntries, IpAddressType and a VpcEndpointState of PendingAcceptance, Pending, Available, Deleting, Deleted, Rejected, Failed, Expired or Partial — PascalCase, unlike the Transit Gateway attachment state beside it, and unlike the lowercase forms the CLI page lists as --filters ARGUMENT values. From describe-security-group-rules, SecurityGroupRules[] with SecurityGroupRuleId, SecurityGroupRuleArn, GroupId, IsEgress, IpProtocol, FromPort, ToPort, Description, Tags, and a peer field naming what the rule permits traffic to or from — CidrIpv4, CidrIpv6, PrefixListId or ReferencedGroupInfo, and IsEgress is what says which direction that peer sits in; a rule carrying ReferencedGroupInfo is one component reaching another by identity rather than by address, which is the internal connection CA-09 is about. ## Assertions - {"field":"describe-vpc-peering-connections.VpcPeeringConnections[?Status.Code=='active'] | [?!not_null(Tags[?Key=='ConnectionAuthorization'] | [0])]","op":"count_eq","value":0,"controls":["ca-9"],"description":"No ACTIVE peering connection is missing the tag naming the authorization record that permitted it. Narrowed by state because the response also carries deleted, rejected, expired and failed connections. Zero on an account with no peering connections, so read it beside the length of the list, never instead of it."} - {"field":"describe-vpc-peering-connections.VpcPeeringConnections[?Status.Code=='pending-acceptance'] | [0].VpcPeeringConnectionId","op":"not_exists","controls":["ca-9"],"description":"No peering request is sitting unaccepted. An unaccepted request is not a connection, but it is an authorization decision nobody has made, and ExpirationTime means it resolves itself by lapsing if the review never happens. The pipe is load-bearing: without it the [0] indexes each matched object rather than the filtered list, and the expression is empty whether such a request exists or not."} - {"field":"describe-transit-gateway-attachments.TransitGatewayAttachments[?State=='available'] | [?!not_null(Tags[?Key=='ConnectionAuthorization'] | [0])]","op":"count_eq","value":0,"controls":["ca-9"],"description":"No AVAILABLE Transit Gateway attachment is missing its authorization tag. ResourceOwnerId is what says whether the far side is inside the boundary, and no assertion can compare it to your account list."} - {"field":"describe-transit-gateway-attachments.TransitGatewayAttachments[?State=='pendingAcceptance'] | [0].TransitGatewayAttachmentId","op":"not_exists","controls":["ca-9"],"description":"No cross-account Transit Gateway attachment is waiting to be accepted. Note the case: the attachment state is camelCase pendingAcceptance, while the VPC endpoint connection state below is PascalCase PendingAcceptance — the two enums are spelled differently and a literal copied from one to the other matches nothing while still returning a green result."} - {"field":"describe-vpc-endpoint-connections.VpcEndpointConnections[?VpcEndpointState=='PendingAcceptance'] | [0].VpcEndpointId","op":"not_exists","controls":["ca-9"],"description":"No consumer account is waiting on a decision to connect INTO an endpoint service this account publishes. This is the only inbound clause in the recipe, and VpcEndpointOwner on such an entry is the account asking. The literal is PascalCase per the VpcEndpointConnection API type; the lowercase spelling on the CLI page is a --filters argument value, not an output value."} - {"field":"describe-security-group-rules.SecurityGroupRules[?ReferencedGroupInfo && !Description]","op":"count_eq","value":0,"controls":["ca-9"],"description":"No security-group rule that reaches another group by identity rather than by address is left without a description. A documentation-completeness check, not evidence about the connection: Description is free text and AWS validates none of it — and in GovCloud it is a field AWS asks you to keep export-controlled data out of."} ## GovCloud Amazon VPC, Transit Gateway and PrivateLink all operate in both AWS GovCloud (US) Regions and every call here is available; VPC, endpoint, attachment and security-group ARNs use partition arn:aws-us-gov. Two documented GovCloud differences touch this recipe and neither blocks it. Security group rule IDs are not shown in the Amazon VPC CONSOLE in GovCloud — the API returns SecurityGroupRuleId normally, so collect this evidence through the CLI and do not expect a reviewer to reconcile it against a console screenshot. And not all VPC endpoints in GovCloud support VPC endpoint policies, so PolicyDocument may be absent on an endpoint where the commercial Regions would carry one; read its absence as an unsupported endpoint type rather than as a removed control, and say which it was. Note also that VPC metadata in GovCloud is not permitted to contain export-controlled data, and AWS names security group rule descriptions, tag keys and values, and VPC endpoint service names among the free-text fields this applies to — which is a constraint on the very fields this recipe asks you to write an authorization reference into. ## Notes CA-09 has four elements and this output serves parts of two of them. The part it holds: which internal connections exist. Every plane on which one component of the system reaches another leaves a resource behind — a peering connection, a Transit Gateway attachment, an endpoint, an endpoint connection, or a security-group rule that names another group instead of a CIDR — and five calls enumerate them completely for a Region. That enumeration is worth having on its own: it is the list the control's documentation requirement is written against, and most providers do not have it. What it does not hold is everything CA-09 asks you to record about each connection. The interface characteristics, the security AND PRIVACY requirements agreed for the connection, the nature of the information communicated, and the authorization to connect at all — none of them is a field. Two further elements of the control are not addressed here at all and should not be read as covered: terminating internal connections when the stated conditions are met, and reviewing the continued need for each connection on a stated frequency. The second of those is the one this inventory most nearly serves — a continuously collected enumeration is the substrate a periodic review runs on — but the review itself is a decision with a date and a reviewer, and none of that is in the response. They live in an interconnection agreement or an internal approval record, and the reconciliation of that record against this inventory is the CA-09 artifact. This recipe produces the column you reconcile against, which is why it is partial and why no assertion below claims more than attachment and state. Read every one of these lists as a history rather than an inventory. Peering connections persist in the response with Status.Code deleted, rejected, expired or failed; Transit Gateway attachments persist as deleted, failed or rejected; endpoints persist as Deleted or Rejected. A count taken over the raw response counts connections that do not exist, and — the direction that actually matters — a clause of the form 'every connection carries an authorization tag' evaluated over the raw response is answering about the dead ones too. Every assertion here is therefore narrowed by state, and the narrowing is the assertion. The completeness clauses are written as OFFENDER LISTS — a filter that selects the rows which fail, asserted to be empty — and not as 'every connection carries a tag'. This is not a style preference. A field projection over a list drops the rows where the field is absent instead of reporting them as false, so an every-row clause of the obvious form evaluates only the rows that already comply and is green on an estate where half the connections are untagged. The offender form was verified against synthetic responses before it was written down. The vacuity to state plainly: all five lists are empty on an account that has none of these, and an every-entry clause over an empty list is true. This evidence cannot distinguish 'no internal connections' from 'no connections in THIS Region' from 'the collection ran with a role that cannot see them'. Record the Region set the collection covered beside the output, because every one of these calls is Regional and nothing in the response says which Region produced it. Two directions, and only one of them is intuitive. Four of the five calls show what this account reaches OUT to. describe-vpc-endpoint-connections is the other direction — it is the provider-side view of who has connected IN to an endpoint service you publish — and a pendingAcceptance entry there is a connection request nobody has adjudicated. The same is true of a peering connection in pending-acceptance: an unaccepted request is not yet a connection, but it is a decision someone owes, and it belongs in the review the KSIs describe as persistent rather than in a quarterly surprise. OwnerId and ResourceOwnerId are what make 'internal' checkable at all, and they are also the join this grammar cannot do: deciding whether a peer account is inside the authorization boundary means comparing OwnerId against your own account list, and an assertion compares a field to a constant. Write the boundary's account set into the assessment and reconcile by hand; a tag naming the authorization record is the closest a field gets, which is what the assertions ask for. Security-group rules are included for a reason worth stating: they are the only one of the five that shows a connection with no resource of its own. A rule whose ReferencedGroupInfo names another security group is one component permitted to reach another by identity, and it is invisible to any inventory that looks only for peering connections and attachments. Description is free text and no AWS call validates it, so treat the description assertion as a documentation-completeness check rather than as evidence about the connection itself. ## References - {"title":"AWS CLI: ec2 describe-vpc-peering-connections (VpcPeeringConnections[] with Tags, ExpirationTime, RequesterVpcInfo/AccepterVpcInfo carrying OwnerId, VpcId, Region; Status.Code including pending-acceptance, active, deleted, rejected, expired)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-peering-connections.html"} - {"title":"AWS CLI: ec2 describe-transit-gateway-attachments (ResourceType and State enums, ResourceOwnerId, TransitGatewayOwnerId, Association, CreationTime, Tags)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-transit-gateway-attachments.html"} - {"title":"AWS CLI: ec2 describe-vpc-endpoints (VpcEndpointType and State enums, ServiceName, PolicyDocument, OwnerId, Groups, SubnetIds, RouteTableIds)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoints.html"} - {"title":"AWS CLI: ec2 describe-vpc-endpoint-connections — the service-provider view of consumer connections, with VpcEndpointOwner and VpcEndpointState including pendingAcceptance","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-vpc-endpoint-connections.html"} - {"title":"AWS CLI: ec2 describe-security-group-rules (SecurityGroupRuleId, IsEgress, Description, and the CidrIpv4 / CidrIpv6 / PrefixListId / ReferencedGroupInfo peer fields)","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-group-rules.html"} - {"title":"AWS GovCloud (US) User Guide: Amazon VPC — security group rule IDs unavailable in the console, not all VPC endpoints support endpoint policies, and the free-text fields that must not carry export-controlled data","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-vpc.html"} - {"title":"Amazon EC2 API: VpcEndpointConnection — vpcEndpointState valid values PendingAcceptance | Pending | Available | Deleting | Deleted | Rejected | Failed | Expired | Partial (PascalCase)","url":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VpcEndpointConnection.html"} - {"title":"Amazon EC2 API: TransitGatewayAttachment — state valid values including initiatingRequest, pendingAcceptance, rollingBack, modifying, rejecting and failing (camelCase; initiating deprecated), and resourceType including vpn-concentrator (tgw-peering deprecated)","url":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TransitGatewayAttachment.html"} --- ## https://ramprules.com/collect/identifier-assignment-and-reuse-prevention # Every identifier the account has issued, with the date it was assigned and the AWS-generated unique id behind it; the workforce identifiers issued through IAM Identity Center and the external issuer each one came from; and the CloudTrail record of identifiers being deleted, which is the only dated evidence of a name becoming free to reuse > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/identifier-assignment-and-reuse-prevention Recipe id: `identifier-assignment-and-reuse-prevention` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - KSI `KSI-IAM-JIT` - control `ia-4` ## Collection Kind: `cli` ```sh # get-account-authorization-details aws iam get-account-authorization-details --filter User Role Group # list-instances aws sso-admin list-instances # list-users aws identitystore list-users --identity-store-id # lookup-events-delete-user aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteUser --start-time --end-time ``` ## Expected output From get-account-authorization-details, UserDetailList[], RoleDetailList[] and GroupDetailList[] — a group name is an identifier IA-04 covers and GroupDetail carries GroupId, the stable and unique string identifying the group, though NOT Tags — with UserName/RoleName/GroupName, the AWS-generated UserId/RoleId, Arn, Path, CreateDate as an ISO-8601 timestamp, Tags, and the attached and inline policy lists. This call rather than iam list-users is deliberate: list-users returns UserId, UserName, Arn, Path and CreateDate but AWS documents that it does NOT return Tags or PermissionsBoundary, and the tag is where an authorization reference can live. From sso-admin list-instances, Instances[] — a list whose minimum length is ZERO — each with InstanceArn, IdentityStoreId, Name, OwnerAccountId, CreatedDate, PrimaryRegion, Regions and a Status of CREATE_IN_PROGRESS, CREATE_FAILED, DELETE_IN_PROGRESS or ACTIVE. IdentityStoreId from that response is the argument the third call needs. From identitystore list-users, Users[] with the required IdentityStoreId and UserId and optional UserName, ExternalIds (a list of issuer/id pairs), Name, Emails, UserStatus (ENABLED or DISABLED), CreatedAt/CreatedBy and UpdatedAt/UpdatedBy. From lookup-events, Events[] with EventName DeleteUser, EventTime, and Username — which AWS documents as the user or role name of the REQUESTER that called the API, meaning the administrator who ran the deletion and NOT the identifier that was deleted. The deleted name is inside the CloudTrailEvent JSON, at requestParameters.userName, and that is the field the reuse comparison reads — bounded, as every lookup-events call is, to management events within the last 90 days. ## Assertions - {"field":"get-account-authorization-details.UserDetailList[?!not_null(Tags[?Key=='IdentifierAuthorization'] | [0])]","op":"count_eq","value":0,"controls":["ia-4"],"description":"No IAM user is missing the tag naming the record that authorized its identifier — the first of IA-04's four verbs, as far as a field can carry it. Written as an offender list because a field projection drops the untagged rows rather than reporting them false, which is exactly the population being asked about. Your own tagging convention, so it is only as complete as the tagging behind it; zero on an account with no IAM users, which is the target state, so read it beside the length of UserDetailList. It cannot extend to groups, which carry no Tags."} ## GovCloud IAM is global and partition-scoped: identifiers created in GovCloud carry arn:aws-us-gov and are entirely separate from the commercial partition's, so an identifier inventory taken in one partition says nothing about the other. IAM Identity Center operates in both AWS GovCloud (US) Regions over FIPS endpoints with NO multi-Region support, and its ARNs take the form arn:aws-us-gov:sso:::instance/ — so list-instances must be run in the Region the instance was enabled in, and PrimaryRegion in the response is what says which that is. CloudTrail management events are available in both GovCloud Regions, but note that CloudFront, IAM and STS events are delivered to us-gov-west-1 specifically: IAM is a global service, so the DeleteUser events this recipe reads land in US-West and a lookup-events call issued against US-East returns nothing while succeeding. ## Notes IA-04 is four verbs — receive authorization for an identifier, select it, assign it to the intended party, and prevent its reuse for a defined period. AWS proves the third completely, gives real but bounded evidence for the fourth, and returns nothing at all for the first two. Assignment is the easy half and it is genuinely complete: every identifier in the account is enumerable with the date it was assigned and the AWS-generated unique id behind it. Selection and authorization are records about a decision, not about a resource, and no call returns them. Reuse is where this control is usually mis-evidenced, and AWS's own documentation is unusually direct about why. Within an account a friendly name for a user, group, role or policy must be unique — but only while it exists. AWS documents the exact failure IA-04's reuse clause exists to prevent: an employee named John leaves, the IAM user John is deleted, a new employee named John arrives, a new IAM user John is created, and a policy written against the friendly name grants the new John access to what the old John left behind. Nothing in AWS prevents that. There is no cooling-off period, no reserved-name list, no setting. What AWS guarantees instead is narrower and worth reading precisely: the unique id is never reused, so the old John's AIDA... and the new John's AIDA... differ, and a resource-based policy or an aws:userId condition written against the unique id cannot be inherited by a successor. The identifier that is protected from reuse is the one nobody uses in policy by default. So the honest evidence for the reuse limb is a comparison, not a field: DeleteUser events dated against the CreateDate of a live identifier bearing the same name — UserDetailList[].CreateDate is collected here and is the right side of that comparison, which is why no CreateUser lookup is listed. Note what to read on the left side: Username on a lookup-events entry is the REQUESTER, the administrator who ran the deletion, so the deleted identifier has to come out of the CloudTrailEvent JSON at requestParameters.userName. Reading Username as the deleted name is the easy mistake and it produces a comparison against the wrong string entirely. Three limits on the comparison, all hard. lookup-events reads management events for the last 90 DAYS only, so any reuse period your SSP states beyond 90 days cannot be evidenced from this call at all — a CloudTrail Lake event data store or an S3 trail with a longer retention is what closes that, and it is a different collection. The call is also Region-bound in a way that has nothing to do with GovCloud: IAM is a global service, its events are recorded in one Region, and lookup-events shows them in the Region where they occurred — so the same command run anywhere else returns an empty Events[] while succeeding, which is indistinguishable from a window in which nobody was deleted. And the comparison itself is a join between two commands' outputs, which the assertion grammar cannot express: it compares a field to a constant, never one response to another. Both of those are why the reuse limb is written into the notes as a manual reconciliation rather than dressed up as a clause below. The IAM users this recipe enumerates are also, on a well-run estate, the smallest part of the answer. Workforce identifiers should be issued in an external identity provider and reach AWS through IAM Identity Center, where the identifier's authority is the ExternalIds pair naming the issuer — which is what the third call reads. An account with an empty UserDetailList and a populated identity store is in better shape than the reverse, and an assertion that ranges over IAM users will say almost nothing about it. Read the two together or read neither. The identity-store calls are collected as EVIDENCE and deliberately carry no assertion. An earlier draft asserted that an Identity Center instance exists and that every identity-store user carries ExternalIds; both were withdrawn, because they fail an account that federates through an IAM SAML provider instead — which is a different architecture, not an IA-04 defect — and because the second is vacuous anyway on an instance with zero users, so the first does not guard it. An assertion that encodes an architectural preference as a control failure is worse than a paragraph saying which architecture this evidence reads best. Emptiness traps to state rather than assert. list-instances returns a list whose documented minimum length is zero and whose maximum is ten, so an account with no instance returns an empty Instances[] rather than an error, and reading only the first entry misses up to nine. A DeleteUser lookup over a window in which nobody was deleted returns an empty Events[], indistinguishable from a window in which the trail was not recording. And GroupDetail carries no Tags, so the authorization-tag clause below cannot be extended to group identifiers at all; device and service identifiers are outside every call here. Roles and groups are collected alongside users because their names are identifiers the control covers, and because the same reuse behaviour applies: RoleId and GroupId are never reused, while RoleName and GroupName are free the moment the resource is deleted. ## References - {"title":"IAM User Guide: IAM identifiers — friendly names must be unique within an account, unique ids are never reused even when a deleted friendly name is re-created, and the worked example of a deleted user's name being re-created and inheriting policy access","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html"} - {"title":"AWS CLI: iam list-users (Users[] always carries UserId, UserName, Arn, Path and CreateDate, and does NOT return Tags or PermissionsBoundary — use GetUser or GetAccountAuthorizationDetails for those)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html"} - {"title":"IAM API: RoleDetail — RoleId, RoleName, CreateDate and Tags as returned by GetAccountAuthorizationDetails","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleDetail.html"} - {"title":"AWS CLI: sso-admin list-instances (Instances[] minimum length 0; InstanceArn, IdentityStoreId, OwnerAccountId, PrimaryRegion, Status ACTIVE | CREATE_IN_PROGRESS | CREATE_FAILED | DELETE_IN_PROGRESS)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-instances.html"} - {"title":"AWS CLI: identitystore list-users (requires --identity-store-id; Users[] with required IdentityStoreId and UserId, optional UserName, ExternalIds issuer/id pairs, UserStatus ENABLED | DISABLED, CreatedAt/CreatedBy)","url":"https://docs.aws.amazon.com/cli/latest/reference/identitystore/list-users.html"} - {"title":"AWS CLI: iam get-account-authorization-details (--filter possible values User | Role | Group | LocalManagedPolicy | AWSManagedPolicy; the page describes the parameter as a comma-separated list while the CLI synopsis passes them space-separated, which is the form used here)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"} - {"title":"AWS CLI: cloudtrail lookup-events — \"You can look up events that occurred in a Region within the last 90 days\"; Username is \"a user name or role name of the requester that called the API in the event returned\"; management events by default","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} - {"title":"AWS GovCloud (US) User Guide: AWS CloudTrail — CloudFront, IAM and AWS STS events are recorded in us-gov-west-1, and Event history and lookup-events show these events in the Region where they occurred","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ct.html"} - {"title":"AWS GovCloud (US) User Guide: IAM Identity Center — \"Multi-Region support is presently not available\", FIPS endpoints for console/SDK/CLI, and the arn:aws-us-gov:sso:::instance/ pattern","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"} - {"title":"IAM API: GroupDetail — GroupId is \"the stable and unique string identifying the group\"; the type carries no Tags member","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GroupDetail.html"} --- ## https://ramprules.com/collect/personnel-separation-access-revocation # The state of every credential in the account as of a stated moment, the enabled-or-disabled status of every workforce identity in the identity store, and the CloudTrail record of the revocations themselves — the five API calls that actually revoke standing access, each with the time it happened and the administrator who did it > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/personnel-separation-access-revocation Recipe id: `personnel-separation-access-revocation` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - control `ps-4` ## Collection Kind: `cli` ```sh # generate-credential-report aws iam generate-credential-report # get-credential-report aws iam get-credential-report # list-users aws identitystore list-users --identity-store-id # lookup-events-delete-user aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteUser --start-time --end-time # lookup-events-delete-login-profile aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteLoginProfile --start-time --end-time # lookup-events-delete-access-key aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteAccessKey --start-time --end-time # lookup-events-update-access-key aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=UpdateAccessKey --start-time --end-time # lookup-events-deactivate-mfadevice aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeactivateMFADevice --start-time --end-time ``` ## Expected output From generate-credential-report, a State of STARTED, INPROGRESS or COMPLETE — AWS stores ONE report per account and regenerates it at most once every four hours, so a request made inside that window silently returns the existing report rather than a fresh one. From get-credential-report, Content (the report, base64-encoded CSV), ReportFormat, and GeneratedTime — the timestamp that says what moment the evidence describes, and the field the freshness assertion reads. The CSV columns are: user, arn, user_creation_time, password_enabled, password_last_used, password_last_changed, password_next_rotation, mfa_active, access_key_1_active, access_key_1_last_rotated, access_key_1_last_used_date, access_key_1_last_used_region, access_key_1_last_used_service, the same five for access_key_2, cert_1_active, cert_1_last_rotated, cert_2_active, cert_2_last_rotated, and additional_credentials_info. Note what the report does NOT cover, because it bounds the whole recipe: AWS documents it as including only passwords, THE FIRST TWO access keys per user, MFA devices and X.509 signing certificates — service-specific credentials such as CodeCommit passwords are absent, as is any access key beyond the second, and additional_credentials_info is the only hint that more exist. From identitystore list-users, Users[] with UserId, UserName, ExternalIds and UserStatus, which is ENABLED or DISABLED. There are five lookup calls rather than one because lookup-events accepts exactly ONE lookup attribute per request, and revocation is five different API calls: deleting the user, deleting the console login profile, deleting an access key, setting an access key Inactive, and deactivating the MFA device. From each lookup-events call, Events[] with EventName, EventTime, Username — the REQUESTER who performed the revocation, not the identity revoked — and the CloudTrailEvent JSON, where requestParameters names the user or device that was acted on. ## Assertions - {"field":"get-credential-report.GeneratedTime","op":"max_age_days","value":1,"controls":["ps-4"],"description":"The credential report being read describes a moment within the last day. AWS regenerates at most once every four hours and returns the stored report inside that window, so calling generate before get does NOT make the result fresh — GeneratedTime is the only field that says how old the evidence is. Substitute the interval your SSP commits to for revocation review."} ## GovCloud IAM, the credential report and CloudTrail all operate in both AWS GovCloud (US) Regions and every call here is available; ARNs use partition arn:aws-us-gov. IAM Identity Center is available in both Regions but has NO multi-Region support, so list-users must be run against the Region its instance was enabled in. The CloudTrail calls carry the one real trap: IAM is a global service and its events are recorded in AWS GovCloud (US-West), us-gov-west-1, while Event history and lookup-events show these events in the Region where they occurred — so a DeleteUser lookup issued against us-gov-east-1 returns an empty Events[] and exits zero, which reads exactly like a period in which nobody was separated. The same shape applies in the commercial partition, where those events land in us-east-1. ## Notes PS-04 is a list of things that happen when someone leaves: disable system access within a defined period, revoke the authenticators, conduct an exit interview, retrieve organizational property, retain access to the information the person worked on, and notify named personnel within a period. AWS holds evidence for the first two and nothing whatever for the other four. And it holds those two only as state and history, never as subject. The credential report says every credential in the account and what shape it is in; CloudTrail says which revocation happened, when, and by which administrator. Five lookups rather than two, because lookup-events takes one lookup attribute per call and revocation is not one API: an estate that follows this recipe's own advice and DISABLES rather than deletes never emits DeleteUser at all, so a collection that watched only for deletions would return an empty Events[] on a correctly executed separation. UpdateAccessKey is in the list for the same reason — setting a key Inactive is a revocation that deletes nothing. What no call knows is that a PERSON was terminated. There is no roster in AWS, no employment status, no separation date — so the join between 'this human left on the 4th' and 'this identity was revoked on the 6th' is made by a human against an HR record, and the period the control defines is checked on that join and not here. This recipe produces the AWS-side column. It is partial for that reason and no assertion below pretends otherwise. That is also why there is exactly one assertion. Any clause of the form 'no user has an active credential' is false on every working account and would be answering about the whole population when the control is about a named few; a clause over 'users your tagging marks as separated' would invent a third tagging convention to answer a question the HR record already answers better. So the single assertion is about the EVIDENCE rather than the estate: that the report describes a recent moment. A credential report is a snapshot with a timestamp, and a stale one is a true statement about a past that has already been superseded. Read the four-hour rule as a collection constraint, not a detail. AWS stores one credential report per account and regenerates it at most once every four hours; a generate call inside that window returns the report you already had. So generate-then-get does not guarantee freshness, GeneratedTime is what does, and a collector that runs the two calls back to back and assumes the second reflects the first is reporting on a state up to four hours old. The report's coverage is narrower than its name suggests, and the gap is exactly where a separation goes wrong. AWS documents it as covering passwords, the first two access keys per user, MFA devices and X.509 signing certificates. A third access key is not in it. Service-specific credentials are not in it. A separated user whose remaining access is a CodeCommit password or a long-term service credential appears in this report as fully revoked. additional_credentials_info is the only signal that anything else exists, and closing that gap needs ListAccessKeys and ListServiceSpecificCredentials per user, which this recipe does not collect and an assessment should. On a well-run estate the IAM half is the small half. Workforce identities live in the identity store and a separation there is UserStatus DISABLED rather than a deletion, which is why the third call is collected: an account whose credential report lists no IAM user for a departed employee, while the identity store still lists them as ENABLED, has not revoked anything — and the credential report, which sees only IAM, cannot show it. Disabling rather than deleting is also the better practice for this control, because it preserves the identifier — see the IA-04 recipe on why a freed name is a hazard. One KSI was deliberately not claimed. KSI-IAM-SUS asks that privileged accounts be disabled or secured IN RESPONSE TO SUSPICIOUS ACTIVITY, and a routine separation is not suspicious activity; the output is identical in both cases and cannot tell an assessor which one it is looking at. KSI-IAM-JIT was dropped for a quieter reason. Its statement asks for a least-privileged, role and attribute-based, and JUST-IN-TIME authorization model, persistently reviewed. Nothing in five commands over STANDING credentials evaluates a just-in-time or attribute-based model; only the 'persistently reviewed' tail is touched, and that tail is already what KSI-IAM-ELP carries here. KSI-IAM-ELP is earned outright: an identity that outlives its holder is precisely a failure of the rule that each user can access only what they need. ## References - {"title":"IAM User Guide: generate credential reports — the CSV columns, the four-hour regeneration rule, and the documented exclusion of service-specific credentials and any access key beyond the first two","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html"} - {"title":"IAM API: GetCredentialReport — returns Content (the base64-encoded CSV), ReportFormat and GeneratedTime, the timestamp the freshness assertion reads","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetCredentialReport.html"} - {"title":"AWS CLI: identitystore list-users (Users[] with UserId, UserName, ExternalIds and UserStatus ENABLED | DISABLED; requires --identity-store-id)","url":"https://docs.aws.amazon.com/cli/latest/reference/identitystore/list-users.html"} - {"title":"AWS CLI: cloudtrail lookup-events — events within the last 90 days; Username is the user or role name of the REQUESTER that called the API","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} - {"title":"AWS GovCloud (US) User Guide: AWS CloudTrail — CloudFront, IAM and AWS STS events are recorded in us-gov-west-1, and lookup-events shows them in the Region where they occurred","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ct.html"} - {"title":"AWS GovCloud (US) User Guide: IAM Identity Center — \"Multi-Region support is presently not available\"","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"} --- ## https://ramprules.com/collect/name-resolution-role-separation # The hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational status > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/name-resolution-role-separation Recipe id: `name-resolution-role-separation` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-SIN` - control `sc-22` ## Collection Kind: `cli` ```sh # list-hosted-zones aws route53 list-hosted-zones # list-resolver-endpoints aws route53resolver list-resolver-endpoints ``` ## Expected output From list-hosted-zones, HostedZones[] with Id, Name, CallerReference, ResourceRecordSetCount, an optional LinkedService naming the AWS service that created the zone, and Config carrying Comment and PrivateZone — a boolean, and the ONLY field that separates an internal zone from an external one. Read its absence as public: AWS documents PrivateZone true as private and false-or-absent as public, so a clause testing for equality with false misses the zones where Config never appears. From list-resolver-endpoints, ResolverEndpoints[] with Id, Arn, Name, CreatorRequestId, HostVPCId, SecurityGroupIds, IpAddressCount, a ResolverEndpointType of IPV4, IPV6 or DUALSTACK, a Direction of INBOUND, OUTBOUND or INBOUND_DELEGATION, and a Status of CREATING, OPERATIONAL, UPDATING, AUTO_RECOVERING, ACTION_NEEDED or DELETING. ## Assertions - {"field":"list-hosted-zones.HostedZones[?Config.PrivateZone==`true`] | [0].Id","op":"exists","controls":["sc-22"],"description":"At least one private hosted zone exists — internal name resolution is served by a zone of its own rather than by the public one. The pipe is load-bearing: without it the [0] indexes each matched zone rather than the filtered list."} - {"field":"list-hosted-zones.HostedZones[?Config.PrivateZone!=`true`] | [0].Id","op":"exists","controls":["sc-22"],"description":"At least one public hosted zone exists, so the separation asserted above is a separation of two live roles rather than an account that simply has no external presence. Written as != true rather than == false deliberately: AWS documents a public zone as PrivateZone false OR ABSENT, and an equality test against false misses every zone whose Config omits the field."} - {"field":"list-resolver-endpoints.ResolverEndpoints[?Status!='OPERATIONAL']","op":"count_eq","value":0,"controls":["sc-22"],"description":"No Resolver endpoint is stuck in CREATING, UPDATING, AUTO_RECOVERING, ACTION_NEEDED or DELETING. This is the health of YOUR crossing points and is not evidence of fault tolerance in the resolution service itself, which is AWS's to demonstrate. Zero on an account with no Resolver endpoints, which is a normal architecture rather than a pass."} ## GovCloud Route 53 is available in both AWS GovCloud (US) Regions with public and private DNS and health checking, and AWS states that public-zone DNS queries are answered from within the FedRAMP boundary — which is itself worth quoting in an assessment. The control plane for Route 53 in GovCloud is in AWS GovCloud (US-West), so these calls are issued there. Four documented differences bear on this recipe. Route 53 RESOLVER DELEGATION is not available for private hosted zones, so an architecture that separates roles by delegating a private subtree cannot be built there and the separation has to be zone-level. Alias targets may point at GovCloud Regions only, never at global AWS Regions. IP-based routing, the console DNS query checking tool and the TestDNSAnswer API are all unavailable, so there is no in-account way to verify what an external resolver actually receives. And the customer managed key for DNSSEC signing and the CloudWatch Logs group for query logging must both be in AWS GovCloud (US-West), where CloudWatch metrics such as DNSQueries can also be found. All Route 53 API actions there share a token bucket of capacity 40 refilling at 5 per second, which matters for a collector that walks many zones. ## Notes SC-22 asks two things of the systems that collectively provide name and address resolution: that they be FAULT-TOLERANT, and that they implement INTERNAL AND EXTERNAL ROLE SEPARATION. This output answers the second and cannot answer the first. Role separation is a field. Config.PrivateZone marks each hosted zone as serving internal or external resolution, and an architecture where internal names are served from private zones associated with VPCs while public names are served from public zones is exactly the separation the control describes — visible, enumerable, and reviewable on the cadence the indicator asks for. Resolver endpoints are collected beside the zones because they are where the two roles actually meet: an INBOUND endpoint lets on-premises resolvers query into the VPC, an OUTBOUND endpoint forwards VPC queries out, and each one is a crossing point that the zone list alone does not show. Fault tolerance is not a field and is not measurable from your account. Route 53's resilience is a property of AWS's anycast name server fleet, not of your configuration, and no call against your account returns it. It is inherited under the shared responsibility model and evidenced from AWS's own authorization package — say so in the assessment rather than presenting a zone list as though it spoke to availability. The one adjacent thing this output does show is whether YOUR crossing points are healthy, which is what the Status clause below asserts, and that is endpoint health rather than service fault tolerance. Conflating them would be the whole control's failure in one line. A scope edge that decides whether this evidence means anything: name resolution is only separated if the two zone sets actually differ. Two hosted zones for the same domain, one private and one public, is split-horizon DNS and is a legitimate and common pattern — but so is a single public zone answering internal names, which satisfies neither role separation nor the control, and the assertions below cannot tell those apart because the grammar compares a field to a constant rather than one zone's Name to another's. Reconcile the two zone sets by name as part of the review. A private hosted zone also cannot be DNSSEC-signed, which is why signing is a separate recipe and not folded in here. And LinkedService is worth reading before anything is concluded from a zone's presence: a zone created by another AWS service on your behalf is inventory rather than architecture. One KSI only. KSI-SVC-SIN — information secured from unwanted access — is what a private zone does, by keeping internal names off the public resolvers. The recipe does not claim the identity indicator that also reaches this control in the dataset: nothing in these two responses evaluates a permission. ## References - {"title":"AWS CLI: route53 list-hosted-zones (HostedZones[] with Config.PrivateZone as the private/public discriminator, plus Id, Name, CallerReference, ResourceRecordSetCount and LinkedService)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53/list-hosted-zones.html"} - {"title":"AWS CLI: route53resolver list-resolver-endpoints (Direction INBOUND | OUTBOUND | INBOUND_DELEGATION; Status CREATING | OPERATIONAL | UPDATING | AUTO_RECOVERING | ACTION_NEEDED | DELETING; ResolverEndpointType IPV4 | IPV6 | DUALSTACK)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53resolver/list-resolver-endpoints.html"} - {"title":"AWS GovCloud (US) User Guide: Amazon Route 53 — public-zone queries answered from within the FedRAMP boundary, control plane in GovCloud (US-West), Resolver delegation unavailable for private hosted zones, TestDNSAnswer and IP-based routing unavailable, DNSSEC signing key must be in US-West","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html"} --- ## https://ramprules.com/collect/security-advisories-receipt-and-dissemination # The advisories AWS itself has issued against this account — operational issues, scheduled changes and account notifications, each dated and scoped — together with the subscribers on the topic those alerts are published to and the confirmation state of each subscription, which is the difference between an address that was entered and an address that receives > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/security-advisories-receipt-and-dissemination Recipe id: `security-advisories-receipt-and-dissemination` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MON` - control `si-5` ## Collection Kind: `cli` ```sh # describe-events aws health describe-events --filter eventTypeCategories=issue,accountNotification,scheduledChange # list-subscriptions-by-topic aws sns list-subscriptions-by-topic --topic-arn # get-subscription-attributes aws sns get-subscription-attributes --subscription-arn ``` ## Expected output From describe-events, events[] with arn, service, eventTypeCode, an eventTypeCategory of issue, accountNotification, scheduledChange or investigation, region, availabilityZone, startTime, endTime, lastUpdatedTime, a statusCode of open, closed or upcoming, and an eventScopeCode of PUBLIC, ACCOUNT_SPECIFIC or NONE — the field that says whether an advisory is a general service event or one raised against this account in particular. The API is served from a global endpoint, global.health.amazonaws.com, which resolves by CNAME to whichever of the us-east-1 (active) and us-east-2 (passive) endpoints is current, and AWS notes that only the active endpoint carries the latest data. From list-subscriptions-by-topic, Subscriptions[] with SubscriptionArn, Owner, Protocol, Endpoint and TopicArn, up to 100 per call with a NextToken beyond that. Read SubscriptionArn carefully: for a subscription that has not been confirmed it is not an ARN at all but the LITERAL STRING PendingConfirmation, which AWS's own published response for an unconfirmed email subscriber shows. That is the discriminator, and it is on this list. From get-subscription-attributes, an Attributes MAP whose values are all strings — including PendingConfirmation, documented as "true if the subscription hasn't been confirmed", and ConfirmationWasAuthenticated, "true if the subscription confirmation request was authenticated" — which is why any clause on them would compare against the string "false" and not a boolean. This call is collected as supplementary evidence — ConfirmationWasAuthenticated is not derivable from the list — and carries no assertion, because it takes --subscription-arn and the unconfirmed case has no ARN to pass it. ## Assertions - {"field":"list-subscriptions-by-topic.Subscriptions | [0].SubscriptionArn","op":"exists","controls":["si-5"],"description":"The security alert topic has at least one subscriber. A topic with none is an alerting path that terminates in nothing. Says nothing about WHO the subscribers are — that is a comparison against the personnel your policy names, and no call returns that roster — and on its own it does not even prove deliverability, since an unconfirmed subscription satisfies it too. Read it with the clause below, never alone."} - {"field":"list-subscriptions-by-topic.Subscriptions[?SubscriptionArn=='PendingConfirmation']","op":"count_eq","value":0,"controls":["si-5"],"description":"No subscriber on the alert topic is still unconfirmed. AWS returns the literal string PendingConfirmation in the SubscriptionArn column for a subscription nobody has confirmed, so the failing case is a value in the list rather than an absence — which is why this clause reads the list and not the per-subscription attributes, whose call cannot even be made for an unconfirmed subscriber."} ## GovCloud Amazon SNS operates in both AWS GovCloud (US) Regions and topic and subscription ARNs use partition arn:aws-us-gov. The AWS Health call is the one to check before this recipe is planned rather than after, and its constraint is commercial as much as GovCloud: AWS states that a Business, Business+, Enterprise On-Ramp, Enterprise or Unified Operations plan is REQUIRED to use the AWS Health API, and that an account not enrolled in one receives a SubscriptionRequiredException. A provider on Basic or Developer support cannot run the first command at all, and for them the advisory-receipt half of this recipe is a Health Dashboard record — which every customer can see — rather than an API result. In GovCloud the endpoint is different in kind, not just in name: AWS documents the Health API there as a single regional endpoint in us-gov-west-1, as opposed to the commercial global endpoint with failover-capable Regions behind it, so the global.health.amazonaws.com DNS-lookup pattern does not apply and us-gov-west-1 is the target. Two further GovCloud behaviours worth writing into the assessment: some Health events are global rather than Regional — IAM's among them — and receiving those requires a rule in AWS GovCloud (US-West), the twin of the CloudTrail Region rule the PS-04 recipe names; and the EventBridge channel there does not deliver public Service Health View events at all, so an alerting pipeline built on EventBridge sees account-specific events only and the API or the RSS feed is what carries the rest. ## Notes SI-05 has four movements: receive security alerts, advisories and directives from external organizations on an ongoing basis; generate internal security alerts; disseminate them to the personnel your policy names; and implement directives or notify the issuing organization of the degree of nonconformance. This output touches the first and the third, and only for one external organization. That organization is AWS. Health events are the vendor's own notifications to this account — operational issues, scheduled changes, account notifications — dated, scoped by eventScopeCode to this account or to the service generally, and enumerable. That is a real answer to 'are you receiving advisories from your suppliers, on an ongoing basis, and can you show it'. The supply-chain indicator is claimed on one limb of its statement and not the whole: KSI-SCR-MON allows for mechanisms that 'may include contractual notification requirements', and a vendor health feed is exactly such a mechanism. It is NOT the other limb — none of Health's four event categories is a vulnerability category, and this evidence monitors AWS's service health rather than the provider's third-party software inventory. Read the claim as the notification limb only. What it is not is the control. CISA emergency directives, US-CERT advisories, vendor bulletins for every other component in the stack, and the entire question of implementing a directive or reporting nonconformance to the issuer are correspondence and decisions. No API returns them, and a collection that presents Health events as SI-05 evidence without saying which limb they serve has answered a quarter of a control. The dissemination half is where the honest telemetry is, and it is smaller than it looks. A topic with subscribers proves an alert has somewhere to go. It does not prove the subscribers are the personnel the policy names — that is a roster comparison — and it does not prove they receive anything unless the subscription is CONFIRMED. AWS requires confirmation for HTTP(S) endpoints, email addresses and cross-account resources. The unconfirmed case is visible, and it is visible in the place you would not look for it. An unconfirmed subscription appears in the topic's subscription list with SubscriptionArn set to the literal string PendingConfirmation instead of an ARN — not a missing field, not a flag, a sentinel value in the identifier column. So the completeness clause below is written against the LIST. An earlier draft asserted the PendingConfirmation attribute from get-subscription-attributes instead, which cannot work: that call takes --subscription-arn, the unconfirmed subscription has no ARN to pass, and the failing case therefore never reaches the assertion at all. The third call stays as supplementary evidence for ConfirmationWasAuthenticated, which the list genuinely does not carry, and it carries no clause. If a clause is ever written on those attributes, note that they come back as a map of STRINGS — PendingConfirmation is "true" or "false", not a boolean, and a comparison against a boolean matches nothing while returning green. One gap the assertions cannot see, named here because a partial rating owes it: nothing collected joins the Health feed to the topic. SECURITY_ALERT_TOPIC_ARN is supplied by the operator, and no output here shows an EventBridge rule on the aws.health source targeting it. The two halves of this recipe are adjacent in the assessment's head and unjoined in the data; collect the EventBridge rule and its targets if that join needs to be evidence rather than assertion. Two emptiness traps. describe-events as written sets no time bound — the filter selects categories, not a window — so what comes back is what AWS Health currently holds, and an empty events[] means the same thing on an account receiving advisories perfectly as on one whose Health access was never wired up. Add startTimes to the filter if the assessment needs the evidence pinned to a period. And the third call must be repeated per subscription: one confirmed subscription proves nothing about the other nine, and the assertion below is written against a single subscription ARN because that is what the API takes — walk the list from the second call and collect one response each, or the evidence covers one address. KSI-SVC-ACM was deliberately not claimed. It asks that configuration be managed by automation and reviewed for drift; an advisory feed and a subscriber list say nothing about configuration, and claiming it would put this recipe on an indicator page as evidence for a question it never asks. ## References - {"title":"AWS CLI: health describe-events (events[] with eventTypeCategory issue | accountNotification | scheduledChange | investigation, statusCode open | closed | upcoming, eventScopeCode PUBLIC | ACCOUNT_SPECIFIC | NONE)","url":"https://docs.aws.amazon.com/cli/latest/reference/health/describe-events.html"} - {"title":"AWS Health User Guide: using the AWS Health API — a Business+, Enterprise, Unified Operations, Business, Enterprise On-Ramp or Enterprise Support plan is required or the call returns SubscriptionRequiredException; global endpoint global.health.amazonaws.com with active us-east-1 and passive us-east-2","url":"https://docs.aws.amazon.com/health/latest/ug/health-api.html"} - {"title":"Amazon SNS API: ListSubscriptionsByTopic (up to 100 subscriptions per call with NextToken; throttled at 30 TPS)","url":"https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptionsByTopic.html"} - {"title":"AWS CLI: sns get-subscription-attributes — PendingConfirmation \"true if the subscription hasn't been confirmed\" and ConfirmationWasAuthenticated, returned in an Attributes map of strings","url":"https://docs.aws.amazon.com/cli/latest/reference/sns/get-subscription-attributes.html"} - {"title":"Amazon SNS Developer Guide: creating a subscription — \"HTTP(S) endpoints, email addresses, and AWS resources in other AWS accounts require confirmation of the subscription before they can receive messages\"","url":"https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html"} - {"title":"AWS SDK code library: ListSubscriptions — the published response for an unconfirmed email subscriber carries SubscriptionArn: 'PendingConfirmation' rather than an ARN","url":"https://docs.aws.amazon.com/code-library/latest/ug/sns_example_sns_ListSubscriptions_section.html"} - {"title":"AWS GovCloud (US) User Guide: AWS Health — the API is a single regional endpoint in us-gov-west-1 rather than a global endpoint; Business or Enterprise support required; global events including IAM need a rule in GovCloud (US-West); the EventBridge channel does not send public Service Health View events","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-health.html"} --- ## https://ramprules.com/collect/personnel-transfer-access-reassignment # What a transferred individual can still reach, and what they have actually used: the reassignment events themselves from CloudTrail (group membership, attached policy, and Identity Center account-assignment changes, each with its time and the administrator who made it), the current Identity Center assignments per permission set, and IAM's service-last-accessed report for the identities involved — a per-principal view of which services the identity is permitted to reach and which of those it has never authenticated to. `iam-access-analyzer-unused-access` answers the same question estate-wide from findings; this answers it for the named principal a transfer is about. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/personnel-transfer-access-reassignment Recipe id: `personnel-transfer-access-reassignment` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-IAM-ELP` - control `ps-5` ## Collection Kind: `cli` ```sh # lookup-events-add-user-to-group aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AddUserToGroup --start-time --end-time # lookup-events-remove-user-from-group aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RemoveUserFromGroup --start-time --end-time # lookup-events-attach-user-policy aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=AttachUserPolicy --start-time --end-time # lookup-events-detach-user-policy aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DetachUserPolicy --start-time --end-time # lookup-events-create-account-assignment aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccountAssignment --start-time --end-time # lookup-events-delete-account-assignment aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteAccountAssignment --start-time --end-time # list-permission-sets aws sso-admin list-permission-sets --instance-arn # list-account-assignments aws sso-admin list-account-assignments --instance-arn --account-id --permission-set-arn # generate-service-last-accessed-details aws iam generate-service-last-accessed-details --arn --granularity ACTION_LEVEL # get-service-last-accessed-details aws iam get-service-last-accessed-details --job-id ``` ## Expected output From each lookup-events call, Events[] with EventName, EventTime, Username — the REQUESTER who made the change, never the identity changed — and CloudTrailEvent, whose requestParameters names the user, group, policy or account assignment acted on. Six calls rather than one because lookup-events accepts exactly ONE lookup attribute per request and a reassignment is six different APIs across two services; the window is bounded at 90 days by the API. From list-permission-sets, PermissionSets[] of ARNs. From list-account-assignments, AccountAssignments[] with AccountId, PermissionSetArn, PrincipalId and PrincipalType (USER or GROUP) — for ONE permission set in ONE account, which is why list-permission-sets precedes it: the assignment set of an account is the union over its permission sets and no single call returns it. From generate-service-last-accessed-details, a JobId (36 characters); from get-service-last-accessed-details, JobStatus (IN_PROGRESS | COMPLETED | FAILED) and ServicesLastAccessed[] with ServiceName, ServiceNamespace, LastAuthenticated, LastAuthenticatedEntity and TotalAuthenticatedEntities, plus TrackedActionsLastAccessed[] when the request asked for ACTION_LEVEL. A service the principal is permitted to call and has never called comes back with the entry PRESENT and LastAuthenticated ABSENT, which is the shape that makes unused-but-granted access visible at all. ## Assertions - {"field":"get-service-last-accessed-details.ServicesLastAccessed[?!not_null(LastAuthenticated)]","op":"count_eq","value":0,"controls":["ps-5"],"description":"After the reassignment review, the transferred principal holds no permission it has never used. The offender form — the services with no LastAuthenticated at all — because a service the principal has never called is listed WITHOUT the most-recent-attempt details rather than with a null timestamp, so a projection over LastAuthenticated drops exactly the rows this clause exists to find. Read a non-zero count as the review's work list, not as a failure: the control is satisfied by acting on it within the period the SSP defines, and whether the individual still needs each one is the HR judgement no command makes."} - {"field":"get-service-last-accessed-details.JobStatus","op":"eq","value":"COMPLETED","controls":["ps-5"],"description":"The last-accessed report actually finished. The generate call returns a JobId immediately and the get call answers IN_PROGRESS until the report exists — a collector that reads ServicesLastAccessed[] from an unfinished job reads an empty array, which would make the clause above vacuously true at the exact moment it has learned nothing."} ## GovCloud IAM, CloudTrail and IAM Identity Center all operate in both AWS GovCloud (US) Regions; ARNs use partition arn:aws-us-gov, and the sso-admin ARN patterns accept it. Two partition traps, both real here. IAM is global and its events are recorded in AWS GovCloud (US-West), us-gov-west-1, while lookup-events shows events in the Region where they occurred — so the four IAM lookups issued against us-gov-east-1 return an empty Events[] and exit zero, which reads exactly like a period in which nobody transferred. The equivalent commercial Region is us-east-1. Second, IAM Identity Center has no multi-Region support in GovCloud, so the sso-admin calls must be issued against the Region its instance was enabled in. What AWS documents is the absence of multi-Region support; what a call issued against the other Region actually does is not documented on that page and this recipe does not guess. Establish which Region holds the instance before collecting, rather than inferring it from a response. ## Notes PS-05 is about a person moving inside the organization: the access that fitted the old role is reviewed, what is no longer needed is removed, and the transfer is completed within a period the provider defines. AWS holds two-thirds of that and cannot hold the rest. What it holds is the CHANGE and the STATE. CloudTrail records the six APIs a reassignment actually travels through — two for group membership, two for attached user policies, two for Identity Center account assignments — each with a timestamp and the administrator who made it. Identity Center holds the assignments as they stand today. What no call knows is that a person MOVED. There is no roster in AWS, no job title, no transfer date, so the join between 'this human changed teams on the 4th' and 'this principal lost the finance permission set on the 9th' is made by a human against an HR record, and the period the control defines is checked on that join. This recipe produces the AWS-side column and the rating says so. The third call set is the one that earns its place. A separation is visible as an absence; a transfer is visible as a RESIDUE — the old permission that nobody removed because nothing failed when it stayed. Service-last-accessed is the signal that names it per principal: for a principal it lists every service the identity could reach under its permissions policies, with the last time it authenticated, and an entry with no LastAuthenticated is a permission granted and never exercised. Run against the transferred principal it turns 'review the access that no longer fits' from an interview into a list. It is not the only route to that question — `iam-access-analyzer-unused-access` answers it estate-wide from findings — but it is the one that answers it about a NAMED identity, which is the unit a transfer is measured in. Read its four documented limits before quoting it. It reports for at least the last 400 days, and less in a Region that began supporting the feature within the last year — so a young Region reports a shorter history than the reviewer assumes. Recent activity usually appears within four hours, so a report pulled immediately after a transfer describes the state before it. It records ATTEMPTS and not successes: a denied call still marks a service as accessed, and AWS names CloudTrail as the authoritative source for whether a call succeeded. And it applies permissions-policy logic ONLY — resource-based policies, ACLs, Organizations policies, permissions boundaries and STS assume-role trust are all excluded, so an identity that reaches a bucket purely through a bucket policy is invisible to it. That last one bounds the whole claim: 'no unused permissions' from this report is a statement about identity policies, not about reach. list-account-assignments takes an account id AND a permission set ARN, and returns the assignees of that one pair. There is no call that returns an account's assignments whole, which is why list-permission-sets runs first and the collection is a loop. A single unlooped call would be a slice of one permission set presented as an account's access, and an assertion over it would be green on an estate where every other permission set is wrong. The authentication indicators are untouched here — nothing collected reads a factor. KSI-IAM-ELP is earned outright: a permission that fits a role the holder has left is exactly the failure of 'each user can access only what they need'. KSI-IAM-JIT is deliberately NOT claimed, on this overlay's own precedent: the PS-04 recipe dropped it because nothing evaluated over STANDING credentials examines a just-in-time or attribute-based model, and only the 'persistently reviewed' tail is touched — a tail KSI-IAM-ELP already carries. Everything collected here is standing too: standing credentials, standing group membership, standing account assignments. The just-in-time half is the Identity Center elevation recipe's to answer, and claiming it here would have had two sibling recipes taking opposite positions on one indicator over one class of telemetry. ## References - {"title":"AWS CLI: cloudtrail lookup-events — one lookup attribute per request, events within the last 90 days, Username is the REQUESTER that called the API","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"} - {"title":"IAM API: GenerateServiceLastAccessedDetails — Granularity SERVICE_LEVEL | ACTION_LEVEL, at least 400 days of history, activity appears within about four hours, records ATTEMPTS including denied ones, and applies permissions-policy logic only (resource-based policies, ACLs, Organizations policies, permissions boundaries and assume-role trust excluded)","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateServiceLastAccessedDetails.html"} - {"title":"IAM API: GetServiceLastAccessedDetails — JobStatus is IN_PROGRESS | COMPLETED | FAILED, and a service with no access attempt is listed WITHOUT details about the most recent attempt (the shape both assertions read)","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLastAccessedDetails.html"} - {"title":"IAM Identity Center API: ListAccountAssignments — requires both AccountId and PermissionSetArn, returns AccountAssignments[] with PrincipalType and PrincipalId for that one pair","url":"https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html"} - {"title":"AWS GovCloud (US) User Guide: AWS CloudTrail — IAM and AWS STS events are recorded in us-gov-west-1 and lookup-events shows them in the Region where they occurred","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ct.html"} - {"title":"AWS GovCloud (US) User Guide: IAM Identity Center — multi-Region support is not available, so the instance answers only in the Region it was enabled in","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"} --- ## https://ramprules.com/collect/acquisition-scanning-and-sbom-inventory # Whether the tooling that examines acquired software is switched on and covering the estate, and what it found: Inspector's per-account enablement state for each scanned resource type, the registry-wide ECR scanning configuration (scan type and frequency, and the repository filters that decide which repositories it applies to), Inspector's own coverage statistics, and a CycloneDX 1.4 or SPDX 2.3 SBOM exported per monitored resource — the component-level inventory of what was actually acquired. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/acquisition-scanning-and-sbom-inventory Recipe id: `acquisition-scanning-and-sbom-inventory` · cadence continuous · partial > **Authored opinion.** AWS overlay v3.0.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MIT` - KSI `KSI-SCR-MON` - control `sr-5` ## Collection Kind: `cli` ```sh # batch-get-account-status aws inspector2 batch-get-account-status # get-registry-scanning-configuration aws ecr get-registry-scanning-configuration # list-coverage-statistics aws inspector2 list-coverage-statistics --group-by SCAN_STATUS_REASON # create-sbom-export aws inspector2 create-sbom-export --report-format CYCLONEDX_1_4 --s3-destination bucketName=,keyPrefix=,kmsKeyArn= # get-sbom-export aws inspector2 get-sbom-export --report-id ``` ## Expected output From batch-get-account-status, accounts[] with accountId, state.status, and resourceState broken out per scanned resource type — ec2, ecr, lambda, lambdaCode and codeRepository — each with its own status and an errorCode when the service could not enable it. From get-registry-scanning-configuration, registryId and scanningConfiguration with scanType (BASIC or ENHANCED) and rules[], each rule carrying scanFrequency (SCAN_ON_PUSH, CONTINUOUS_SCAN or MANUAL) and repositoryFilters[] of {filter, filterType}; ENHANCED supports CONTINUOUS_SCAN and SCAN_ON_PUSH, BASIC supports SCAN_ON_PUSH only, and where scan-on-push is not specified the frequency defaults to MANUAL. From list-coverage-statistics, countsByGroup[] and totalCounts — the number of resources Inspector is actually covering, which is the number that decides whether an empty findings list means clean or means unscanned. From create-sbom-export, a reportId; from get-sbom-export, status (IN_PROGRESS | SUCCEEDED | FAILED | CANCELLED) with the s3Destination the JSON documents were written to. Each exported document is one resource's component inventory: CycloneDX 1.4 with components[] carrying purl and bom-ref, or SPDX 2.3 with packages[] carrying versionInfo and externalRefs. Unresolved hashes — components whose package manager used a version range or dynamic reference and which therefore cannot be scanned for vulnerabilities — are INCLUDED in the export as hashes, and are the part of the inventory a vulnerability count silently omits. ## Assertions - {"field":"batch-get-account-status.accounts[?resourceState.ecr.status!='ENABLED']","op":"count_eq","value":0,"controls":["sr-5"],"description":"Every account the call REPORTED ON has ECR scanning ENABLED. `resourceState.ecr` and its `status` are both required fields, so a never-enabled account answers DISABLED rather than omitting the key — the offender form is used here not to catch a missing key but because it names the failing rows directly, which is the shape that survives an estate this clause is later widened over. It is only half the check; the clause below is the other half."} - {"field":"batch-get-account-status.failedAccounts","op":"count_eq","value":0,"controls":["sr-5"],"description":"No account failed to enable Inspector at all. This is the sibling array, and without it the clause above is the ListResolverDnssecConfigs trap in a new costume: an account that could not be enabled — ACCESS_DENIED, BLOCKED_BY_ORGANIZATION_POLICY — is reported in failedAccounts[] and is ABSENT from accounts[], so a clause reading only accounts[] is green on precisely the account whose scanning never started."} - {"field":"get-sbom-export.status","op":"eq","value":"SUCCEEDED","controls":["sr-5"],"description":"The SBOM export finished and wrote its documents. Poll until the status is terminal — SUCCEEDED, FAILED or CANCELLED — and assert on that. IN_PROGRESS is not a pass: it is exactly the state in which a report id exists and no inventory has been written, which is the condition this clause exists to catch, so accepting it would be a check that cannot fail."} ## GovCloud Both services are available in AWS GovCloud (US-West) and AWS GovCloud (US-East). Two documented differences bear on this recipe and one bears on the control it proves. Inspector: Lambda CODE scanning is not available in the partition, so resourceState.lambdaCode reports its absence rather than a misconfiguration, and the Linux deep-inspection plugin is documented as not FIPS compliant — which matters to a provider whose SSP claims FIPS-validated modules end to end. ECR: pull-through cache rules work only WITHIN the same partition, ECR public registries are not available, and the ECR Public Gallery is not hosted in GovCloud though it may be reachable if the estate has external internet access. Those three are acquisition facts, not availability trivia: they change where a GovCloud estate's images can legitimately come from, which is the strategy half of SR-05. S3 and KMS ARNs in the export destination use partition arn:aws-us-gov. ## Notes SR-05 asks for acquisition strategies, contract tools and procurement methods that reduce supply-chain risk. Two halves, and AWS holds one of them completely and the other not at all. The half it holds is the TOOLING at the moment of acquisition. ECR's registry scanning configuration is the acquisition gate: scan-on-push examines an image as it enters the registry, and the rules[] with their repository filters say which repositories that applies to. Inspector monitors what has already landed and exports an SBOM per resource, which is the component-level inventory of what was actually acquired rather than what a supplier said they shipped. Both are continuous, both are machine-readable, and together they answer 'what did we take in, and what was wrong with it'. The half it does not hold is the STRATEGY the control names — the contract clauses, the approved-supplier list, the delivery method, the decision to buy this component rather than that one. No scanner stands in for procurement, and none of these five commands reads a contract. That is the whole reason for the partial rating, and the assessment reads it out of the acquisition documentation the control asks for. The enablement and coverage calls exist because of the empty-list trap, and here it is unusually sharp. A findings query against an estate with Inspector switched off returns an empty array and exits zero, and so does a clean estate. batch-get-account-status is what separates them: it reports status per resource type, so ECR ENABLED with EC2 DISABLED is visible as the partial coverage it is rather than as silence. Read BOTH of its arrays. An account that could not be enabled — access denied, or blocked by an Organizations policy — is reported in failedAccounts[] and does not appear in accounts[] at all, so a clause over accounts[] alone is green on the one account whose scanning never began. The enumeration has an edge worth stating too: accounts[] is capped at one hundred entries with no continuation token, and what the call returns when no account ids are passed is undocumented — so run it as the delegated administrator with the ids you mean, and treat the response as evidence about the accounts it names rather than about the organization. list-coverage-statistics closes the second half of the same gap — Inspector can be enabled and still not be covering a resource, and a count of covered resources is the denominator every finding count needs. Neither is decoration; without them the SBOM evidence is a claim about an unknown population. The registry configuration has its own version of the trap, and it is the reason no assertion here asserts on rules[] alone. Scan frequency defaults to MANUAL where scan-on-push was not configured, and a registry with NO rules is a registry that scans nothing on push — but it answers with a well-formed scanningConfiguration all the same, so a clause reading 'every rule has SCAN_ON_PUSH or CONTINUOUS_SCAN' is vacuously true on exactly the estate that has configured nothing. The offender form is the population of repositories no rule's filter matches, and that needs a join against describe-repositories this assertion grammar cannot express — which is why this is partial and not full even though the enablement half could be written down. On the SBOM export: it needs an S3 bucket whose policy allows Inspector to write and a KMS key whose policy allows Inspector to encrypt, both configured before the call, and it is asynchronous — create returns a reportId and get reports status. Read the unresolved-hash note in the output as evidence rather than noise. A component whose package manager used a version range cannot be mapped to a name and version, and therefore cannot be scanned for vulnerabilities at all; Inspector now includes those hashes in the export. They are the components a vulnerability count does not cover, and an SBOM read without them looks cleaner than the estate is. KSI-SCR-MON is earned directly: third-party software resources ARE automatically monitored for upstream vulnerabilities, and these commands prove the mechanism is on and covering. KSI-SCR-MIT is claimed for identify-and-review and not for mitigate — nothing here shows a risk being closed, only found. ## References - {"title":"Amazon Inspector User Guide: Exporting SBOMs — CycloneDX 1.4 and SPDX 2.3, the create-sbom-export CLI form with its S3 and KMS prerequisites, and the inclusion of unresolved hashes for components that cannot be mapped to a name and version","url":"https://docs.aws.amazon.com/inspector/latest/user/sbom-export.html"} - {"title":"Amazon ECR API: GetRegistryScanningConfiguration — returns registryId and scanningConfiguration with scanType and rules[] of {repositoryFilters, scanFrequency}","url":"https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRegistryScanningConfiguration.html"} - {"title":"Amazon ECR API: RegistryScanningRule — scanFrequency is SCAN_ON_PUSH | CONTINUOUS_SCAN | MANUAL; ENHANCED supports the first two, BASIC supports SCAN_ON_PUSH, and MANUAL is the default where scan-on-push is not specified","url":"https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_RegistryScanningRule.html"} - {"title":"Amazon Inspector API: BatchGetAccountStatus — accounts[] with state.status and resourceState per ec2, ecr, lambda, lambdaCode and codeRepository, and failedAccounts[] as a SIBLING array carrying its own resourceStatus and the errorCodes for accounts that could not be enabled","url":"https://docs.aws.amazon.com/inspector/v2/APIReference/API_BatchGetAccountStatus.html"} - {"title":"Amazon Inspector API: ResourceState — `ecr` is a required member and its `status` is required, so a never-enabled account reports DISABLED rather than omitting the key","url":"https://docs.aws.amazon.com/inspector/v2/APIReference/API_ResourceState.html"} - {"title":"AWS CLI: inspector2 get-sbom-export — status is SUCCEEDED | IN_PROGRESS | CANCELLED | FAILED; IN_PROGRESS is the state in which a report id exists and no document has been written","url":"https://docs.aws.amazon.com/cli/latest/reference/inspector2/get-sbom-export.html"} - {"title":"AWS GovCloud (US) User Guide: Amazon Inspector — available in both GovCloud Regions; Lambda code scanning is not available and the Linux deep-inspection plugin is not FIPS compliant","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-inspector2.html"} - {"title":"AWS GovCloud (US) User Guide: Amazon ECR — pull through cache rules are available only within the same partition, public registries are not available, and the ECR Public Gallery is not hosted in the partition","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ecr.html"} --- ## https://ramprules.com/collect/dependency-vulnerability-monitoring # Whether Dependabot alerting is configured in this organization and which repositories it actually reaches, together with the alerts themselves — each carrying the advisory that raised it, the package, ecosystem and manifest path it was found in, the reason a human gave for closing it, and, for a remediated one, the date it was fixed. The first half is the population; the second half is what was found in it, and the second half means nothing without the first. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/dependency-vulnerability-monitoring Recipe id: `dependency-vulnerability-monitoring` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MON` - KSI `KSI-SCR-MIT` - control `sr-6` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?per_page=100" # alerts-open gh api --paginate "/orgs//dependabot/alerts?state=open&per_page=100" # alerts-dismissed gh api --paginate "/orgs//dependabot/alerts?state=dismissed&per_page=100" # alerts-auto-dismissed gh api --paginate "/orgs//dependabot/alerts?state=auto_dismissed&per_page=100" # alerts-fixed gh api --paginate "/orgs//dependabot/alerts?state=fixed&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first command, `configuration-repositories` the second, `alerts-open` the third, `alerts-dismissed` the fourth, `alerts-auto-dismissed` the fifth, `alerts-fixed` the sixth. RUN THE SECOND COMMAND ONCE PER CONFIGURATION returned by the first, not once for the organization. The first command returns every configuration and the second takes a single ``; collecting one response and reading it as the organization's is the arithmetic error this recipe is most likely to be assessed with, and the clause on `configuration-repositories` speaks only for the configurations actually walked. From the configurations call, an array of code security configurations, each with an id, a name, a `target_type` of `global`, `organization` or `enterprise`, and the feature fields as THREE-STATE strings rather than booleans — `dependabot_alerts`, `dependabot_security_updates`, `dependency_graph`, `secret_scanning`, `secret_scanning_push_protection`, `code_scanning_default_setup` and `private_vulnerability_reporting` each taking `enabled`, `disabled` or `not_set` — plus an `enforcement` of `enforced` or `unenforced`. `not_set` is the value to read carefully: it is neither on nor off, it is the absence of a decision, and a clause comparing against `disabled` alone does not see it. From the configuration-repositories call, rows carrying a `status` of `attached`, `attaching`, `detached`, `removed`, `enforced`, `failed`, `updating` or `removed_by_enterprise` and the repository object each refers to; the call passes no status filter, so a failing row is present-and-false rather than absent. From the alerts calls, alerts with `number`, a `state` of `open`, `dismissed`, `fixed` or `auto_dismissed`, a `severity` of `low`, `medium`, `high` or `critical`, a `dependency` object naming `package.ecosystem`, `package.name`, `manifest_path`, a `scope` of `development` or `runtime` and a `relationship` of `direct`, `transitive`, `inconclusive` or `unknown`, a `security_advisory` object carrying `ghsa_id`, a nullable `cve_id`, `cvss_severities` with `cvss_v3` and `cvss_v4` scores, `cwes`, a `classification` of `general` or `malware` and `epss` percentage and percentile, a `security_vulnerability` with the affected version range, `created_at`, `updated_at`, `dismissed_at`, `fixed_at` and `auto_dismissed_at` timestamps, a `dismissed_reason` from the enum `fix_started`, `inaccurate`, `no_bandwidth`, `not_used` and `tolerable_risk`, and the `repository` the alert belongs to. Note the calls that look like one: `dismissed`, `auto_dismissed` and `fixed` are SEPARATE values of `state`, so a query for any one returns none of the others. The organization endpoint requires an organization owner or a security manager, and a token carrying the `security_events` scope. ## Assertions - {"field":"configurations[?target_type=='organization' && dependabot_alerts=='enabled'] | [0].id","op":"exists","controls":["sr-6"],"description":"At least one code security configuration the organization itself owns sets `dependabot_alerts` to `enabled`. The field is three-state and the middle value is the trap: `not_set` is neither on nor off, and a clause written against `disabled` passes an organization that never decided. `target_type` is narrowed to `organization` because the enum admits a `global` scope no administrator creates. This says a configuration exists and decided; it does not say which repositories it reaches, and it does NOT say nothing is scanned when it fails — repository-level enablement bypasses configurations entirely. Read it with the clause below and with the reconciliation `scan_scope` names."} - {"field":"configuration-repositories[?status=='failed']","op":"count_eq","value":0,"controls":["sr-6"],"description":"No repository the configuration was applied to failed to receive it. `failed` is the status that produces silence rather than an error: the repository is attached in intent, collects nothing, and contributes no row to any alert query — so an alert list over the organization is partly clean BECAUSE of it. The call passes no status filter, so the failing row is present-and-false rather than absent, which is why the offender form works here. It speaks only for the configurations actually walked; see the iteration note in `expected_output`."} - {"field":"configurations[?target_type=='organization' && dependabot_alerts!='enabled']","op":"count_eq","value":0,"controls":["sr-6"],"description":"No configuration the organization owns leaves Dependabot alerting unenabled. `!=` rather than `== 'disabled'` on purpose: the field is three-state, and `not_set` — a configuration that decided nothing — is the value a comparison against `disabled` walks straight past. The failing row is present-and-false in the same response the clause above reads, which is what makes this the offender form and not a projection over the rows that already pass. A deliberate exception, such as a configuration governing archived or public repositories, fails this clause correctly: it is a finding that wants a written justification, not a defect in the check."} ## Outside the boundary Platform: GitHub Enterprise Cloud Collecting this evidence puts the code-hosting and scanning platform inside the assessment rather than beside it. The repositories, the dependency graph and the alert store are held and operated by a third party, so the platform is itself an information resource whose potential impact has to be addressed under SA-09 and CA-03 and accounted for in the external-system inventory AC-20 already covers — the plane that answers a supply-chain control raises supply-chain controls. Ask the cited Marketplace listing one question in particular before relying on this recipe: SR-06 is a class c and class d control, so every reader of it is running a Moderate or High system, and the impact level a platform's listing carries is not necessarily the one those systems need. That is the SA-09 question here, it is answered by reading the listing rather than by this sentence, and no value for it is written down because it is a dated fact that changes. Which offering is in use decides the rest: GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency and github.com are different deployments on different infrastructure, and this recipe was authored against the first. ## Notes SR-06 asks the provider to ASSESS AND REVIEW the supply chain risk associated with suppliers and contractors. This output assesses one population — the third-party software components resolved into the build — continuously, and it produces a reviewable record for each finding. That is a real answer to one limb and it is not the control. Provenance, contract terms, geographic and financial exposure, and the frequency at which a supplier is re-reviewed are a human record, and a manifest entry names a package, not a supplier's risk posture. The disposition this recipe spends said exactly that, and the rating is unchanged by having written the commands down. What the population is, and what it is not. GitHub documents that when Dependabot alerts are enabled it "immediately generates the dependency graph and creates alerts for any vulnerable dependencies it identifies", so the graph is not a separate switch a clause below needs to police — which is why the first assertion reads `dependabot_alerts` and not both fields. What the same page says under its own heading of limitations, and what bounds this recipe more than anything else in it, is that "only advisories reviewed by GitHub trigger alerts". The detection surface is the GitHub Advisory Database's reviewed set. A vulnerability that is real, published, and not in that set produces no alert, and an empty list is silent about it. A second, sharper limit sits inside the first: alerting on MALICIOUS packages, as opposed to vulnerable ones, is a separate opt-in that has to be enabled after Dependabot alerts are, and no command in this recipe can see whether it is on — the code security configuration response carries no property for it. So an alert list with no malware finding in it is equally an organization with no malicious dependency and an organization that never switched the detection on, and a clause asserting the absence of malware would be vacuous for exactly that reason. Both limits are ceilings on the evidence rather than defects in the collection, and they belong in the assessment rather than in a footnote. A code security configuration is not the only way Dependabot gets switched on, and the first clause below is wrong in one direction because of it. Alerts can be enabled on a repository directly, in that repository's own settings, with no configuration involved. An organization that never adopted configurations therefore returns an empty list from the first command and FAILS the clause while scanning every repository it owns. Read a failure there as "no organization-level configuration governs this", which is a real and useful finding, and NOT as "nothing is scanned" — the second reading is unsupported and the reconciliation named in `scan_scope` is what distinguishes them. The multi-configuration case, named because the first assertion is weaker than it reads in the other direction too. The clause is satisfied by ANY qualifying configuration, including one applied to no repository at all. The `target_type` narrowing on both configuration clauses is a deliberate trade and it costs something. The enum admits `global` and `enterprise` alongside `organization`, and GitHub ships a recommended configuration that an administrator does not create but DOES apply from the organization's own configurations table — applying it is a decision, and a decision this clause will not count. So the narrowing buys a false FAIL on GitHub's recommended path and on an enterprise-applied one, in exchange for not passing on a row the organization never chose. That is the right way round only because of how a failure is to be read, below: not as "nothing is scanned" but as "no configuration this organization owns governs this", which is literally true in the global and enterprise cases too. What documentation does NOT settle is whether the org endpoint returns those rows at all — its description says configurations "available in" an organization rather than owned by one — and the live risk is not that the narrowing is unnecessary but that the rows it excludes are the organization's real answer. One call against a live organization settles it, and an assessment leaning on either configuration clause should make that call first. Why there is no clause on `dismissed_reason`. An earlier draft asserted that no dismissed alert had a null reason, and it was decorative: GitHub requires a `dismissed_reason` when an alert's state is set to `dismissed`, so on a `state=dismissed` list there is no documented path that yields null and the clause could not fail. It is recorded here so it is not re-added. The review limb of the claim rests on the fourth command's output being collected and read, not on a check that cannot go red. `state=dismissed`, `state=auto_dismissed` and `state=fixed` are three separate queries, and the last two carry no assertion deliberately. The auto-dismissed list exists because an organization whose alerts close mostly by rule has a short `dismissed` list, and any review clause would be near-vacuously true while very little was reviewed by anyone; an auto-dismissal is a rule firing, not a person deciding, and a clause about its count would assert that a policy is correct rather than that a review happened. The fixed list exists because it is the mitigation record, and it is the reason KSI-SCR-MIT can be claimed at all — but a count of remediated alerts is a measure of how much was broken, not of how well it was handled, and no threshold over it would mean anything without the response clock the plan surfaces separately. It carries the emptiness problem the open list carries, and it carries it while bearing the whole weight of the mitigation claim: an empty fixed list is equally an organization that has never had a vulnerable dependency, one that has never remediated one, and one whose scanning was switched on last week. Nothing in this recipe distinguishes those, which is why the claim on that indicator is a collected record for a human to read and not a check that can go red. MAS-CSO-TPR was deliberately not claimed, and the reasoning is recorded so the next batch does not re-derive it. Its artifact is a machine-readable output of the third-party information resources of the offering, and a dependency IS a third-party information resource on the dataset's own definition — an information resource not entirely inside the Minimum Assessment Scope, where information resources expressly include software and code. But the requirement's statement names the data that output must carry: general usage and configuration, an explanation or justification for use, mitigation measures, and compensating controls. An alert stream carries none of the four, and the enumeration it implies is a by-product rather than the artifact. A recipe that exported the dependency graph SBOM would have a genuine partial claim on that requirement; this one does not, and adjacency is not a join. KSI-SCR-MIT is claimed on the software-component limb only. Identify is the alert, review is `dismissed_reason`, mitigate is the transition to `fixed` — those three are the indicator's three verbs, over one supplier population, and all three are now collected rather than two of them being collected and the third described. Hardware, managed services, and every supplier relationship that never resolves into a manifest are outside it, and an indicator page carrying this recipe should be read as carrying evidence for a part. The evidence platform is itself an external system; see `external_system`. It is not a footnote on this control in particular — SR-06 is a supply chain control, and answering it by adopting a supplier is a move that has to be visible in the assessment rather than only in the recipe. ## References - {"title":"GitHub REST: Dependabot alerts — GET /orgs/{org}/dependabot/alerts; state open | dismissed | fixed | auto_dismissed, severity, dependency.package.ecosystem/name, manifest_path, scope, relationship, security_advisory ghsa_id/cve_id/cvss_severities/cwes/classification general | malware/epss, dismissed_reason enum and the PATCH rule that a reason must be provided when dismissing; organization owner or security manager, security_events scope","url":"https://docs.github.com/en/rest/dependabot/alerts"} - {"title":"GitHub REST: code security configurations — GET /orgs/{org}/code-security/configurations and .../{configuration_id}/repositories; target_type global | organization | enterprise, dependabot_alerts, dependency_graph, secret_scanning and code_scanning_default_setup each enabled | disabled | not_set, enforcement enforced | unenforced, repository association status attached | attaching | detached | removed | enforced | failed | updating | removed_by_enterprise","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: about Dependabot alerts — \"When enabled, GitHub immediately generates the dependency graph and creates alerts for any vulnerable dependencies it identifies\", and under its own limitations heading \"Only advisories reviewed by GitHub trigger alerts\", sourced from the GitHub Advisory Database","url":"https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems SR-06 applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} - {"title":"GitHub and Government: FedRAMP FAQ — what GitHub states about which offering is covered and under which baseline; re-read rather than quote","url":"https://government.github.com/fedramp-faq"} --- ## https://ramprules.com/collect/supply-chain-alert-notification-routing # The organization's webhook configuration — which endpoints are subscribed to the supply-chain alert event, whether each is switched on, and where it points — together with the platform's own record of what it actually delivered to them and with what response code. Configuration says a path exists; the delivery log says the path carried something. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/supply-chain-alert-notification-routing Recipe id: `supply-chain-alert-notification-routing` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MON` - control `sr-8` ## Collection Kind: `api` ```sh # hooks gh api --paginate "/orgs//hooks?per_page=100" # hook gh api "/orgs//hooks/" # deliveries-failed gh api --paginate "/orgs//hooks//deliveries?status=failure&per_page=100" # deliveries gh api --paginate "/orgs//hooks//deliveries?per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `hooks` is the first command, `deliveries-failed` the third, `deliveries` the fourth. RUN COMMANDS 2, 3 AND 4 ONCE PER HOOK returned by the first, not once for the organization. The first command returns every organization webhook and the rest take a single ``; the delivery clause below speaks only for the hooks actually walked, and collecting one hook's deliveries and reading them as the organization's is the arithmetic error this recipe is most likely to be assessed with. From the hooks calls, webhook objects with `id`, `name`, `active`, an `events` array, a `config` object carrying `url`, `content_type` and `insecure_ssl`, plus `created_at`, `updated_at`, `url`, `ping_url`, `deliveries_url` and `type`. Read `events` knowing that GitHub documents the wildcard on the create body: the parameter "determines what events the hook is triggered for. Set to [\"*\"] to receive all possible events", and it defaults to `push`. Whether a GET returns the literal `"*"` or an expanded list is NOT documented and was not verified, which is why both clauses below carry the wildcard as a disjunct rather than testing for it — the disjunction is correct under either behaviour. From the deliveries calls, delivery records with `id`, `guid`, `delivered_at`, `redelivery`, `duration`, `status`, `status_code`, `event`, `action`, `installation_id`, `repository_id` and `throttled_at`. The third command uses GitHub's own `status` filter, documented on the organization webhooks reference as `success` for a response code of 200–399 and `failure` for 400–599, so it returns a list built to hold only offenders. The relevant `event` value is `dependabot_alert`, whose actions are `assignees_changed`, `auto_dismissed`, `auto_reopened`, `created`, `dismissed`, `fixed`, `reintroduced` and `reopened`, and which GitHub makes available on repository, organization and app webhooks. ## Assertions - {"field":"hooks[?active==`true` && (contains(events,'dependabot_alert') || contains(events,'*'))] | [0].id","op":"exists","controls":["sr-8"],"description":"At least one active organization webhook is subscribed to the supply-chain alert event. The wildcard is part of the clause rather than a caveat beside it: GitHub documents `events` as accepting `[\"*\"]` \"to receive all possible events\", so the best-subscribed hook on the platform may carry no event name, and a clause matching only the literal string reports it as missing. Says nothing about WHERE the hook points — `config.url` is opaque and the reconciliation in `scan_scope` is what reads it."} - {"field":"hooks[?(contains(events,'dependabot_alert') || contains(events,'*')) && active==`false`]","op":"count_eq","value":0,"controls":["sr-8"],"description":"No webhook subscribed to the supply-chain alert event is switched off. This is the failure that looks exactly like working configuration: the hook is present, correctly subscribed, visible in every listing, and dispatches nothing. It carries the same wildcard disjunct as the clause above, and it has to — the hook most likely to be subscribed and disabled is a wildcard one, and a literal-only filter would silently exempt exactly the case this clause exists to catch. Asserted as an offender count rather than as `active == true` over subscribed rows, because the projection form is evaluated over the rows that already carry the field and is green on a list where every subscribed hook is disabled."} - {"field":"deliveries-failed[?event=='dependabot_alert']","op":"count_eq","value":0,"controls":["sr-8"],"description":"No supply-chain alert delivery in the retrieved window came back a failure. The list is GitHub's own `status=failure` filter — documented as a response code of 400–599 — so this clause reads a response built to contain only offending rows, which is what keeps it meaningful on a healthy organization instead of vacuously true. Its window is of unknown length: no retention period is documented for delivery records, so this is a statement about what is retained, not about all time. It speaks only for the hooks actually walked; see the iteration note in `expected_output`."} ## Outside the boundary Platform: GitHub Enterprise Cloud The routing configuration and its delivery log are held by the platform, not by the provider, so reading them brings the platform into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. The consequence is sharper on this control than on most: SR-08 is about notification reaching the provider, and the evidence that it does is itself held by an outside party whose availability is a dependency of the notification path. SR-08 sits in the class b, c and d baselines, so this recipe is read by providers at every level, and the impact level a platform's Marketplace listing carries is not necessarily the one a Moderate or High system needs — that is the SA-09 question, it is answered by reading the cited listing, and no value for it is written here because it is a dated fact that changes. Which offering is in use decides the rest — GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency and github.com are different deployments — and this recipe was authored against GitHub Enterprise Cloud. ## Notes SR-08 establishes agreements and procedures with entities in the supply chain for notification of compromise or of a vulnerability. It has two limbs and this recipe answers one of them. The agreements limb is a contract with a supplier and nothing here touches it. What this recipe deliberately does NOT read is the alert list, and that is the whole design. A public advisory feed is not an entity in your supply chain, so an alert stream — however rich — cannot evidence SR-08 on its own; the feed itself is SI-05's artifact and is already collected there. What is evidence is the procedure: that an upstream notification, once it arrives, is delivered to a named destination rather than into nothing. That is configuration plus a delivery record, which is what these commands collect. A future batch tempted to strengthen this recipe by adding `dependabot/alerts` to it should read this paragraph first. The emptiness trap here is worse than usual and it is worth being blunt about. GitHub's deliveries reference documents `per_page`, `cursor` and a `status` filter, and states NO retention period for delivery records. So the window these commands read is of unknown length, and an empty deliveries list means one of: nothing was ever delivered, nothing has been delivered recently, or nothing is retained that far back. None of the three is distinguishable from the others in the output, and none of them is a pass. The failure clause below is therefore written over the `status=failure` list — a list whose emptiness is meaningful in a way the full list's is not, because it is built to contain offenders — and the fourth command is collected as the corroborating record a human reads for volume and recency. No clause asserts the full list is non-empty, because on a quiet organization it legitimately is. The wildcard is in BOTH hook clauses rather than in a note, and it has to be in both. A hook created with `events: [\"*\"]` receives every event including this one and may contain the string `dependabot_alert` nowhere, so a clause matching the literal alone reports the most completely subscribed configuration on the platform as unsubscribed. An earlier draft carried the disjunct on the first clause and not the second, which was worse than omitting it from both: the second clause exists to catch a subscribed-but-disabled hook, and without the disjunct the hook it could not see was exactly the wildcard one that had been switched off. Note also that GitHub documents the wildcard on the create request body; nothing states what a GET returns for such a hook, so the disjunction is written to be correct whether the literal survives the round trip or is expanded. The deprecated event, which no clause tests and every assessment should look for. GitHub carries a closing-down notice on `repository_vulnerability_alert` — "this event is closing down, use the `dependabot_alert` event instead" — with actions `create`, `dismiss`, `reopen` and `resolve`. An organization whose only subscription is that event is being delivered to today and is on a path that ends. It fails the first clause below, and that failure is correct rather than a false positive: the finding is real, its severity is scheduled rather than immediate, and reading the failure as a configuration error would be reading it right for the wrong reason. Organization hooks are not the only hooks. `dependabot_alert` is available on repository, organization and app webhooks, and `/orgs/{org}/hooks` returns only the middle one. A provider routing alerts per repository, or through a GitHub App, has a correct configuration that is entirely absent from these commands. That is a scope limit rather than a finding, and an assessment that reads an empty org hooks list as a failure has misread it — walk the repositories in the boundary, or the app installation, and collect the same two calls there. What a delivery proves and where it stops. A `status_code` in the 200–399 band says the platform reached an endpoint and the endpoint accepted the payload. It does not say the payload was parsed, was routed onward, reached a person, or was acted on within any clock. Every one of those is the thing SR-08's procedures limb ultimately cares about, and every one of them lives in the receiving system rather than in this one — which is the honest reason this recipe is `partial` and would still be `partial` with a perfect delivery log. KSI-SCR-MIT was deliberately not claimed. The dataset reaches SR-08 from KSI-SCR-MON alone, and a routing path evidences monitoring reaching someone rather than a risk being identified, reviewed and mitigated. ## References - {"title":"GitHub REST: organization webhooks — GET /orgs/{org}/hooks, /orgs/{org}/hooks/{hook_id} and /orgs/{org}/hooks/{hook_id}/deliveries, the last taking the status filter (success = 200–399, failure = 400–599) with no retention period stated; hook fields id, name, active, events, config.url/content_type/insecure_ssl, created_at, updated_at; events defaults to push and the create body accepts [\"*\"] \"to receive all possible events\"","url":"https://docs.github.com/en/rest/orgs/webhooks"} - {"title":"GitHub REST: repository webhooks — the sibling deliveries reference, carrying the same delivery fields id, guid, delivered_at, redelivery, duration, status, status_code, event, action and throttled_at, and the same status filter wording; cited because a provider routing alerts per repository collects the same evidence there","url":"https://docs.github.com/en/rest/repos/webhooks"} - {"title":"GitHub webhook events and payloads — dependabot_alert, available on repository, organization and app webhooks, actions created, dismissed, fixed, reintroduced, reopened, auto_dismissed, auto_reopened, assignees_changed; repository_vulnerability_alert carries a closing-down notice directing use of dependabot_alert instead","url":"https://docs.github.com/en/webhooks/webhook-events-and-payloads"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class of the system relying on this recipe; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/secret-exposure-detection-and-push-protection # Whether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/secret-exposure-detection-and-push-protection Recipe id: `secret-exposure-detection-and-push-protection` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SVC-ASM` - control `ia-5.6` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?per_page=100" # alerts-open gh api --paginate "/orgs//secret-scanning/alerts?state=open&per_page=100" # alerts-resolved gh api --paginate "/orgs//secret-scanning/alerts?state=resolved&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first command, `configuration-repositories` the second, `alerts-open` the third, `alerts-resolved` the fourth. RUN THE SECOND COMMAND ONCE PER CONFIGURATION returned by the first, not once for the organization. The first returns every configuration and the second takes a single ``; the clause on `configuration-repositories` speaks only for the configurations actually walked. From the configurations call, an array of code security configurations, each with an id, a name, a `target_type` of `global`, `organization` or `enterprise`, and the secret-scanning feature fields as THREE-STATE strings rather than booleans — `secret_scanning`, `secret_scanning_push_protection`, `secret_scanning_validity_checks`, `secret_scanning_non_provider_patterns`, `secret_scanning_delegated_bypass` and `secret_scanning_delegated_alert_dismissal` each taking `enabled`, `disabled` or `not_set` — plus an `enforcement` of `enforced` or `unenforced`. `not_set` is the value that defeats a careless clause: it is neither on nor off, it is the absence of a decision, and a comparison against `disabled` alone walks straight past it. From the configuration-repositories call, rows carrying a `status` of `attached`, `attaching`, `detached`, `removed`, `enforced`, `failed`, `updating` or `removed_by_enterprise`. From the alerts calls, alerts with `number`, `created_at`, `updated_at`, `url`, `html_url`, a `state` of `open` or `resolved`, a `resolution` drawn from `false_positive`, `wont_fix`, `revoked`, `used_in_tests`, `pattern_edited` and `pattern_deleted`, `resolved_at` and `resolved_by`, a `secret_type` and its `secret_type_display_name`, a `validity` of `active`, `inactive` or `unknown`, and the push-protection quartet `push_protection_bypassed`, `push_protection_bypassed_by`, `push_protection_bypassed_at` and — for the alert raised by the bypass — the repository it landed in, plus `publicly_leaked` and `multi_repo`. Note that `resolution` and `validity` are documented as comma-separated FILTERS accepting those values as well as fields carrying them, and that the endpoint takes `secret_type`, `exclude_secret_types`, `providers`, `sort`, `direction`, `before`, `after`, `is_publicly_leaked` and `is_multi_repo` besides. The organization endpoint requires an administrator or a security manager, and a token carrying the `repo` or `security_events` scope. ## Assertions - {"field":"configurations[?target_type=='organization' && secret_scanning=='enabled'] | [0].id","op":"exists","controls":["ia-5.6"],"description":"At least one code security configuration the organization itself owns sets `secret_scanning` to `enabled`. Three-state field, so the middle value is the trap: `not_set` is the absence of a decision rather than a `no`, and a clause written against `disabled` passes an organization that never decided. `target_type` is narrowed to `organization` because the enum admits a `global` scope no administrator creates. This says a configuration exists and decided; it does not say which repositories it reaches, and a failure means no organization-owned configuration governs scanning — not that nothing is scanned."} - {"field":"configurations[?target_type=='organization' && secret_scanning_push_protection!='enabled']","op":"count_eq","value":0,"controls":["ia-5.6"],"description":"No configuration the organization owns leaves push protection unenabled. `!=` rather than `== 'disabled'` on purpose: the field is three-state and `not_set` is what a comparison against `disabled` misses. Written as an offender count over rows present in the same response the clause above reads, rather than as a projection over the rows that already carry the setting, which would be green on a list where every configuration has it off. Detection after the fact and prevention at the push are different protections, and this is the only clause here that asks for the second."} - {"field":"configurations[?target_type=='organization' && secret_scanning_validity_checks!='enabled']","op":"count_eq","value":0,"controls":["ia-5.6"],"description":"No configuration the organization owns leaves validity checking unenabled. This clause exists to give the next one a chance of meaning something — it is necessary and it is NOT sufficient. `validity` is `unknown` on every alert in an organization that never turned validity checks on, and `unknown` is not `active`, so the next clause passes perfectly while nothing has ever been checked. Green here does not make the next clause safe: unsupported secret types stay `unknown` with the feature fully on, checks are periodic rather than retroactive, and this clause reads configurations rather than the repositories the alerts came from. See the notes for all three residues. Red here makes the next clause unreadable rather than passing."} - {"field":"alerts-open[?validity=='active']","op":"count_eq","value":0,"controls":["ia-5.6"],"description":"No open secret scanning alert names a credential the issuing provider confirmed still works. This is the sharpest statement available on this plane about authenticator protection: not that a secret was committed, which is history, but that a committed secret is live now. It is not readable alone. It requires the first clause (scanning on at all) and the third (validity checking on) to be green, and it still passes over any secret type GitHub cannot validity-check and over any alert not yet re-checked since the feature was enabled. Offender form over a state-filtered list, and its silence is bounded once more by the partner programme: a leaked credential handled directly with its vendor never appears here at all."} ## Outside the boundary Platform: GitHub Enterprise Cloud The detection engine, the alert store and the record of who bypassed a block are all held and operated by the platform, so collecting this evidence brings it into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 already covers. The consequence is sharper here than on a scanning control, and it is worth stating plainly: this recipe hands a third party the authenticators themselves. Detection works by matching the credential, validity checking works by ASKING THE ISSUING PROVIDER whether it still works, and the partner programme works by reporting the match to the vendor who issued it. A provider adopting this is not only trusting the platform with its code; it is trusting it with the secrets that leaked out of it, and with the fact that they leaked. IA-05 (06) is a class c and class d control, so every reader of it runs a Moderate or High system, and the offering named above is not the one such a reader can necessarily use: the Marketplace listing cited below is the listing for GitHub Enterprise Cloud, and a class c or class d reader has to check it against the class they are operating at and, if it does not answer, look to whichever offering does — GitHub Enterprise Cloud for Government is a different product on different infrastructure and carries its own listing. That is the SA-09 question. It is answered by reading the listings rather than by this sentence, and no status value is written down here because a certification status is a dated fact that changes. Which offering is in use decides the rest: secret scanning for private and internal repositories requires GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud, and GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency and github.com are different deployments on different infrastructure. This recipe was authored against GitHub Enterprise Cloud. ## Notes IA-05 (06) asks the provider to protect authenticators commensurate with the security category of the information to which use of the authenticator permits access. Two words in that sentence are the reason this is `partial` and would stay `partial` under any amount of extra collection. PROTECT is broader than DETECT: this evidence is a detection-and-response record for one storage location, and the control asks about the protection of authenticators wherever they live. COMMENSURATE is a judgement that requires knowing what the credential opens, and no field in any response here says that — `secret_type` names the kind of credential, never the security category of what it unlocks. A `high` alert on a test-fixture token and a `low` alert on a production database password are the same shape in this output. The disposition this recipe spends said exactly that, and writing the commands down has not changed it. The population problem, stated once and load-bearing everywhere below. Authenticators live in secret stores, CI variable sets, container images, build arguments, configuration management and on operator workstations. This recipe reads git repositories on one platform. The fraction of the provider's authenticator population that is in scope here is not a number this recipe can compute, and `scan_scope` names the external list against which somebody has to compute it. WHY THE VALIDITY CLAUSE IS INTERLOCKED WITH A SETTINGS CLAUSE, AND WHY THE INTERLOCK IS NECESSARY WITHOUT BEING SUFFICIENT. The fourth assertion asserts that no open alert has a `validity` of `active` — no leaked credential is confirmed to still work. Read alone it is one of the most vacuous clauses on this plane, because `validity` is `unknown` for every alert in an organization that never switched validity checks on, and `unknown` is not `active`, so the clause passes perfectly on an organization that has never checked a single credential. The third assertion exists to close that: it fails an organization whose configurations leave `secret_scanning_validity_checks` at anything other than `enabled`. What it does NOT do is make the fourth clause safe, and an earlier draft of this paragraph claimed it did. Three residues survive it. First, GitHub documents that validity checks are "available for secrets from many service providers, and support continues to expand" and that "Some secrets require more than the token itself to confirm whether they are active" — so a leaked credential of an unsupported type reports `unknown` with validity checking fully enabled, and the fourth clause passes over it. Second, GitHub "will periodically check the validity of a detected credential", which is a schedule rather than a trigger: enabling the feature does not retro-populate the alerts already open, so there is a window after enablement in which every existing alert is still `unknown`. Third, the third clause is not even the only prerequisite — the FIRST assertion is equally load-bearing, because with `secret_scanning` off there are no alerts of any validity at all and the fourth clause is vacuous for a reason the third never touches. And the third clause reads configurations rather than repositories, so it can be red while validity checking is genuinely on through repository-level settings, and green while the repositories that matter are attached to no configuration at all; it does not bind the population the alerts came from. Read the fourth clause as meaningful only when the first and third are green AND the reconciliation in `scan_scope` has been done, and read a green fourth clause on its own as saying nothing. THE PARTNER PROGRAMME IS AN INVISIBLE SUCCESS PATH AND IT MAKES AN EMPTY ALERT LIST AMBIGUOUS IN A NEW DIRECTION. GitHub states that "Partner secrets are reported directly to the provider and aren't displayed in your repository alerts". So for a leaked credential issued by a participating vendor, the platform's response is to tell the vendor, and the provider's own alert list stays empty. An empty `alerts-open` is therefore equally an organization that has leaked nothing, an organization that is not scanning, and an organization whose leaks were all handled by a party that never told it. The first and third of those are indistinguishable in this output and only one of them is a pass. This is not the usual empty-list caveat imported from the plane card; it is a documented behaviour of this specific feature, and an assessment reading a clean alert list as evidence of a clean estate has made the exact error the platform's own documentation predicts. What the bypass fields are worth, and where they stop. Push protection blocks a push containing a detected credential, and GitHub documents that anyone with write access can bypass it by choosing a reason from "It's used in tests", "It's a false positive" and "I'll fix it later", after which the platform "Creates an alert", "Adds the bypass event to the audit log", and emails owners, security managers and repository administrators. So a bypass is a recorded decision rather than a silent one, and `push_protection_bypassed`, `push_protection_bypassed_by` and `push_protection_bypassed_at` on the resulting alert are that decision as fields. No clause below asserts a count of zero over them, deliberately: a bypass is a documented, authorized action with a named actor and a stated reason, and a provider with a legitimate test fixture would fail such a clause while behaving correctly. The bypass records are collected as a record for a human to read against the provider's own procedure — the third of the three documented reasons is an admission that a credential was pushed knowingly, and how long "later" ran is a question for the assessment rather than for a threshold. Delegated bypass, whose enablement is visible as `secret_scanning_delegated_bypass`, moves the decision to a reviewer; it is collected, not asserted, for the same reason. A code security configuration is not the only way any of this gets switched on, so the first three clauses are wrong in one direction. The features can be enabled on a repository directly in its own settings, with no configuration involved, and an organization that never adopted configurations returns an empty list from the first command and fails all three while scanning everything it owns. Read a failure as "no organization-level configuration governs this" — which is literally true and is itself a finding — and NOT as "nothing is scanned". The reconciliation named in `scan_scope` is what separates the two readings, and nothing in this output does. The `target_type` narrowing carries the same cost it carries on the dependency recipe: the enum admits `global` and `enterprise`, an administrator can apply a configuration owned elsewhere, and applying it is a decision this clause will not count. The trade is made the same way and for the same reason. KSI-SVC-ASM is claimed on the PROTECTION limb only. The indicator asks for management, protection and regular ROTATION of keys, certificates and other secrets, automated and persistently reviewed. Detection of an exposed secret, and the record of what was decided about it, is protection and it is review. Rotation is not a scanning result: `resolution` admits `revoked`, which is the closest this output comes, and it is a human's assertion typed into a dropdown rather than an observation that a credential was replaced. The rotation limb of this indicator is answered on the AWS plane, by the KMS and ACM recipes, and an indicator page carrying this recipe should be read as carrying evidence for a part. KSI-IAM-APM and KSI-IAM-ELP also reach this control in the dataset and are deliberately not claimed: one is about passwordless and phishing-resistant authentication methods and the other about least privilege, and a leaked-credential detector speaks to neither. ## References - {"title":"GitHub REST: secret scanning — GET /orgs/{org}/secret-scanning/alerts and GET /repos/{owner}/{repo}/secret-scanning/alerts; state open | resolved, resolution false_positive | wont_fix | revoked | used_in_tests | pattern_edited | pattern_deleted, validity active | inactive | unknown, and the alert fields number, created_at, secret_type, secret_type_display_name, resolved_at, resolved_by, push_protection_bypassed / _by / _at, publicly_leaked and multi_repo; repo or security_events scope, organization endpoint requires an administrator or security manager","url":"https://docs.github.com/en/rest/secret-scanning/secret-scanning"} - {"title":"GitHub REST: code security configurations — the secret-scanning enablement fields secret_scanning, secret_scanning_push_protection, secret_scanning_validity_checks, secret_scanning_non_provider_patterns, secret_scanning_delegated_bypass and secret_scanning_delegated_alert_dismissal, each documented as enabled | disabled | not_set, and the repository association status enum attached | attaching | detached | removed | enforced | failed | updating | removed_by_enterprise","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: about secret scanning — scans \"your entire Git history on all branches\" for hardcoded credentials; \"Partner secrets are reported directly to the provider and aren't displayed in your repository alerts\"; validity checks \"help you prioritize which secrets to remediate first by verifying whether a detected secret is still active\" and are \"separate from secret scanning's partner program\"; private and internal repositories require GitHub Secret Protection on GitHub Team or GitHub Enterprise Cloud","url":"https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning"} - {"title":"GitHub: about push protection — blocks the push and \"provide[s] a detailed message explaining the reason for the block\"; \"Anyone with write access to the repository can bypass push protection by specifying a bypass reason\" from used-in-tests, false-positive and I'll-fix-it-later; a bypass \"Creates an alert\", \"Adds the bypass event to the audit log\" and emails owners, security managers and repository administrators; delegated bypass moves the decision to a reviewer; requires GitHub Secret Protection","url":"https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems IA-05 (06) applies to; a certification status is a dated fact about a product, not about your deployment, and this recipe hands that product the authenticators themselves","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/build-provenance-attestation-verification # For each artifact actually running in the boundary, the cryptographic answer to whether it came from the build this provider claims built it: the signed provenance statement, the certificate identifying the workflow that produced it, and the transparency-log timestamps that make the signature checkable later. Collected alongside the two things that decide whether that answer can be trusted at all — the version of the verifying client, and the record of which deployed artifacts were submitted for verification in the first place. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/build-provenance-attestation-verification Recipe id: `build-provenance-attestation-verification` · cadence on-change · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-MLA-EVC` - control `si-7.7` ## Collection Kind: `cli` ```sh # gh-version gh --version # ecr-repositories aws ecr describe-repositories --query "repositories[].repositoryName" --output json # ecr-images aws ecr describe-images --repository-name --query "imageDetails[].{digest:imageDigest,pushedAt:imagePushedAt,tags:imageTags}" --output json # verify-results gh attestation verify oci:///@ --repo / --predicate-type https://slsa.dev/provenance/v1 --format json # attestations gh api "/repos///attestations/sha256:?per_page=100" # trusted-root gh attestation trusted-root > trusted_root.jsonl ``` ## Expected output Report names used below, and the command each comes from: `gh-version` is the first command, `ecr-repositories` the second, `deployed-images` the third, `verify-results` the fourth, `attestations` the fifth. THIS RECIPE IS TWO NESTED LOOPS AND BOTH ARE LOAD-BEARING. Run the third command ONCE PER REPOSITORY NAME returned by the second — `describe-images` takes a single `--repository-name` and there is no organization-wide form of it — and run the fourth and fifth ONCE PER DIGEST returned by the third. Walking one repository and reading its images as the registry's is the same arithmetic error the sibling recipes on this plane call out by name, and here it lands on the command that IS the scope claim, so it under-states the population rather than merely under-reporting a setting. From `gh --version`, the client version string. It is collected rather than decorative — see the CVE paragraph in the notes. From the registry calls, the repository names in the account and, per repository, one row per image with its `digest`, `pushedAt` and `tags`. This is the widest population the commands can establish, it comes from the estate rather than from the platform under assessment, and `scan_scope` says what it is still not. From the verify call with `--format json`, GitHub documents "a JSON array containing one entry per verified attestation", each entry carrying an `attestation` (the verified bundle) and a `verificationResult` whose parsed contents include `signature.certificate` — the parsed X.509 certificate identifying the signer — `verifiedTimestamps`, an array of transparency-log and timestamp-authority records, and `statement`, carrying `subject`, `predicateType` and the `predicate` object. The command's documented purpose is to "Verify the integrity and provenance of an artifact using its associated cryptographically signed attestations", validating "the identity of the actor that produced the attestation" and "the expected attestation predicate type (the nature of the claim)". `--predicate-type` defaults to `https://slsa.dev/provenance/v1` and is written out explicitly in the command above rather than left implicit, for the reason the notes give. Other flags worth knowing exist rather than being used blind: `--cert-identity` and `--cert-identity-regex`, `--cert-oidc-issuer` (default `https://token.actions.githubusercontent.com`), `--signer-repo`, `--signer-workflow`, `--source-ref`, `--source-digest`, `--deny-self-hosted-runners`, `--digest-alg` (default `sha256`), `--limit` (default 30), `--bundle` and `--custom-trusted-root`. From the attestations REST call, a JSON OBJECT — not an array, and it is the only command in this file whose stdout is not one. The body carries an `attestations` array whose entries have `repository_id`, `bundle_url`, `initiator` and a `bundle` object with `mediaType`, `verificationMaterial` and `dsseEnvelope`. Because the report name and the body key are the same word, the clause below reads `attestations.attestations` and that repetition is correct rather than a typo: the first is this recipe's name for the command's stdout, the second is the key inside it. The path parameter is documented as `sha256:HEX_DIGEST`, `predicate_type` filters to "provenance, sbom, release, or freeform text for custom predicate types", `per_page` maxes at 100, and a fine-grained token needs `attestations:read`. The sixth command writes the trusted root out for an air-gapped assessment: GitHub documents that "Artifact attestations can be verified without an internet connection" given the bundle, the trusted root file and the CLI imported in advance, and advises generating "a new `trusted_root.jsonl` file any time you are importing new signed material into your offline environment". ## Assertions - {"field":"verify-results | [0].verificationResult.statement.predicateType","op":"exists","controls":["si-7.7"],"description":"The verification returned at least one attestation whose parsed statement can be read. This clause exists because of CVE-2025-25204: on affected GitHub CLI versions the command exited ZERO when no attestation matched the requested predicate type, so the absent case looked like the passing case to anything reading `$?`. An empty array is the shape that bug produces, and this clause fails on it. Written against the parsed JSON rather than the exit status for that reason, and paired with the collected `gh --version` so an assessment can say which client produced the answer. It speaks for one digest — the population is the two nested loops in `expected_output`, not this clause."} - {"field":"attestations.attestations | [0].bundle.dsseEnvelope","op":"exists","controls":["si-7.7"],"description":"The platform holds at least one stored attestation bundle for the digest, read through the REST API rather than through the verifying client. A second, independent view of the same fact: the clause above says a verification succeeded, and this says the underlying signed envelope exists in the store and can be fetched again by an assessor who did not run the original command. The doubled word is deliberate — this command's stdout is an object rather than an array, and `attestations.attestations` is this recipe's report name followed by the key inside the body. Keyed by `subject_digest`, so like every clause here it speaks only for the digests the registry enumeration actually drove it over."} ## Outside the boundary Platform: GitHub Enterprise Cloud This recipe depends on TWO external systems, not one, and how independent the second is depends on a fact worth reading off the citation rather than hedging. The first is the platform that issues and stores the attestations, an information resource under SA-09 and CA-03 like every other on this plane. The second is the signing and transparency infrastructure the verification actually trusts: GitHub documents that it "uses Sigstore, which is an open source project that offers a comprehensive solution for signing and verifying software artifacts via attestations", and it is explicit about which instance signs what — "Public repositories that generate artifact attestations use the Sigstore Public Good Instance", while "Private repositories that generate artifact attestations use GitHub's Sigstore instance". Read what that means for a provider, because it cuts against this recipe rather than for it: a private repository, which is what a FedRAMP-boundary repository normally is, has its artifacts signed by the same vendor that hosts the code, runs the build and stores the attestation. The trust root is not an independent second party there — it is the first party again, and the verification is the platform confirming its own claim. Only the public-repository path gets the separation, and there the transparency log is operated by neither the provider nor its platform vendor, which is a different SA-09 question rather than a smaller one. The `--no-public-good` switch and the `--custom-trusted-root` flag on the verifying command are the surface of this choice. SI-07 (07) is a class c and class d control, so every reader runs a Moderate or High system, and the offering named above is not necessarily the one such a reader can use: the Marketplace listing cited below is the listing for GitHub Enterprise Cloud, and a class c or class d reader has to check it against the class they operate at and look to whichever offering answers it — GitHub Enterprise Cloud for Government is a different product on different infrastructure with its own listing. No status value is written down here, because a certification status is a dated fact that changes, and none of these listings says anything at all about the Sigstore instance the verification trusts. ## Notes SI-07 (07) asks the provider to incorporate the detection of organization-defined security-relevant unauthorized changes INTO THE ORGANIZATIONAL INCIDENT RESPONSE CAPABILITY. The detection half of that sentence is the strongest thing this plane has: verification of a signed provenance statement over a named artifact is cryptography, not inference, and it either checks out or it does not. The other half is not in this output anywhere. Nothing here shows that a verification failure raises an incident, that an incident is triaged, that it reaches a human, or that a deployment is stopped. The gap is the integration and not the detection, and the disposition this recipe spends said so in advance precisely so that the authoring batch would not read the strength of the command as covering the clause it does not touch. It does not. THE EXIT STATUS IS NOT THE EVIDENCE, AND THERE IS A CVE THAT PROVES IT. The obvious way to write this recipe is to run the command in CI and trust its exit code — which is what makes CVE-2025-25204 the single most important fact in this file. GitHub's own advisory for the GitHub CLI states that `gh attestation verify` "may return an incorrect zero exit status when no matching attestations are found for the specified `--predicate-type `", that this happens when "an artifact has an attestation with a predicate type different from the one provided in the command", that the cause was "a re-used uninitialized error variable" returning `nil` "when no matching attestations are found", and that "Users who rely exclusively on the exit status code of `gh attestation verify` may incorrectly verify an attestation when the attestation's predicate type does not match the specified predicate type in the command". Versions from v2.49.0 are affected; v2.67.0 is the fix. Read what that says about this plane, because it is the plane card's vacuity trap arriving in the one place the card said `full` was plausible: the ABSENCE of a matching attestation was reported as success. The clauses below are therefore written against the PARSED JSON rather than against the exit code, `--predicate-type` is written out explicitly in the command rather than relied on as a default, and `gh --version` is collected so that an assessment can state which client produced the result. A recipe on this plane that reduces to `run the command, check $?` is unsound on a client older than v2.67.0 and is unverifiable on any client whose version was never recorded. TWO ASSERTIONS WERE WRITTEN, AUDITED AND DELETED BEFORE THIS RECIPE SHIPPED. Both are recorded here so that a later batch reading the thin assertion list does not helpfully restore them. The first asserted `verify-results[?verificationResult.verifiedTimestamps==null] count_eq 0` — that no returned attestation lacked the transparency-log records that make its signature checkable later. It was unfalsifiable, and the way it failed is the exact shape this plane's card warns about. Verification requires at least one observer timestamp to succeed, so an attestation with none never appears in the output at all: it is ABSENT from the response, not false in it, and the clause therefore returned zero on every possible output of the command, including on an estate where nothing verifies. The literal was wrong twice over besides — a bare `null` is not a JMESPath literal in the form this file uses elsewhere, and the field is an empty array rather than null in any case — but the fatal defect is the one no rewrite of the expression could repair. It read as the recipe's most confident clause and decided nothing. That it appeared in the one recipe whose whole argument is that this plane must not trust a signal reporting success on absence is the reason it is written up here at length rather than quietly dropped. The second asserted `verify-results[?verificationResult.statement.predicateType!='https://slsa.dev/provenance/v1'] count_eq 0` — that every returned entry carried the predicate type asked for. It cannot fail either, for a duller reason: the command is invoked WITH `--predicate-type https://slsa.dev/provenance/v1`, so on a patched client the returned set is already filtered to it, and on an affected client the array is empty and the surviving existence clause is what catches that. A clause restating the flag it was invoked with is an invariant, not a check. What it was really trying to say belongs where it now is — in the command, written out explicitly rather than left to a default. What remains is two clauses that can both go red, which is a smaller number than this recipe started with and a more honest one. Why this is `partial` and not `full`, stated against the schema's own two tests rather than by assertion. The writable check exists — the clauses below are it. The freshness clause does not: a `full` rating on this plane additionally needs a `max_age_days` assertion showing the scan RAN, RECENTLY, over a named set, and there is nothing in this output to hang one on. `verifiedTimestamps` carries transparency-log and timestamp-authority records, but those timestamp the SIGNING of the attestation, not the running of the verification, and a freshness clause over them would assert that the artifact was built recently — a different claim, and one that is false for a correctly pinned long-lived dependency. The verification event itself leaves no timestamp in this output at all. So the honest reading is that the population cannot be shown to have been re-verified on any cadence from the evidence the recipe collects, which is the second reason the rating is `partial` and the reason it would remain `partial` even if the incident-response limb were somehow answered. What an attestation proves, in GitHub's own words, and what it does not. The concept page states that "Artifact attestations enable you to create unfalsifiable provenance and integrity guarantees for the software you build" and that "Artifact attestations by itself provides SLSA v1.0 Build Level 2". It also carries the sentence that belongs in every assessment reading this evidence: "It is important to remember that artifact attestations are *not* a guarantee that an artifact is secure. Instead, artifact attestations link you to the source code and the build instructions that produced them." A verified artifact is an artifact whose origin is known. SI-07 (07) is about unauthorized CHANGE, and provenance answers that limb well; it says nothing about whether the authorized build was itself sound, which is SA-11's and SI-07's own territory. The signer identity is where this recipe is weakest as written, and it is deliberate. The command validates "the identity of the actor that produced the attestation", but the clauses below do not pin WHICH actor: `--cert-identity`, `--cert-identity-regex`, `--signer-repo`, `--signer-workflow` and `--source-ref` are the flags that would, and the right values for them are provider-specific — the workflow file and ref that legitimately builds this artifact. A verification that passes without them says the artifact was built by SOME workflow in the named repository, which is a real claim and a weaker one than most readers will assume. `--deny-self-hosted-runners` is the same shape: a provider whose threat model distinguishes hosted from self-hosted runners has a flag for it and this recipe does not set it. Pinning these is the single highest-value change an implementer can make to this recipe, and it is left to the implementer because a wrong value here fails closed and noisily rather than silently. The registry commands are AWS calls inside a pipeline recipe, and that is on purpose rather than an oversight about which file this belongs in. `scan_scope` requires an inventory held OUTSIDE the scanner, and a scanner that cannot enumerate anything makes the requirement bite harder here than anywhere else on this plane — so the enumeration has to come from the estate. They are written against ECR because that is the estate this project's other plane describes; a provider deploying Lambda packages, AMIs or plain binaries substitutes the equivalent enumeration and the recipe is unchanged in every other respect. Nothing about the verification is AWS-specific. What these commands are NOT is the control's population, and `scan_scope` now says so at length rather than implying otherwise: a registry listing is what was pushed, the deployment record is what is running, and an earlier draft of that field described the second while enumerating the first. KSI-MLA-EVC is claimed and the other two indicators reaching this control are not, and the claim is the weakest judgement in this recipe rather than a settled one. EVC asks that the configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. Two of its words strain here. `Persistently` is the one the missing freshness clause fails to evidence, and it is named elsewhere in these notes. `Configuration` is the harder one and is recorded rather than argued away: an artifact's provenance is not its configuration, EVC's other controls are `ca-7`, `cm-2` and `cm-6` — configuration-baseline controls, which is the company the indicator keeps — and the honest statement is that verifying what a deployment was built from is a test applied to a machine-based information resource before it becomes one, which is adjacent to the indicator's subject rather than inside it. EVC is claimed because it is the least-bad of the three indicators that reach this control and because the evidence is real; a batch that later finds a better home for this recipe should move it without treating this paragraph as a defence. KSI-MLA-LET asks for a maintained and reviewed list of information resources and event types that will be logged, monitored and audited; a verification result is not that list. KSI-MLA-OSM asks for a SIEM or similar system used for centralized, tamper-resistant logging; the Sigstore transparency log is genuinely tamper-resistant logging, but it is the signing infrastructure's log rather than the provider's monitoring system, and claiming OSM from it would be reading someone else's control as evidence of yours. Both omissions are the same judgement the incident-response gap makes: the route from this output into the provider's own response and monitoring capability is exactly what is missing, and claiming the indicators that describe that route would be claiming it. ## References - {"title":"GitHub CLI manual: gh attestation verify — synopsis `gh attestation verify [ | oci://] [--owner | --repo] [flags]`; \"Verify the integrity and provenance of an artifact using its associated cryptographically signed attestations\", validating \"the identity of the actor that produced the attestation\" and \"the expected attestation predicate type\"; --predicate-type defaults to https://slsa.dev/provenance/v1, --cert-oidc-issuer to https://token.actions.githubusercontent.com, --digest-alg to sha256, --limit to 30; --format json returns \"a JSON array containing one entry per verified attestation\" carrying attestation and verificationResult with signature.certificate, verifiedTimestamps and statement (subject, predicateType, predicate); exit-status behaviour is NOT documented on this page","url":"https://cli.github.com/manual/gh_attestation_verify"} - {"title":"GitHub CLI security advisory GHSA-fgw4-v983-mgp8 (CVE-2025-25204) — \"`gh attestation verify` returns incorrect exit code during verification when predicate types mismatch\"; \"may return an incorrect zero exit status when no matching attestations are found for the specified --predicate-type\"; cause \"a re-used uninitialized error variable\" returning nil; \"Users who rely exclusively on the exit status code of `gh attestation verify` may incorrectly verify an attestation when the attestation's predicate type does not match\"; affected >= v2.49.0, patched v2.67.0","url":"https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8"} - {"title":"GitHub: artifact attestations concept — \"Artifact attestations enable you to create unfalsifiable provenance and integrity guarantees for the software you build\"; \"Artifact attestations by itself provides SLSA v1.0 Build Level 2\"; GitHub \"uses Sigstore\", public repositories use \"the Sigstore Public Good Instance\" with \"an immutable transparency log\"; and the limitation that matters most — \"It is important to remember that artifact attestations are *not* a guarantee that an artifact is secure. Instead, artifact attestations link you to the source code and the build instructions that produced them.\"","url":"https://docs.github.com/en/actions/concepts/security/artifact-attestations"} - {"title":"GitHub REST: repository attestations — GET /repos/{owner}/{repo}/attestations/{subject_digest}, subject_digest documented as \"sha256:HEX_DIGEST\", predicate_type filtering to \"provenance, sbom, release, or freeform text for custom predicate types\", per_page max 100 default 30, response attestations[] carrying repository_id, bundle_url, initiator and bundle (mediaType, verificationMaterial, dsseEnvelope); fine-grained tokens need attestations:read","url":"https://docs.github.com/en/rest/repos/attestations"} - {"title":"GitHub: verify artifact attestations offline — \"Artifact attestations can be verified without an internet connection\" given `gh attestation download`, `gh attestation trusted-root > trusted_root.jsonl` and the CLI imported in advance, verified with --bundle and --custom-trusted-root; \"It's best practice to generate a new `trusted_root.jsonl` file any time you are importing new signed material into your offline environment\"","url":"https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/verify-attestations-offline"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems SI-07 (07) applies to; a certification status is a dated fact about a product, not about your deployment, and it says nothing at all about the Sigstore instance the verification trusts","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/static-analysis-coverage-and-flaw-disposition # Whether static analysis is configured in this organization and which repositories it actually reaches; for each of those repositories, which query suite ran over which languages, whether the recurring schedule is still alive, when the analysis last ran and with how many rules in the run; and what the analysis found, split into what is still open and what a person closed by hand — each closure carrying who closed it, which of four fixed reasons they chose, and whatever they wrote down. The first two halves are the population and the proof that testing happened; the third is the half an assessment asks for, and read without the other two it cannot be told apart from the output of a scanner that never ran. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/static-analysis-coverage-and-flaw-disposition Recipe id: `static-analysis-coverage-and-flaw-disposition` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MIT` - control `sa-11` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?per_page=100" # default-setup gh api "/repos///code-scanning/default-setup" # analyses gh api --paginate "/repos///code-scanning/analyses?tool_name=CodeQL&ref=refs/heads/&per_page=100" # alerts-open gh api --paginate "/orgs//code-scanning/alerts?state=open&tool_name=CodeQL&per_page=100" # alerts-dismissed gh api --paginate "/orgs//code-scanning/alerts?state=dismissed&tool_name=CodeQL&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first command, `configuration-repositories` the second, `default-setup` the third, `analyses` the fourth, `alerts-open` the fifth and `alerts-dismissed` the sixth. RUN COMMANDS 3 AND 4 ONCE PER REPOSITORY, not once for the organization. There is no organization-scoped analyses endpoint and no organization-scoped default-setup endpoint — GitHub documents both only under /repos/{owner}/{repo} — while the alert endpoints exist at both scopes. So the population half of this recipe is assembled one repository at a time and the findings half arrives in one list, and collecting one repository's analyses and reading them as the organization's is the arithmetic error this recipe is most likely to be assessed with. From `configurations`, configuration objects whose code-scanning fields are `code_scanning_default_setup` and `code_scanning_delegated_alert_dismissal`, each documented as `enabled | disabled | not_set`, plus `code_scanning_default_setup_options` carrying `runner_type` (`standard | labeled | not_set`) and `runner_label`. Each row also carries `target_type`, which is `global | organization | enterprise` — and the list endpoint's own `target_type` parameter is documented `Default: all`, so THIS RESPONSE IS NOT A LIST OF CONFIGURATIONS THE ORGANIZATION AUTHORED. It can contain a GitHub-provided global configuration and an enterprise-owned one, neither of which the organization can edit, and both of which can be the thing that switched code scanning on. The two clauses below split on exactly that distinction; read their descriptions together rather than separately. From `configuration-repositories`, association rows whose `status` is one of `attached | attaching | detached | removed | enforced | failed | updating | removed_by_enterprise`; the call passes no `status` filter, whose documented default is `all`, which is deliberate here because the `failed` row is what one clause below exists to catch. From `default-setup`, `state` (`configured | not-configured`), `languages` drawn from `actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift`, `query_suite` (`default | extended`), `threat_model` (`remote | remote_and_local`), `runner_type`, `runner_label`, `updated_at` and `schedule` (`weekly | null`). From `analyses`, analysis objects with `id`, `ref`, `commit_sha`, `analysis_key`, `environment`, `category`, `error`, `warning`, `created_at`, `results_count`, `rules_count`, `sarif_id`, `deletable` and a `tool` object of `name`, `version`, `guid`. `sort` accepts only `created` and `direction` defaults to `desc`, which is what makes `analyses[0]` the most recent run and is the documented behaviour the freshness clause depends on — a collector that overrides either has changed what that clause means. The command narrows on `ref` as well as `tool_name`, and both narrowings are load-bearing: without `ref` the newest row can be a pull-request analysis (`refs/pull/N/merge`), and GitHub documents `category` as what distinguishes "multiple analyses for the same tool and commit, but performed on different languages or different parts of the code", so on a multi-language repository `analyses[0]` is whichever LANGUAGE finished last. There is no server-side `category` filter, so a repository with more than one analysed language needs the freshness clause read per category — see the note. From both alert lists, alerts with `number`, `created_at`, `updated_at`, `state` (`open | dismissed | fixed | null`), `fixed_at`, `dismissed_by`, `dismissed_at`, `dismissed_reason` (`false positive | won't fix | used in tests | mitigated | null`), `dismissed_comment` (nullable, max 280 characters), a `rule` object (`id`, `name`, `severity` `none | note | warning | error`, `security_severity_level` `low | medium | high | critical`, `description`, `full_description`, `tags`, `help`, `help_uri`), a `tool` object, `most_recent_instance` (with `ref`, `analysis_key`, `category`, `commit_sha`, `location`, `classifications`) and, at organization scope, the `repository` the alert belongs to. Read the alert lists knowing two documented things about them: the organization endpoint takes no `ref` filter, and GitHub states that "The status and details on the alert page only reflect the state of the alert on the default branch of the repository, even if the alert exists in other branches" — so this is a default-branch picture, not a repository-wide one. Both alert commands pass `tool_name=CodeQL`, because code scanning stores third-party SARIF in the same store and this recipe's claims are about the CodeQL analyses the fourth command measures. ## Assertions - {"field":"configurations[?code_scanning_default_setup=='enabled'] | [0].id","op":"exists","controls":["sa-11"],"description":"At least one code security configuration visible to this organization sets `code_scanning_default_setup` to `enabled`. Deliberately NOT narrowed to `target_type=='organization'`: the list endpoint's `target_type` parameter defaults to `all`, the response enum is `global | organization | enterprise`, and an organization whose code scanning is switched on by a GitHub-provided global configuration or by an enterprise-owned one is compliant while owning no such configuration itself — a narrowed clause would report it as having none. Three-state field, so the middle value is still the trap: `not_set` is the absence of a decision rather than a `no`, and a clause written against `disabled` passes an organization that never decided. This says a configuration exists and decided; it does not say which repositories it reaches, and it does NOT say nothing is analysed when it fails, because repository-level enablement bypasses configurations entirely."} - {"field":"configurations[?target_type=='organization' && code_scanning_default_setup!='enabled']","op":"count_eq","value":0,"controls":["sa-11"],"description":"No configuration the organization ITSELF OWNS leaves code scanning default setup unenabled. This clause keeps the `target_type` narrowing that the clause above drops, and the asymmetry is the point rather than an inconsistency: a provider cannot edit a global or enterprise-owned configuration, so failing it for one would be failing it for a decision it has no permission to make, while a configuration it authored and left at `not_set` is its own omission. `!=` rather than `== 'disabled'` for the three-state reason, and written as an offender count over rows present in the same response, so the failing row is present-and-false rather than dropped by a projection. A deliberate exception — a configuration governing archived or documentation-only repositories — fails this clause correctly: that is a finding wanting a written justification, not a defect in the check."} - {"field":"configuration-repositories[?status=='failed']","op":"count_eq","value":0,"controls":["sa-11"],"description":"No repository the configuration was applied to failed to receive it. `failed` is the status that produces silence rather than an error: the repository is attached in intent, is analysed by nothing, and contributes no analysis and no alert — so the organization's alert list is partly clean BECAUSE of it. The call passes no `status` filter, whose documented default is `all`, so the failing row is present-and-false rather than absent. It speaks only for the configurations actually walked; see the iteration note in `expected_output`."} - {"field":"default-setup.state","op":"eq","value":"configured","controls":["sa-11"],"description":"This repository has code scanning default setup configured, read from the repository itself rather than inferred from a configuration that claims to govern it. The clause exists because the three above are all organization-scoped and none of them binds the repository an alert came from; this is the first of three statements in the recipe made about a named repository, and it is the reason commands 3 and 4 are run per repository. `not-configured` here on a repository the boundary inventory names is the finding the whole recipe is built to surface."} - {"field":"default-setup.schedule","op":"eq","value":"weekly","controls":["sa-11"],"description":"The recurring scan for this repository is still scheduled. This is the clause that makes the freshness clause below mean what it says, and it exists because GitHub documents the schedule switching ITSELF off: \"If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes.\" `schedule` is documented `weekly | null`, so a quiet boundary repository reports `configured`, has a real analysis history, and is no longer being analysed at all — a state the previous clause passes and this one catches. A provider whose organization enabled monthly scans of inactive repositories will fail this clause while behaving correctly; that is a finding wanting one sentence of context, and it is a better failure than the silence it replaces."} - {"field":"analyses[0].rules_count","op":"gt","value":0,"controls":["sa-11"],"description":"The most recent analysis ran with at least one rule in it. This catches the pathological run that every other clause here reports as healthy: a configured, scheduled repository whose CodeQL run completed with an empty or failed query pack produces an analysis record, a `created_at` that satisfies any freshness clause, `results_count` of zero, and no alerts. `rules_count` is what separates that from a clean scan. `error` and `warning` are collected on the same object and are worth reading beside it; they are not asserted because their empty forms are not documented. This clause counts rules and says nothing about WHICH rules — the limb SA-11 calls depth and coverage is the one `scan_scope` sends outside the platform."} - {"field":"analyses[0].created_at","op":"max_age_days","value":7,"controls":["sa-11"],"description":"This repository's most recent CodeQL analysis on the default branch is no more than seven days old. Seven comes from the platform's own `schedule` field asserted two clauses above — the recurring scan for default setup is `weekly` — and NOT from the once-a-week sentence in the workflow documentation, which is scoped to the default analysis workflow that advanced setup installs and which a default-setup repository has no copy of. Given the schedule clause is green, a wider gap means the scheduled run did not happen. It depends on two documented behaviours of the endpoint (`sort` accepts only `created`, `direction` defaults to `desc`) and on the command's `tool_name` and `ref` narrowings; on a repository with more than one analysed language it must be read per `category`, because `analyses[0]` is otherwise whichever language finished last. This is the clause that makes the alert clauses readable: an empty alert list from a repository whose last analysis is nine months old is not evidence of anything."} - {"field":"alerts-dismissed[?dismissed_comment==`null`]","op":"count_eq","value":0,"controls":["sa-11"],"description":"No alert was dismissed without a written justification. `dismissed_comment` is where a human says why, is nullable and is capped at 280 characters; the literal-null comparison catches both an explicit null and an absent key, so the failing row is present-and-false rather than dropped. SA-11's flaw-remediation limb asks for a process that can be verified, and a dismissal carrying only a dropdown value is where that record stops being verifiable — `dismissed_reason`'s documented enum includes `null`, so even the dropdown is not guaranteed to be there. This clause deliberately does NOT assert that dismissals are absent or rare — dismissing a true finding with a stated reason is the process working — and it does not, and cannot, check whether the sentence is any good. It reads the organization-scoped list, so filter to the boundary inventory first; see `scan_scope`."} ## Outside the boundary Platform: GitHub Enterprise Cloud Collecting this evidence puts the code-hosting and analysis platform inside the assessment rather than beside it: the repositories, the analysis runs and the alert store are held and operated by a third party, so the platform is an information resource whose potential impact has to be addressed under SA-09 and CA-03 and accounted for in the external-system inventory AC-20 already covers. This control is the one where that consequence is most easily missed, because SA-11 is about the developer's own testing and it feels internal — the testing is internal and the record of it is not. SA-11 sits in the class c and class d baselines, so every reader of this recipe is running a Moderate or High system, and the impact level a platform's Marketplace listing carries is not necessarily the one those systems need; that is the SA-09 question, it is answered by reading the cited listing rather than by this sentence, and no value for it is written here because it is a dated fact that changes. Note what is being handed over here as well: this is not metadata about builds but the source code itself and a list of its unfixed weaknesses. Which offering is in use decides the rest — GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency and github.com are different deployments on different infrastructure — and this recipe was authored against GitHub Enterprise Cloud. ## Notes SA-11 has five limbs and this recipe reaches parts of three. The developer's security and privacy assessment plan and the depth-and-coverage determination that plan is required to state are documents; a 3PAO reads them there. What the platform contributes is that testing RAN, with a named ruleset and a live schedule, over a named set of repositories and languages, and what it found — the evidence-of-execution limb — plus the disposition of each finding, which is the flaw-correction limb seen from one side, plus one testable property of the remediation record itself: that each closure carries a written justification, which is the verifiability limb the dismissal clause is grounded in. The judgement that a flaw was corrected rather than argued away is not in this output and no amount of extra collection puts it there. That is what the disposition this recipe spends already said, and writing the commands down has not changed it. WHAT AN EMPTY ALERT LIST IS CONSISTENT WITH, ON THIS CONTROL SPECIFICALLY. Five worlds, and only one is a pass: nothing was found; nothing was scanned; scanning is off; scanning was on and the schedule has since been disabled for inactivity; or one repository out of forty was scanned. The first six assertions exist to separate them and they are ordered deliberately — configuration intent, ownership, attachment success, repository state, schedule liveness, then rule count and freshness — because each is necessary for the next to mean anything. There is a sixth world hidden by a present, plausible-looking field: default setup analyses a SELECTED LIST of languages, and a repository can be `configured`, scheduled, fresh, rule-carrying, and completely silent about the service that carries the risk because that language was never selected. `languages` is returned by the third command, so the fact is collected; it is not asserted, because the list it must be compared against — the languages the boundary's code is written in — is not in any response here. `scan_scope` names that comparison. WHY THERE IS NO SEVERITY THRESHOLD CLAUSE. It would be easy to add "no open alert at critical severity" and it would be the wrong control. SA-11 is about the developer performing testing and producing evidence of it, not about the estate being free of findings. The clock on how fast a detected finding must be dealt with is the dataset's own VER-TFR-EVU requirement — evaluate ALL vulnerabilities within a stated number of days of detection — which is a different measurement with a different per-class value, and a recipe that quietly turned SA-11 into a zero-criticals gate would report an authorization failure for a provider testing exactly as this control requires and holding a legitimately open medium. A CADENCE GAP THAT BELONGS TO THE PLATFORM RATHER THAN TO THE PROVIDER, AND WHICH THE SEVEN-DAY CLAUSE DOES NOT CLOSE. The freshness clause enforces seven days because that is what `schedule: weekly` means. KSI-SCR-MIT's own class-c floor is the VDR-TFR-MVX MUST — verify and validate the status of machine-based information resources at least once every three days — which is tighter than the schedule this platform runs on default setup, and SA-11 is a class c and class d control, so this affects every reader of it. On an actively developed repository the gap closes by itself, because default setup also scans on pushes and pull requests; on a boundary repository that is quiet, the weekly schedule is the only thing running and it does not meet the indicator's clock. For class d the binding MUST is looser rather than tighter — read it off `classClocks[].tightestMust` rather than off the tightest clock, which is a SHOULD — so the gap is a class-c fact, not a monotonic one. A provider needing to close it moves to advanced setup and its own schedule, which is a different recipe against a different endpoint. HOW SEVERITY IS DERIVED, SINCE ASSESSMENTS TREAT IT AS AN OBSERVATION. GitHub documents that every code scanning alert carries a level of Error, Warning or Note, that CodeQL security alerts additionally carry Critical, High, Medium or Low, and that those levels "follow the industry-standard Common Vulnerability Scoring System (CVSS)" — derived by taking the 75th-percentile CVSS score of CVEs whose CWE tags relate to the query. So `security_severity_level` is a statistical property of a class of vulnerability, not a measurement of this instance in this codebase. It is a good prioritisation signal and it is not a risk determination for the system under assessment. WHAT `dismissed_reason` ADMITS, AND THE ONE VALUE THAT IS A CLAIM RATHER THAN AN OBSERVATION. The documented values are `false positive`, `won't fix`, `used in tests`, `mitigated` and `null`. Three of the four strings describe the finding; `mitigated` describes the code, and nothing in the platform verifies it — a person selected it. `won't fix` is the value an assessment should read against the provider's own risk-acceptance procedure rather than against this recipe. Where `code_scanning_delegated_alert_dismissal` is `enabled` on the governing configuration, dismissals go behind a reviewer instead of being unilateral; that field is collected by the first command and is deliberately not asserted, because the control does not require delegated dismissal and a provider without it can still hold a verifiable remediation record. THE DEFAULT-BRANCH PICTURE. GitHub states that an alert's status "only reflect[s] the state of the alert on the default branch of the repository, even if the alert exists in other branches", and the organization-scoped alerts endpoint accepts no `ref` filter at all. So this evidence is a statement about the default branch of each repository, which is also why the analyses command pins `ref` to it. For a provider that releases from the default branch that is the right population; for one that maintains long-lived release branches, the branch that is actually deployed may be carrying findings this recipe cannot see, and the repository-scoped alerts endpoint with `ref` is where that gap is closed. ONE THING THE DOCUMENTATION DOES NOT SAY, RECORDED AS A GAP RATHER THAN FILLED IN. The reference page for alerts does not define what makes an alert `fixed` rather than `dismissed`, or what happens to an open alert when the code stops being scanned, and this recipe makes no claim about either. An alert disappearing from `alerts-open` is therefore not by itself evidence that a flaw was corrected — the same limb the dismissal clause is careful about, arriving from the other direction. KSI-SCR-MIT is claimed because it is the ONLY in-scope indicator the dataset maps onto SA-11 — the claim is forced by an upstream mapping rather than chosen, and it is worth saying so plainly, because the fit is imperfect. The indicator asks that supply chain RISKS be persistently identified, reviewed and mitigated, and CodeQL default setup analyses the provider's own source: a first-party injection sink is a software weakness rather than a supply chain risk. What transfers cleanly are the verbs — a recurring analysis is identification and the dismissal record is review — and the noun does not. Mitigation is outside this plane in any case: whether the code changed is a fact about a commit, not about an alert list, and the `fixed` state is not documented well enough here to carry it. ## References - {"title":"GitHub REST: code scanning — GET /orgs/{org}/code-scanning/alerts (filters tool_name, tool_guid, state open | closed | dismissed | fixed, severity critical | high | medium | low | warning | note | error, sort created | updated, direction, assignees; no ref filter at organization scope), GET /repos/{owner}/{repo}/code-scanning/alerts (adds ref and pr), GET /repos/{owner}/{repo}/code-scanning/analyses (filters tool_name, tool_guid, ref, sarif_id, pr; sort created only, direction desc by default) returning ref, commit_sha, analysis_key, environment, category, error, created_at, results_count, rules_count, id, url, sarif_id, tool, deletable, warning; GET /repos/{owner}/{repo}/code-scanning/default-setup returning state configured | not-configured, languages, runner_type standard | labeled | null, runner_label, query_suite default | extended, threat_model remote | remote_and_local, updated_at, schedule weekly | null; alert rule sub-object id, name, severity none | note | warning | error, security_severity_level low | medium | high | critical, description, full_description, tags declared \"array of string or null\", help, help_uri, and dismissed_reason false positive | won't fix | used in tests | mitigated | null with dismissed_by, dismissed_at and dismissed_comment (nullable, max 280 characters); alerts and analyses need the security_events scope, default setup needs repo","url":"https://docs.github.com/en/rest/code-scanning/code-scanning"} - {"title":"GitHub REST: code security configurations — code_scanning_default_setup and code_scanning_delegated_alert_dismissal each documented as enabled | disabled | not_set, code_scanning_default_setup_options carrying runner_type standard | labeled | not_set and runner_label; the response `target_type` is global | organization | enterprise while the LIST endpoint's own target_type parameter is documented \"Default: all\"; the repositories endpoint takes \"A comma-separated list of statuses. If specified, only repositories with these attachment statuses will be returned. Can be: all, attached, attaching, detached, removed, enforced, failed, updating, removed_by_enterprise. Default: `all`\"; both organization endpoints need read:org and an organization administrator or security manager","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: configuring default setup for code scanning — the schedule this recipe's freshness clause rests on, and the documented reason it stops: \"If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes\", and \"Organization owners can enable monthly scans of inactive repositories\"","url":"https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"} - {"title":"GitHub: about code scanning alerts — \"All code scanning alerts have a level of Error, Warning, or Note\"; \"Each security alert found using CodeQL also has a security severity level of Critical, High, Medium, or Low\"; those levels \"follow the industry-standard Common Vulnerability Scoring System (CVSS)\", derived by taking the 75th-percentile CVSS score of CVEs carrying related CWE tags; and \"The status and details on the alert page only reflect the state of the alert on the default branch of the repository, even if the alert exists in other branches\"","url":"https://docs.github.com/en/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts"} - {"title":"GitHub: code scanning workflow configuration options — \"The default threat model includes remote sources of untrusted data\", extended to local sources \"(for example: command-line arguments, environment variables, file systems, and databases) by specifying threat-models: local\"; the feature is \"currently in public preview and subject to change\" and \"supported only by analysis for Java/Kotlin and C#\"; security-extended is \"Queries from the default suite, plus lower severity and precision queries\" and security-and-quality adds maintainability and reliability queries; \"Use category to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code\"; and the once-a-week sentence, which is scoped to the default analysis WORKFLOW — advanced setup — not to default setup","url":"https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options"} - {"title":"GitHub: CodeQL query suites — the queries in the default suite \"are highly precise and return few false positive code scanning results\"; security-extended \"consists of all the queries in the default query suite, plus additional queries with slightly lower precision and severity\" and \"may return a greater number of false positive code scanning results\"; both are available to default setup and a custom suite requires advanced setup","url":"https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-query-suites"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems SA-11 applies to; a certification status is a dated fact about a product, and this recipe hands that product the source code itself","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/input-validation-taint-analysis-coverage # Which taint-tracking ruleset actually ran over this repository — the query suite, the languages selected, and the threat model that decides what counts as an untrusted source — together with whether the recurring scan is still scheduled, when it last ran per analysed language, and how many rules were in the run; and then the open findings in the injection families SI-10 is about, identified by the CWE tags the queries carry. The ruleset and the freshness are the load-bearing half: a finding names a sink that exists, but only the run record says the absence of findings means anything at all. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/input-validation-taint-analysis-coverage Recipe id: `input-validation-taint-analysis-coverage` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-MAT` - control `si-10` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?status=attached,enforced&per_page=100" # default-setup gh api "/repos///code-scanning/default-setup" # analyses gh api --paginate "/repos///code-scanning/analyses?tool_name=CodeQL&ref=refs/heads/&per_page=100" # alerts-open gh api --paginate "/orgs//code-scanning/alerts?state=open&tool_name=CodeQL&per_page=100" # analysis-sarif gh api -H "Accept: application/sarif+json" "/repos///code-scanning/analyses/" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first, `configuration-repositories` the second, `default-setup` the third, `analyses` the fourth, `alerts-open` the fifth, and the sixth returns SARIF rather than a report this recipe asserts on. RUN COMMANDS 3, 4 AND 6 ONCE PER REPOSITORY. Neither default setup nor analyses has an organization-scoped endpoint; the alerts endpoint does, and it returns the owning `repository` on each alert, so the findings arrive in one list while the run record is assembled one repository at a time. AND READ THE TWO RUN-RECORD CLAUSES ONCE PER ANALYSED LANGUAGE, not once per repository. GitHub documents `category` as what distinguishes "multiple analyses for the same tool and commit, but performed on different languages or different parts of the code", and the endpoint has NO `category` filter — its filters are `tool_name`, `tool_guid`, `pr`, `ref` and `sarif_id`. So on a Java-plus-JavaScript repository the newest row is whichever language finished last, and a clause reading position zero of the unfiltered list can be satisfied by a run that says nothing about the language carrying the risk. The command pins `ref` to the default branch for the same class of reason — without it a `refs/pull/N/merge` analysis can be the newest row — and `` in the two clauses below is a placeholder the collector fills once per entry in `default-setup.languages`. The exact category string default setup emits per language is NOT documented and was not verified; read it off the `category` field of the response rather than constructing it. From `default-setup`, the fields this recipe exists to read — `query_suite` (`default | extended`), `threat_model` (`remote | remote_and_local`) and `languages` (from `actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift`) — plus `state` (`configured | not-configured`), `updated_at` and `schedule` (`weekly | null`). From `analyses`, `created_at`, `rules_count`, `results_count`, `category`, `commit_sha`, `ref`, `error`, `warning` and the `tool` object; `sort` accepts only `created` and `direction` defaults to `desc`, so the first row of any category-filtered projection is that category's newest run. From `alerts-open`, alerts whose `rule` object carries `tags` — the field the CWE clause below reads. CodeQL query metadata puts CWE classification in that array in the form `external/cwe/cwe-089`, verified on three query help pages: `js/sql-injection` carries `security`, `external/cwe/cwe-089`, `external/cwe/cwe-090` and `external/cwe/cwe-943`; `js/command-line-injection` carries `correctness`, `security`, `external/cwe/cwe-078` and `external/cwe/cwe-088`; `js/reflected-xss` carries `security`, `external/cwe/cwe-079` and `external/cwe/cwe-116`. Two things about that array decide how the clause below is written. `tags` is documented as "array of string or null", and a null array is the case a `contains()` filter cannot state an opinion about — so a separate clause counts the rows that have no array at all, rather than letting them pass silently. And the alerts endpoint has NO server-side tag filter — its filters are `tool_name`, `tool_guid`, `state`, `severity`, `sort`, `direction` and `assignees` — so the CWE narrowing is a client-side filter over a FULL page walk, and a collector that fetches one page of thirty and filters it has produced a smaller answer rather than a filtered one. The command passes `tool_name=CodeQL` so the list holds only rows from the analyses the run-record clauses measure. The sixth command returns the run's SARIF, whose `runs[].tool.driver.rules[]` is the closest thing available to a list of the queries that actually executed. GitHub documents the response as "a subset of the analysis data that was uploaded", which is why nothing below asserts on it: it is collected so a human can read which rules were present, and a subset is not a population. ## Assertions - {"field":"default-setup.state","op":"eq","value":"configured","controls":["si-10"],"description":"This repository has code scanning configured, read from the repository rather than from an organization configuration that claims to govern it. First clause because it is the precondition for every other statement here: on `not-configured` the analyses list is empty, the alert clause is vacuously green, and the recipe has measured nothing."} - {"field":"default-setup.languages[?@==''] | [0]","op":"exists","controls":["si-10"],"description":"The language this part of the boundary's code is written in is among those default setup selected. Read once per language on the provider's own list of implementation languages, which is external to every response here — that list is the whole point, because `languages` is a SELECTION and a repository whose Go service was never selected is `configured`, scheduled, fresh, rule-carrying and completely silent about that service. This is the one limb of SI-10's coverage question that is writable at all, and it is writable only because the comparison value comes from outside; nothing in this output would reveal the omission."} - {"field":"default-setup.schedule","op":"eq","value":"weekly","controls":["si-10"],"description":"The recurring scan for this repository is still scheduled. GitHub documents the schedule switching itself off — \"If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes\" — and `schedule` is documented `weekly | null`, so a quiet boundary repository reports `configured`, has a real analysis history, and is no longer being analysed. This clause is what entitles the freshness clause below to treat a gap as a failure rather than as a repository nobody pushed to. An organization that enabled monthly scans of inactive repositories fails it while behaving correctly, which is a finding wanting one sentence rather than a defect."} - {"field":"analyses[?category==''] | [0].rules_count","op":"gt","value":0,"controls":["si-10"],"description":"The most recent analysis FOR THIS LANGUAGE ran with at least one rule in it. The category filter is load-bearing rather than tidy: without it this reads position zero of a list that mixes languages, and a green result can come from a run that never touched the code in question. It catches the pathological run — a configured repository whose analysis completed with an empty or failed query pack produces an analysis record, a satisfying `created_at`, `results_count` of zero, and no alerts. `rules_count` is what distinguishes that from a clean scan; `error` and `warning` sit on the same object and are worth reading beside it, and are unasserted because their empty forms are not documented. It counts rules and says nothing about WHICH rules — see the note on why the CWE-family coverage limb is not assertable."} - {"field":"analyses[?category==''] | [0].created_at","op":"max_age_days","value":7,"controls":["si-10"],"description":"The most recent CodeQL analysis for this language on the default branch is no more than seven days old. Seven comes from the `schedule: weekly` field asserted above, not from the once-a-week sentence in the workflow documentation — that sentence is scoped to the default analysis workflow which advanced setup installs and a default-setup repository has no copy of. With the schedule clause green, a wider gap means the scheduled run did not happen. Read the note on cadence before treating seven as sufficient: the indicator's own class-c MUST is shorter than the schedule this clause enforces."} - {"field":"alerts-open[?rule.tags==`null`]","op":"count_eq","value":0,"controls":["si-10"],"description":"Every open alert carries the tag array the CWE clause below reads. This is a guard, not a finding about the code: `tags` is documented \"array of string or null\", and a `contains()` filter over a null array is the one case that cannot be answered — depending on the evaluator it either raises or quietly drops the row, and in an offender-form `count_eq 0` clause dropping it makes the result GREENER. So the rows with no array are counted here instead of being exempted there. The command's `tool_name=CodeQL` narrowing already removes the likeliest source of untagged rows, third-party SARIF uploaded into the same store; this clause is what makes that a checked fact rather than an assumption."} - {"field":"alerts-open[?contains(rule.tags,'external/cwe/cwe-089') || contains(rule.tags,'external/cwe/cwe-078') || contains(rule.tags,'external/cwe/cwe-079')]","op":"count_eq","value":0,"controls":["si-10"],"description":"No open alert names a sink in the three injection families verified for this recipe — SQL and NoSQL injection (CWE-089), OS command injection (CWE-078) and reflected cross-site scripting (CWE-079). Offender form over a list built to hold offenders, so it reports the rows that fail rather than projecting over the rows that already pass, and it is readable only once the guard above has established that every row has a tag array to search. Two limits are its meaning rather than caveats beside it: the family list is a verified SUBSET of what SI-10 covers rather than a definition of it, and a green result is a statement about paths the ruleset models from sources it treats as untrusted, not about the provider's own list of information inputs."} ## Outside the boundary Platform: GitHub Enterprise Cloud The analysis engine, the ruleset it ran and the findings it produced are all held and operated by a third party, so reading them brings the platform into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. The dependency is sharper here than on most recipes because the EVIDENCE ITSELF is a property of someone else's ruleset: what counts as an unvalidated input is decided by queries the provider does not write, version, or necessarily see, and a query pack update can change what a clean result means without anything in the provider's system changing. SI-10 is a class c and class d control, so every reader is running a Moderate or High system, and the impact level a platform's Marketplace listing carries is not necessarily the one those systems need — that is the SA-09 question, it is answered by reading the cited listing, and no value for it is written here because it is a dated fact that changes. This recipe was authored against GitHub Enterprise Cloud; github.com and the data-residency offering are different deployments on different infrastructure. ## Notes SI-10 asks the provider to check the validity of organization-defined information inputs, and the defining is the half no scanner does. Taint-tracking analysis is genuine telemetry about the other half — a path from a source the ruleset models to a sink it knows is exactly what an input-validation failure looks like in code — but a clean result says "no sink the ruleset knows about, reachable from a source it models" and the control says "the inputs we defined are checked". Those are different sentences, and `scan_scope` names the second list because nothing in this output contains it. THE THREAT MODEL IS THE SHARPEST TRAP ON THIS CONTROL AND IT LOOKS LIKE A SOLVED PROBLEM. `threat_model` is a field in the response with a value of `remote` or `remote_and_local`, so it reads like a setting a provider can simply turn up. GitHub documents that "The default threat model includes remote sources of untrusted data" and that extending it to local sources — "command-line arguments, environment variables, file systems, and databases" — is "currently in public preview and subject to change" and "supported only by analysis for Java/Kotlin and C#". Two consequences follow, and both are findings rather than caveats. On a codebase in any other language, there is no local-source configuration to make: a CLI argument, an environment variable or a row read back out of the database is NOT in the model the scan used, and SI-10's information inputs frequently include exactly those. And where the language does support it, the capability is in public preview, which is a poor foundation for a control statement in a Moderate or High system. Nothing below asserts `remote_and_local`, deliberately — asserting it would fail every provider whose language cannot express it, while implying the ones that can have covered local inputs. WHY THE RULESET-COVERAGE LIMB IS COLLECTED AND NOT ASSERTED, AND WHY THAT IS WHAT KEEPS THIS RECIPE `partial`. The clause an assessment actually wants is "a query for this CWE family was in the run", because that is what makes an empty finding list meaningful. It is not writable from the documented API. `rule.tags` exists only on alerts that exist, so the CWE tags are visible precisely when something was found and invisible in the case where the claim matters. `rules_count` counts rules without naming them. The SARIF response is the closest available and GitHub documents it as "a subset of the analysis data that was uploaded" — a subset cannot establish the absence of a rule, and a recipe that asserted over it would be reading an unspecified sample as a population. What IS writable, and is now asserted, is the coarser half of the same question: that the language was selected at all. The residue — which QUERIES ran within that language — is what keeps this `partial`, and the residue is a property of the documented API rather than of this batch's effort. Two things could close it and neither is in scope here: a documented endpoint listing a run's rules, or the published per-language suite membership read against `query_suite`, which is an inference the cited pages do not license. WHAT THE QUERY SUITE CHANGES ABOUT THE WORD "CLEAN". GitHub documents the `default` suite as "highly precise" with "few false positive" results, and `security-extended` as "all the queries in the default query suite, plus additional queries with slightly lower precision and severity" that "may return a greater number of false positive code scanning results". So a clean result under `default` is a weaker statement than a clean result under `extended` — fewer queries asked fewer questions — and a provider that switched to `extended` and now has open alerts has not regressed. The value is collected and not asserted because SI-10 names no suite; treating `extended` as a requirement would be authoring a preference as a control. A CADENCE GAP WORTH STATING PLAINLY, BECAUSE IT IS THE PLATFORM FAILING THE INDICATOR RATHER THAN THE PROVIDER. The freshness clause enforces seven days because that is what `schedule: weekly` means. KSI-CNA-MAT's own class-c floor is the VDR-TFR-MVX MUST — verify and validate the status of machine-based information resources at least once every three days — which is tighter, and SI-10 is a class c and class d control, so this reaches every reader. On an actively developed repository the gap closes by itself, because default setup also scans on pushes and pull requests; on a boundary repository that is quiet, the weekly schedule is the only thing running and the schedule clause is the only reason its silence is visible at all. For class d the binding MUST is LOOSER rather than tighter — read it off `classClocks[].tightestMust`, because the tightest class-d clock is a SHOULD — so this is a class-c fact and not a monotonic one. A provider needing to close it moves to advanced setup and its own schedule, which is a different recipe against a different endpoint. The default-branch limit applies here as it does to the sibling recipe on this platform: alert status reflects the default branch, the organization-scoped alerts endpoint takes no `ref` filter, and the analyses command pins `ref` to the default branch for the same reason. This is a default-branch statement about a repository, not a repository-wide one. KSI-PIY-RSD also reaches this control and is deliberately NOT claimed. That indicator asks whether the effectiveness of building security into the SDLC is persistently reviewed, and a scan record is an input to such a review rather than the review itself — the same reason the secret-scanning recipe declined the rotation limb of its adjacent indicator. KSI-CNA-MAT is claimed because an injection sink reachable from untrusted input is attack surface in the indicator's own terms — the dataset's own glossary counts code among machine-based information resources — and a recurring analysis over a named repository set is the persistent review it asks for. ## References - {"title":"GitHub REST: code scanning — GET /orgs/{org}/code-scanning/alerts (filters tool_name, tool_guid, state open | closed | dismissed | fixed, severity critical | high | medium | low | warning | note | error, sort created | updated, direction, assignees; no ref filter at organization scope), GET /repos/{owner}/{repo}/code-scanning/alerts (adds ref and pr), GET /repos/{owner}/{repo}/code-scanning/analyses (filters tool_name, tool_guid, ref, sarif_id, pr; sort created only, direction desc by default) returning ref, commit_sha, analysis_key, environment, category, error, created_at, results_count, rules_count, id, url, sarif_id, tool, deletable, warning; GET /repos/{owner}/{repo}/code-scanning/default-setup returning state configured | not-configured, languages, runner_type standard | labeled | null, runner_label, query_suite default | extended, threat_model remote | remote_and_local, updated_at, schedule weekly | null; alert rule sub-object id, name, severity none | note | warning | error, security_severity_level low | medium | high | critical, description, full_description, tags declared \"array of string or null\", help, help_uri, and dismissed_reason false positive | won't fix | used in tests | mitigated | null with dismissed_by, dismissed_at and dismissed_comment (nullable, max 280 characters); alerts and analyses need the security_events scope, default setup needs repo","url":"https://docs.github.com/en/rest/code-scanning/code-scanning"} - {"title":"GitHub REST: code security configurations — code_scanning_default_setup and code_scanning_delegated_alert_dismissal each documented as enabled | disabled | not_set, code_scanning_default_setup_options carrying runner_type standard | labeled | not_set and runner_label; the response `target_type` is global | organization | enterprise while the LIST endpoint's own target_type parameter is documented \"Default: all\"; the repositories endpoint takes \"A comma-separated list of statuses. If specified, only repositories with these attachment statuses will be returned. Can be: all, attached, attaching, detached, removed, enforced, failed, updating, removed_by_enterprise. Default: `all`\"; both organization endpoints need read:org and an organization administrator or security manager","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: configuring default setup for code scanning — the schedule this recipe's freshness clause rests on, and the documented reason it stops: \"If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes\", and \"Organization owners can enable monthly scans of inactive repositories\"","url":"https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"} - {"title":"GitHub: code scanning workflow configuration options — \"The default threat model includes remote sources of untrusted data\", extended to local sources \"(for example: command-line arguments, environment variables, file systems, and databases) by specifying threat-models: local\"; the feature is \"currently in public preview and subject to change\" and \"supported only by analysis for Java/Kotlin and C#\"; security-extended is \"Queries from the default suite, plus lower severity and precision queries\" and security-and-quality adds maintainability and reliability queries; \"Use category to distinguish between multiple analyses for the same tool and commit, but performed on different languages or different parts of the code\"; and the once-a-week sentence, which is scoped to the default analysis WORKFLOW — advanced setup — not to default setup","url":"https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options"} - {"title":"GitHub: editing your configuration of default setup — \"(Public preview) Optionally, in the 'Threat model' row of the 'Scan settings' section, select Remote and local sources. This option is only available for repositories with code in a supported language: Java/Kotlin and C#\", and the query suite is chosen in the same Scan settings section","url":"https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/edit-default-setup"} - {"title":"GitHub: CodeQL query suites — the queries in the default suite \"are highly precise and return few false positive code scanning results\"; security-extended \"consists of all the queries in the default query suite, plus additional queries with slightly lower precision and severity\" and \"may return a greater number of false positive code scanning results\"; both are available to default setup and a custom suite requires advanced setup","url":"https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-query-suites"} - {"title":"CodeQL: metadata for CodeQL queries — @tags carries the query's categories, @precision \"Indicates the percentage of query results that are true positives\" with values low | medium | high | very-high, @problem.severity \"Defines the level of severity of any alerts generated by a non-security query\", and @security-severity \"Defines the level of severity, between 0.0 and 10.0, for queries with @tags security\"","url":"https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/"} - {"title":"CodeQL query help: js/sql-injection — CWE-089, CWE-090 and CWE-943, carrying the tags security, external/cwe/cwe-089, external/cwe/cwe-090 and external/cwe/cwe-943; a database query \"built from user-provided data without sufficient sanitization\"","url":"https://codeql.github.com/codeql-query-help/javascript/js-sql-injection/"} - {"title":"CodeQL query help: js/command-line-injection — CWE-078 and CWE-088, carrying the tags correctness, security, external/cwe/cwe-078 and external/cwe/cwe-088; \"Code that passes untrusted user input directly to child_process.exec or similar APIs that execute shell commands\"","url":"https://codeql.github.com/codeql-query-help/javascript/js-command-line-injection/"} - {"title":"CodeQL query help: js/reflected-xss — CWE-079 and CWE-116, carrying the tags security, external/cwe/cwe-079 and external/cwe/cwe-116; \"Directly writing user input (for example, an HTTP request parameter) to an HTTP response without properly sanitizing the input first\"","url":"https://codeql.github.com/codeql-query-help/javascript/js-reflected-xss/"} - {"title":"GitHub REST: get a code scanning analysis — supports the application/sarif+json custom media type, which returns \"a subset of the analysis data that was uploaded\" formatted as SARIF 2.1.0 plus github/alertNumber and github/alertUrl; the default media type returns the analysis summary rather than the SARIF payload","url":"https://docs.github.com/en/rest/code-scanning/code-scanning#get-a-code-scanning-analysis-for-a-repository"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems SI-10 applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/change-verification-status-checks-and-run-records # For every change that reached the assessed branch, the automated verification that ran against it — which workflows ran, on which commit, and what each concluded — together with the two things that decide whether those runs were a condition of the change or merely adjacent to it: the rule that made the checks required, and the platform's own per-push record of whether that rule held, failed, or was bypassed. The runs alone are activity; the rule and the per-push record are what make them a gate. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/change-verification-status-checks-and-run-records Recipe id: `change-verification-status-checks-and-run-records` · cadence weekly · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-VTD` - KSI `KSI-CMT-LMC` - control `cm-4.2` ## Collection Kind: `api` ```sh # repos gh api --paginate "/orgs//repos?per_page=100" # branch-rules gh api "/repos///rules/branches/" # rulesets gh api --paginate "/repos///rulesets?includes_parents=true&per_page=100" # rule-suites gh api --paginate "/repos///rulesets/rule-suites?ref=refs/heads/&time_period=month&evaluate_status=active&per_page=100" # runs-completed gh api --paginate "/repos///actions/runs?branch=&status=completed&per_page=100" # runs-failure gh api --paginate "/repos///actions/runs?branch=&status=failure&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `repos` is the first command, `branch-rules` the second, `rulesets` the third, `rule-suites` the fourth, `runs-completed` the fifth, `runs-failure` the sixth. RUN COMMANDS 2 THROUGH 6 ONCE PER REPOSITORY AND ONCE PER ASSESSED BRANCH, not once for the organization. The first command returns the repository list and the rest take a single `` and a single ``; every clause below speaks only for the repository and branch actually walked, and collecting one repository's rules and reading them as the organization's is the arithmetic error this recipe is most likely to be assessed with. From `branch-rules`, an array of the repository rule objects IN EFFECT on that branch, each carrying a `type` drawn from `creation`, `update`, `deletion`, `required_linear_history`, `required_deployments`, `required_signatures`, `pull_request`, `required_status_checks`, `non_fast_forward`, `commit_message_pattern`, `commit_author_email_pattern`, `committer_email_pattern`, `branch_name_pattern`, `tag_name_pattern`, `file_path_restriction`, `max_file_path_length`, `file_extension_restriction`, `max_file_size`, `workflows`, `code_scanning` and `copilot_code_review`, and a `parameters` object whose shape depends on the type. For `required_status_checks` the parameters are a `required_status_checks` array of `{context, integration_id}` entries, `strict_required_status_checks_policy` and `do_not_enforce_on_create`. From `rulesets`, the rulesets that apply to the repository — `includes_parents` defaults to TRUE, so organization and enterprise rulesets are included and `source_type` (`Repository`, `Organization`, `Enterprise`) says which is which. Each carries `id`, `name`, a `target` of `branch`, `tag`, `push` or `repository`, an `enforcement` of `disabled`, `active` or `evaluate`, `bypass_actors` entries with an `actor_type` of `Integration`, `OrganizationAdmin`, `RepositoryRole`, `Team`, `DeployKey` or `User` and a `bypass_mode` of `always`, `pull_request` or `exempt`, plus `current_user_can_bypass`, `created_at` and `updated_at`. From `rule-suites`, one record per push evaluated against the rules: `id`, `actor_id`, `actor_name`, `before_sha`, `after_sha`, `ref`, `repository_id`, `repository_name`, `pushed_at`, a `result` of `pass`, `fail` or `bypass`, and an `evaluation_result`. The per-suite endpoint adds `rule_evaluations`, each with a `rule_source`, a `rule_type`, a `result` and an `enforcement` of `active`, `evaluate` or `deleted ruleset` — worth fetching for any suite this recipe's clauses flag, because it is the only place that says WHICH rule decided. `time_period` accepts `hour`, `day`, `week` and `month` and defaults to `day`; the command above passes `month`, which is the documented ceiling, and `evaluate_status=active`, documented as returning "only rule suites resulting from rulesets in active (non-evaluate) mode" — without it the response mixes pushes measured against enforcing rulesets with pushes measured against dry-run ones, and nothing on the page describes what `result` holds for the second kind. From `runs-completed` and `runs-failure`, workflow runs with `id`, `name`, `head_branch`, `head_sha`, `path`, `run_number`, `run_attempt`, `event`, `status`, a `conclusion` — documented on the workflow-runs page as a string or null and NOT as an enum, so treat `success`, `failure`, `neutral`, `cancelled`, `skipped`, `timed_out` and `action_required` as the values to expect rather than as a closed set this citation establishes — `workflow_id`, `created_at`, `updated_at`, `run_started_at`, `triggering_actor`, `head_commit` and `referenced_workflows`. `failure` is a value of the `status` FILTER as well as of `conclusion`, so the sixth command returns a list built to hold only failing runs. ## Assertions - {"field":"branch-rules[?type=='required_status_checks'] | [0]","op":"exists","controls":["cm-4.2"],"description":"A required-status-checks rule is in effect on the assessed branch — GitHub's own words for it are that such checks \"ensure that all required CI tests are passing before collaborators can make changes to a branch\". Read from `/rules/branches/{branch}`, which returns the rules in effect rather than the rulesets that might contain them, so an organization-level ruleset counts here exactly as a repository-level one does. It says a gate is declared; it does not say the gate names any check, which is the next clause, and it does not say the ruleset behind it enforces anything, which is the one after."} - {"field":"branch-rules[?type=='required_status_checks' && !(parameters.required_status_checks)]","op":"count_eq","value":0,"controls":["cm-4.2"],"description":"No required-status-checks rule in effect declares an empty set of checks. This is the clause the one above cannot be trusted without: the rule is present in every listing, reads as a gate in every screenshot, and requires nothing. Written as an offender count over rows present in the same response. THE PARENTHESES ARE LOAD-BEARING and were absent in the first draft of this batch: `!parameters.X` parses as `(!parameters).X`, which evaluates to null, which is falsy, so the unparenthesised clause selects no row on any input and is green by construction. `!(parameters.required_status_checks)` is the form that works, and it catches the empty array and the absent key alike, because both are falsy — where `length()` would raise on the row that has no `parameters` at all."} - {"field":"rulesets[?enforcement=='evaluate' && target=='branch']","op":"count_eq","value":0,"controls":["cm-4.2"],"description":"No BRANCH ruleset applying to this repository is in dry-run mode. This clause is NOT what makes the clauses above trustworthy, and the first draft of this batch claimed it was. The endpoint those clauses read settles it instead: GitHub documents `/rules/branches/{branch}` as returning \"all active rules that apply to the specified branch\" and states that \"Rules in rulesets with \\\"evaluate\\\" or \\\"disabled\\\" enforcement statuses are not returned\" — so a rule that appears there is enforcing, and an evaluating ruleset is invisible to every `exists` clause rather than passing one. What this clause is, then, is a separate finding: a repository operating under a branch ruleset that somebody believes is in force and that blocks nothing. `evaluate` is the status the rule-suites API distinguishes when it offers to return \"only rule suites resulting from rulesets in active (non-evaluate) mode\". Narrowed to `target=='branch'` because the same response carries `tag`, `push` and `repository` rulesets, and a tag ruleset left evaluating has no bearing on the change path this recipe assesses."} - {"field":"rule-suites[?result=='bypass']","op":"count_eq","value":0,"controls":["cm-4.2"],"description":"No change reached the assessed branch in the retrieved window by bypassing the rules that verify it. The list is the platform's own per-push evaluation record, so a bypassed push is present-and-labelled rather than absent — this is the rare clause on this plane whose population is built by the vendor to contain the failure. The command passes `evaluate_status=active`, documented as returning \"only rule suites resulting from rulesets in active (non-evaluate) mode\", so a push measured against a dry-run ruleset is not counted here. Its window is at most a month, because `time_period` tops out there and no retention period is documented for these records at all, and it is green on a repository with no ruleset at all — which is why it is read with the first clause and not alone. Unlike a push-protection bypass, this record carries no reason field, so it cannot be read as a per-event authorized exception; what it can be read against is `bypass_actors` in the `rulesets` response, which is the STANDING authorization, and a provider with a designated break-glass integration will fail this clause while operating as configured."} ## Outside the boundary Platform: GitHub Enterprise Cloud There is no independent observer anywhere in this recipe, and that is a sharper external-system question than the usual one. The rule that makes verification a condition of a change, the evaluation of that rule, and the log of that evaluation are three views held by one party, and the workflow runs the rule points at are executed by the same party on the same infrastructure. A provider's assurance that its changes were verified therefore rests entirely on an outside vendor's account of its own enforcement, which makes the platform an information resource whose potential impact has to be addressed under SA-09 and CA-03 and accounted for in the external-system inventory AC-20 already covers. CM-04 (02) is a class c and class d control, so every reader of this recipe runs a Moderate or High system, and the offering named above is not necessarily the one such a reader can use: the Marketplace listing cited below is the listing for GitHub Enterprise Cloud, and a class c or class d reader has to check it against the class they operate at and look to whichever offering answers it — GitHub Enterprise Cloud for Government is a different product on different infrastructure with its own listing. That is the SA-09 question here. It is answered by reading the listing rather than by this sentence, and no status value is written down, because a certification status is a dated fact that changes. ## Notes CM-04 (02) requires the provider to verify that the IMPACTED CONTROLS are implemented correctly, operating as intended, and producing the desired outcome. This output shows that automated checks ran against each change, that passing them was a condition of the change, and what each concluded. Which controls a change impacts, and whether a passing test verifies one of them, is a mapping from test to control that a human writes; a pipeline that publishes such a mapping is publishing an authored artifact rather than a measurement. The disposition this recipe spends said exactly that, and writing the commands down has not changed the rating. THE DRY-RUN TRAP, AND THE ENDPOINT CHOICE THAT ALREADY CLOSED IT. A ruleset in `evaluate` mode is a complete, well-formed set of rules that enforces nothing, and it is this plane's empty list wearing a different coat: it appears in `/rulesets` intact and generates rule suite records. The first draft of this batch hedged about whether `/rules/branches/{branch}` returns such rules, called it a live risk, and told the reader to make one call against a live repository to settle it. That was a manufactured uncertainty, and the page the recipe already cites settles it in one sentence: the endpoint "Returns all active rules that apply to the specified branch", and "Rules in rulesets with \"evaluate\" or \"disabled\" enforcement statuses are not returned." So reading the rules IN EFFECT rather than the rulesets that contain them is what closes the trap here, and it was closed before any clause was written. The consequence runs both ways and both are worth stating: the first two clauses are stronger than the draft claimed, because a rule they find is enforcing by construction; and the evaluate clause is weaker, because it guards nothing above it. It stays as a finding in its own right — a branch ruleset somebody believes is in force and that blocks nothing — narrowed to `target=='branch'`, since the same response carries tag, push and repository rulesets whose dry-run state says nothing about this change path. A REQUIRED-CHECKS RULE THAT REQUIRES NOTHING. The `required_status_checks` rule takes a `required_status_checks` array of contexts, and an empty one is a rule that is present in every listing, satisfies the first clause, and gates on no check whatsoever. The second clause is spelled `!parameters.required_status_checks` rather than with `length()` deliberately: an empty array and an absent key are both falsy under that spelling and both are genuine offenders, while `length()` raises on the row where `parameters` is missing entirely — which is the row most worth seeing. A rule object that legitimately carries no `parameters` would fail this clause; that is a false red that makes somebody look, which is the direction this repo has chosen every time it has had the choice. WHY THE BYPASS CLAUSE IS ASSERTED HERE AND THE PUSH-PROTECTION ONE WAS NOT. `secret-exposure-detection-and-push-protection` deliberately does not count push-protection bypasses to zero, because a bypass there is a documented decision with a named actor and one of three stated reasons, and a provider with a legitimate test fixture would fail such a clause while behaving correctly. A rule suite bypass has no reason field in anything fetched: the record carries `actor_name`, `result` and the rule evaluations, and nothing that says why. It therefore cannot be read as an authorized exception — all it says is that a change reached the assessed branch without the verification the rule required, which for CM-04 (02) is the finding rather than a footnote. What it CAN be read against, and the first draft of this batch missed this, is `bypass_actors` — returned in the same `rulesets` response this recipe already collects, with a `bypass_mode` of `always`, `pull_request` or `exempt`. That is a standing authorization to bypass, configured and visible, so a provider with a designated break-glass integration fails this clause while operating exactly as configured. The per-event reason is absent; the standing permission is not, and a failure of this clause is read against that list before it is read as a finding. Note one collection caveat that would make any future clause over `bypass_actors` vacuous: GitHub documents that "To prevent leaking sensitive information, the bypass_actors property is only returned if the user making the API request has write access to the ruleset", so a read-only assessment token sees an empty bypass list rather than an error. THE WINDOW, AND WHY THE CADENCE IS WEEKLY. `time_period` accepts `hour`, `day`, `week` and `month`, defaults to `day`, and `month` is the ceiling — and no retention period is documented for rule suite records at all. The bypass clause is therefore a statement about at most a month, and about however much of that month the platform still holds. Collecting monthly against a monthly ceiling leaves no margin: a collection that slips by a day loses records silently rather than erroring, and the records it loses are exactly the ones nobody saw. Weekly is four chances at the same evidence. WHY NO CLAUSE COUNTS THE FAILED RUNS. The sixth command returns a list built to contain offenders, and it carries no assertion. A workflow run that failed on the protected branch is the verification apparatus working — the desired state is that failures happen and are addressed, not that none occur — and a scheduled nightly that failed once says nothing about whether any change was verified. Both run lists are corroboration for a human: that runs exist at all, that they run on the branch the rules protect, and that their names correspond to the contexts the required-checks rule names. Nothing here checks that last correspondence, and it is the join an assessment most wants — a required context is a string, a workflow run has a name, and no response in this recipe says the string was produced by the run. NO CLAUSE READS A POSITION, deliberately. Nothing fetched documents the sort order of `/actions/runs`, so nothing here reads `[0]` as "the most recent". The immediately preceding batch on this plane put a freshness clause on `analyses[0]` and had to be corrected, because position zero was whichever language finished last. The same shape is available here and is not taken; a freshness claim over these runs would need a `created` range in the query rather than an index into the response. KSI-CMT-VTD is the direct claim: persistent testing and validation of changes throughout deployment, automated. KSI-CMT-LMC — modifications to the offering are logged and monitored — is claimed on the LOGGED limb only. The rule suite record is a per-push log of every change measured against the rules, and the workflow runs are a per-change record of what ran against it, which is logging in the most literal sense. Monitored is weaker and is not claimed: nothing in this recipe routes any of it to a person or to an alert, and no threshold in it fires. The evidence platform is itself an external system; see `external_system`. Two sibling recipes in the same batch — `developer-change-control-and-integrity` and `security-representative-change-approval` — read overlapping commands for different controls. They are separate recipes rather than one, because a single recipe carrying all three would put one `automatable` rating and one assertion set over three separate arguments, and the argument is the thing being assessed. ## References - {"title":"GitHub REST: repository rules — GET /repos/{owner}/{repo}/rules/branches/{branch} returning the rule objects in effect on a branch, GET /repos/{owner}/{repo}/rulesets with includes_parents defaulting to true, and the ruleset history endpoints; ruleset fields id, name, target branch | tag | push | repository, source_type Repository | Organization | Enterprise, enforcement disabled | active | evaluate, bypass_actors with actor_type Integration | OrganizationAdmin | RepositoryRole | Team | DeployKey | User and bypass_mode always | pull_request | exempt, current_user_can_bypass, rules, created_at, updated_at","url":"https://docs.github.com/en/rest/repos/rules"} - {"title":"GitHub REST: organization rules — the same ruleset schema at organization scope, and the source of the exact rule `type` strings this recipe filters on: creation, update, deletion, required_linear_history, required_deployments, required_signatures, pull_request, required_status_checks, non_fast_forward, commit_message_pattern, branch_name_pattern, file_path_restriction, workflows, code_scanning; the pull_request rule's parameters, of which this batch reads required_approving_review_count, dismiss_stale_reviews_on_push, require_code_owner_review, require_last_push_approval, required_review_thread_resolution and allowed_merge_methods, the page also documenting dismissal_restriction and required_reviewers; the required_status_checks rule's parameters required_status_checks (context, integration_id), strict_required_status_checks_policy and do_not_enforce_on_create","url":"https://docs.github.com/en/rest/orgs/rules"} - {"title":"GitHub REST: rule suites — GET /repos/{owner}/{repo}/rulesets/rule-suites and .../rule-suites/{rule_suite_id}; query parameters ref, time_period hour | day | week | month defaulting to day, actor_name, rule_suite_result \"Can be one of: pass, fail, bypass, all\" defaulting to all, and evaluate_status documented as \"active - only rule suites resulting from rulesets in active (non-evaluate) mode will be returned\"; response fields id, actor_id, actor_name, before_sha, after_sha, ref, repository_id, repository_name, pushed_at, result pass | fail | bypass and evaluation_result, with rule_evaluations carrying rule_source, rule_type, result and an enforcement of active | evaluate | \"deleted ruleset\"; NO retention period is stated for these records","url":"https://docs.github.com/en/rest/repos/rule-suites"} - {"title":"GitHub REST: workflow runs — GET /repos/{owner}/{repo}/actions/runs; the status filter accepting completed, action_required, cancelled, failure, neutral, skipped, stale, success, timed_out, in_progress, queued, requested, waiting and pending, plus actor, branch, event, created, exclude_pull_requests, check_suite_id and head_sha; run fields id, name, head_branch, head_sha, path, run_number, run_attempt, event, status, conclusion (documented as a string or null, WITHOUT an enum on this page — the familiar success/failure/neutral/cancelled/skipped/timed_out/action_required list belongs to check runs and is not sourced here), workflow_id, created_at, updated_at, run_started_at, triggering_actor, head_commit and referenced_workflows","url":"https://docs.github.com/en/rest/actions/workflow-runs"} - {"title":"GitHub: available rules for rulesets — \"Required status checks ensure that all required CI tests are passing before collaborators can make changes to a branch or tag\", the strict \"Require branches to be up to date before merging\" option, \"You can require that all changes to the target branch be associated with a pull request\" with its approving-review count, stale-approval dismissal, code-owner review and last-push options, \"When you enable required commit signing on a branch, contributors and bots can only push commits that have been signed and verified to the branch\", \"You can prevent users from force pushing to the targeted branches or tags. This rule is enabled by default\", and the bypass-permission paragraph","url":"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets"} - {"title":"GitHub: creating rulesets for a repository — the enforcement statuses, \"Active: your ruleset will be enforced upon creation\" and \"Disabled: your ruleset will not be enforced\", and the third status this recipe's clause exists for, offered \"to test the effects of any metadata restrictions without impacting contributors\"; also \"You can grant certain roles, teams, or apps bypass permissions for your ruleset\"","url":"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems this control applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/developer-change-control-and-integrity # The rules that made every change to the mainline arrive through a reviewed pull request, as a signed commit, onto a history that cannot be rewritten — together with the record of when those rules themselves last changed and who changed them, and the platform's own per-push record of any change that got past them. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/developer-change-control-and-integrity Recipe id: `developer-change-control-and-integrity` · cadence weekly · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MIT` - control `sa-10` ## Collection Kind: `api` ```sh # repos gh api --paginate "/orgs//repos?per_page=100" # branch-rules gh api "/repos///rules/branches/" # rulesets gh api --paginate "/repos///rulesets?includes_parents=true&per_page=100" # ruleset-history gh api --paginate "/repos///rulesets//history?per_page=100" # ruleset-history-version gh api "/repos///rulesets//history/" # rule-suites gh api --paginate "/repos///rulesets/rule-suites?ref=refs/heads/&time_period=month&evaluate_status=active&rule_suite_result=bypass&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `repos` is the first command, `branch-rules` the second, `rulesets` the third, `ruleset-history` the fourth, `ruleset-version` the fifth, `rule-suites-bypassed` the sixth. RUN COMMANDS 2, 3 AND 6 ONCE PER REPOSITORY AND ASSESSED BRANCH; run command 4 ONCE PER RULESET returned by command 3, and command 5 once per version of a ruleset you actually want to read. Every clause below speaks only for the repository and branch walked. `branch-rules` and `rulesets` return the shapes described in the sibling recipe `change-verification-status-checks-and-run-records`, and the rule types this recipe filters on are `pull_request`, `required_signatures` and `non_fast_forward`. The `pull_request` rule's parameters are `required_approving_review_count`, `dismiss_stale_reviews_on_push`, `require_code_owner_review`, `require_last_push_approval`, `required_review_thread_resolution` and `allowed_merge_methods`. `non_fast_forward` is the rule GitHub describes in its interface as blocking force pushes, and `required_signatures` the one under which "contributors and bots can only push commits that have been signed and verified to the branch". From `ruleset-history`, one entry per version of the ruleset: a `version_id`, an `actor` with an `id` and a `type`, and an `updated_at`. It says WHEN the change-control rules changed and WHO changed them, and it does not say what they changed to. From `ruleset-version`, the same three fields plus a `state` object, which is the ruleset as it stood at that version — this is the command to run when a history entry needs to become an answer. From `rule-suites-bypassed`, the push-evaluation records filtered by GitHub's own `rule_suite_result` parameter, documented as accepting `pass`, `fail`, `bypass` and `all`. The command passes `bypass`, so the response is built to contain only the pushes that got past the rules, each with `actor_name`, `before_sha`, `after_sha`, `ref` and `pushed_at`. `time_period` tops out at `month` and no retention period is documented for these records. The command also passes `evaluate_status=active` — documented as returning "only rule suites resulting from rulesets in active (non-evaluate) mode" — so the bypasses counted are bypasses of rules that were actually enforcing. ## Assertions - {"field":"branch-rules[?type=='pull_request'] | [0]","op":"exists","controls":["sa-10"],"description":"A pull-request rule is in effect on the assessed branch, so no change reaches the mainline except as a proposal — GitHub's wording is that the rule requires \"that all changes to the target branch be associated with a pull request\". Read from the endpoint that returns rules in effect, so an organization-level ruleset satisfies it exactly as a repository-level one does. It says changes are routed through a review mechanism; the next clause says whether that mechanism requires anybody."} - {"field":"branch-rules[?type=='pull_request' && (!parameters || parameters.required_approving_review_count==`0`)]","op":"count_eq","value":0,"controls":["sa-10"],"description":"No pull-request rule in effect requires zero approvals. This is the clause above's other half: zero is a legal, selectable value for `required_approving_review_count`, and a rule set to it routes every change through a pull request the author can merge unread. Both limbs are needed because JMESPath treats the number zero as truthy — `!parameters.required_approving_review_count` cannot catch a count of zero, and the equality test alone cannot catch a rule object with no parameters — so the disjunction catches the empty process and the malformed row alike."} - {"field":"branch-rules[?type=='required_signatures'] | [0]","op":"exists","controls":["sa-10"],"description":"A required-signatures rule is in effect, so that under it \"contributors and bots can only push commits that have been signed and verified to the branch\". This is the integrity of a change made checkable after the fact: each change carries a cryptographic claim about its author. It asserts that the RULE is in force, not that any given commit is signed — history predating the rule is untouched by it — and a signature attributes a change without authorizing it."} - {"field":"branch-rules[?type=='non_fast_forward'] | [0]","op":"exists","controls":["sa-10"],"description":"A rule blocking force pushes is in effect on the assessed branch. It is asserted rather than left as hygiene because every other artifact this recipe collects is a claim ABOUT a history — a merge record, a signature, an approval — and all of them are statements about commits a force push can silently replace. This clause is the precondition of the others being worth reading, rather than a fourth independent property."} - {"field":"rulesets[?enforcement=='evaluate' && target=='branch']","op":"count_eq","value":0,"controls":["sa-10"],"description":"No BRANCH ruleset applying to this repository is in dry-run mode. This clause is NOT what makes the clauses above trustworthy, and the first draft of this batch claimed it was. The endpoint those clauses read settles it instead: GitHub documents `/rules/branches/{branch}` as returning \"all active rules that apply to the specified branch\" and states that \"Rules in rulesets with \\\"evaluate\\\" or \\\"disabled\\\" enforcement statuses are not returned\" — so a rule that appears there is enforcing, and an evaluating ruleset is invisible to every `exists` clause rather than passing one. What this clause is, then, is a separate finding: a repository operating under a branch ruleset that somebody believes is in force and that blocks nothing. `evaluate` is the status the rule-suites API distinguishes when it offers to return \"only rule suites resulting from rulesets in active (non-evaluate) mode\". Narrowed to `target=='branch'` because the same response carries `tag`, `push` and `repository` rulesets, and a tag ruleset left evaluating has no bearing on the change path this recipe assesses."} ## Outside the boundary Platform: GitHub Enterprise Cloud SA-10 is a control about the DEVELOPER's configuration management, and on this plane the developer's configuration management system is a third party's hosted service. Adopting it to collect this evidence makes the provider's own change-control mechanism an external information resource under SA-09 and CA-03, and one that belongs in the external-system inventory AC-20 already covers. The consequence is sharper here than on a scanning control, because what is outsourced is not the detection of a problem but the ENFORCEMENT of the process: the rules that decide which changes may reach the mainline are held, evaluated and logged by the vendor, and the ruleset history that says who changed those rules is held by the same vendor. SA-10 is a class c and class d control, so every reader runs a Moderate or High system, and the offering named above is not necessarily the one such a reader can use: the Marketplace listing cited below is the listing for GitHub Enterprise Cloud, and a class c or class d reader has to check it against the class they operate at and look to whichever offering answers it — GitHub Enterprise Cloud for Government is a different product on different infrastructure with its own listing. No status value is written down here, because a certification status is a dated fact that changes. ## Notes SA-10 requires the provider to make the developer perform configuration management during development, implementation and operation; to document, manage and control the integrity of changes; to implement ONLY ORGANIZATION-APPROVED changes; to document approved changes and their potential security impacts; and to track flaws. This output answers the integrity-and-control limb with mechanism rather than with assertion: a rule that every change arrives through a pull request, a rule that its commits are signed, a rule that the history behind it cannot be rewritten, and the platform's own record of anything that got past all three. The gap the disposition named is the word ORGANIZATION-APPROVED. The configuration management plan naming the approving authority and the classes of change it covers is a document, and a merge record cannot show that the person who approved held that authority. Nothing here closes that, and the rating is unchanged by having written the commands down. A PULL-REQUEST RULE THAT REQUIRES NO APPROVAL. `required_approving_review_count` is a documented, selectable parameter and zero is a legal value for it. A `pull_request` rule with zero required approvals routes every change through a pull request and lets its author merge it unread — it satisfies the first clause, appears in every listing, and is a process with nobody in it. The second clause counts it, and it carries `!parameters` as a disjunct because the zero test alone cannot see a rule object with no parameters at all: JMESPath treats the number zero as truthy, so `!parameters.required_approving_review_count` would NOT catch a count of zero and `parameters.required_approving_review_count == 0` would not catch an absent object. The two together catch both, and a rule that legitimately carries no parameters fails loudly rather than passing silently. THE DRY-RUN TRAP is closed by the endpoint the first four clauses read, not by the fifth, and the first draft of this batch had that backwards in both siblings. GitHub documents `/rules/branches/{branch}` as returning "all active rules that apply to the specified branch" and says that "Rules in rulesets with \"evaluate\" or \"disabled\" enforcement statuses are not returned" — so a `pull_request`, `required_signatures` or `non_fast_forward` rule found there is enforcing, and a ruleset in dry-run is invisible to those clauses rather than satisfying them. That matters more here than in the sibling recipe, because four of this recipe's five clauses read that endpoint. The fifth is kept as an independent finding — a branch ruleset believed to be in force that blocks nothing — and not as the guard the draft called it. SIGNED COMMITS PROVE ATTRIBUTION, NOT AUTHORITY. Under `required_signatures`, "contributors and bots can only push commits that have been signed and verified to the branch", which is the integrity limb of SA-10 in the most literal available sense: every change carries a cryptographic claim about who made it, checkable long after the fact. What a signature does not carry is that the signer was entitled to make that change, which is the organization-approved gap again one layer down. Note also what the clause asserts and does not: that the RULE is in effect, not that any particular commit on the branch is signed. A history that predates the rule is unaffected by it, and nothing in this recipe reads the commits themselves. BLOCKING FORCE PUSHES IS WHAT MAKES THE REST OF THE RECORD EVIDENCE. `non_fast_forward` is the rule GitHub describes as preventing force pushes, and it is asserted here rather than treated as hygiene because every other artifact this recipe collects is a claim about a history: a merge record, a signature, an approval. All of them are statements about commits that a force push can replace. The fourth clause is therefore not a fourth control property but the precondition of the other three being worth reading. THE HISTORY ENDPOINT IS THE ONE PIECE OF EVIDENCE ABOUT THE CONTROL ITSELF, AND IT CARRIES NO CLAUSE ON PURPOSE. `/rulesets/{ruleset_id}/history` returns a `version_id`, an `actor` and an `updated_at` per version — who changed the change-control rules, and when. That is as close as this plane comes to configuration management OF the configuration management, and no threshold over it would mean anything: one entry is a ruleset created once and never touched, which is a good state, and forty entries is a ruleset under active maintenance, which is also a good state. It is collected because an assessment reading a green ruleset today needs to know whether it was green last quarter, and the version list is the only thing here that answers. Turning an entry into an answer takes the per-version command, which returns the ruleset's `state` as it stood. THE BYPASS LIST IS FILTERED BY THE VENDOR, AND THAT IS WHY ITS EMPTINESS MEANS SOMETHING. The sixth command passes `rule_suite_result=bypass`, so the response is constructed to hold only the pushes that got past the rules; an empty response is the meaningful kind of empty rather than the ambiguous kind, in the way a `status=failure` list is and a full list is not. Its bounds are the same as the sibling recipe's — at most a month, and only as much of that month as the platform retains — which is why the cadence here is weekly rather than monthly despite everything else in the recipe being configuration that changes rarely. KSI-SCR-MIT asks the provider to persistently identify, review and mitigate potential supply chain risks, and this recipe is claimed on the MITIGATE limb alone. The developer is a supply chain participant, and constraining what any developer — or any credential belonging to one — can put into the mainline is a mitigation of that participant's risk. It is not an identification of any risk and not a review of one: nothing here surfaces a finding, ranks it, or records a decision about it. The identify and review limbs of this indicator are carried on this plane by `dependency-vulnerability-monitoring`, and an indicator page carrying this recipe should be read as carrying evidence for a part. The evidence platform is itself an external system; see `external_system`. Two sibling recipes in the same batch read overlapping commands for different controls, and are separate recipes for the reason given in `change-verification-status-checks-and-run-records`. ONE LIMB OF THE DISPOSITION IS NOT CARRIED FORWARD, and it is recorded here because deleting the disposition deletes the only other place it was written down. The rationale this recipe spends argued from "branch protection, required reviews, signed commits AND MERGE RECORDS", and there is no merge record in this recipe: no `/pulls`, no `/commits`, no review endpoint. What replaced that limb is the rule that makes a pull request compulsory and the bypass list that says nothing got around it, which is the mechanism rather than the instances. The instances are collected on this plane by `security-representative-change-approval`, under a different control, and an assessment wanting per-change evidence for SA-10 should read that recipe's fifth and sixth commands beside this one. The rating is unaffected — `partial` was right on either reading — but the covered ground is narrower than the register said it would be. The type-string-to-interface-name join is unsourced and is stated here rather than implied. `required_signatures` and `non_fast_forward` are the API `type` values, taken from the organization-rules reference; "Require signed commits" and "Block force pushes" are the names the ruleset documentation uses for the same two rules. No page cited here maps one spelling to the other. The mapping is not in doubt, and it is not cited either, which is the honest way to leave it. ## References - {"title":"GitHub REST: repository rules — GET /repos/{owner}/{repo}/rules/branches/{branch} returning the rule objects in effect on a branch, GET /repos/{owner}/{repo}/rulesets with includes_parents defaulting to true, and the ruleset history endpoints; ruleset fields id, name, target branch | tag | push | repository, source_type Repository | Organization | Enterprise, enforcement disabled | active | evaluate, bypass_actors with actor_type Integration | OrganizationAdmin | RepositoryRole | Team | DeployKey | User and bypass_mode always | pull_request | exempt, current_user_can_bypass, rules, created_at, updated_at","url":"https://docs.github.com/en/rest/repos/rules"} - {"title":"GitHub REST: organization rules — the same ruleset schema at organization scope, and the source of the exact rule `type` strings this recipe filters on: creation, update, deletion, required_linear_history, required_deployments, required_signatures, pull_request, required_status_checks, non_fast_forward, commit_message_pattern, branch_name_pattern, file_path_restriction, workflows, code_scanning; the pull_request rule's parameters, of which this batch reads required_approving_review_count, dismiss_stale_reviews_on_push, require_code_owner_review, require_last_push_approval, required_review_thread_resolution and allowed_merge_methods, the page also documenting dismissal_restriction and required_reviewers; the required_status_checks rule's parameters required_status_checks (context, integration_id), strict_required_status_checks_policy and do_not_enforce_on_create","url":"https://docs.github.com/en/rest/orgs/rules"} - {"title":"GitHub: available rules for rulesets — \"Required status checks ensure that all required CI tests are passing before collaborators can make changes to a branch or tag\", the strict \"Require branches to be up to date before merging\" option, \"You can require that all changes to the target branch be associated with a pull request\" with its approving-review count, stale-approval dismissal, code-owner review and last-push options, \"When you enable required commit signing on a branch, contributors and bots can only push commits that have been signed and verified to the branch\", \"You can prevent users from force pushing to the targeted branches or tags. This rule is enabled by default\", and the bypass-permission paragraph","url":"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets"} - {"title":"GitHub REST: rule suites — GET /repos/{owner}/{repo}/rulesets/rule-suites and .../rule-suites/{rule_suite_id}; query parameters ref, time_period hour | day | week | month defaulting to day, actor_name, rule_suite_result \"Can be one of: pass, fail, bypass, all\" defaulting to all, and evaluate_status documented as \"active - only rule suites resulting from rulesets in active (non-evaluate) mode will be returned\"; response fields id, actor_id, actor_name, before_sha, after_sha, ref, repository_id, repository_name, pushed_at, result pass | fail | bypass and evaluation_result, with rule_evaluations carrying rule_source, rule_type, result and an enforcement of active | evaluate | \"deleted ruleset\"; NO retention period is stated for these records","url":"https://docs.github.com/en/rest/repos/rule-suites"} - {"title":"GitHub: creating rulesets for a repository — the enforcement statuses, \"Active: your ruleset will be enforced upon creation\" and \"Disabled: your ruleset will not be enforced\", and the third status this recipe's clause exists for, offered \"to test the effects of any metadata restrictions without impacting contributors\"; also \"You can grant certain roles, teams, or apps bypass permissions for your ruleset\"","url":"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/creating-rulesets-for-a-repository"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems this control applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/security-representative-change-approval # The rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/security-representative-change-approval Recipe id: `security-representative-change-approval` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CMT-RVP` - KSI `KSI-PIY-RSD` - control `cm-3.4` ## Collection Kind: `api` ```sh # repos gh api --paginate "/orgs//repos?per_page=100" # branch-rules gh api "/repos///rules/branches/" # codeowners-errors gh api "/repos///codeowners/errors?ref=" # codeowners-file gh api -H "Accept: application/vnd.github.raw" "/repos///contents/.github/CODEOWNERS?ref=" # pulls-closed gh api --paginate "/repos///pulls?state=closed&base=&per_page=100" # pull-reviews gh api --paginate "/repos///pulls//reviews?per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `repos` is the first command, `branch-rules` the second, `codeowners-errors` the third, `codeowners-file` the fourth, `pulls-closed` the fifth, `reviews` the sixth. RUN COMMANDS 2 THROUGH 5 ONCE PER REPOSITORY AND ASSESSED BRANCH, and command 6 once per pull request selected from the fifth. The fourth and fifth commands are a SAMPLE AND WALK for a human reader, not a population any clause below reads — the closed pull request list is unbounded and no assertion here is written over it. From `branch-rules`, the rule objects in effect on the branch, of which this recipe reads the `pull_request` type and its parameters `required_approving_review_count`, `dismiss_stale_reviews_on_push`, `require_code_owner_review`, `require_last_push_approval`, `required_review_thread_resolution` and `allowed_merge_methods`. From `codeowners-errors`, an object with an `errors` array, each error carrying `line`, `column`, `kind`, `source`, `suggestion`, `message` and `path`. The `ref` parameter is "A branch, tag or commit name used to determine which version of the CODEOWNERS file to use" and DEFAULTS TO THE REPOSITORY'S DEFAULT BRANCH — the command passes it explicitly, because a recipe assessing any other branch would otherwise be checking a different file from the one in force there. From `codeowners-file`, the file itself. GitHub documents three legal locations — "the .github/, root, or docs/ directory of the repository" — so a 404 from the path above is not an absence, it is the wrong one of the three; try `CODEOWNERS` and `docs/CODEOWNERS` before concluding anything. From `pulls-closed`, the closed pull requests targeting the branch, and from `reviews`, the review records: `id`, `user`, `body`, a `state` — the page documents it as a required string and enumerates nothing, so `APPROVED`, `COMMENTED`, `DISMISSED` and `PENDING` are the values to expect rather than a closed set, and no clause here depends on the enum being complete, `html_url`, `submitted_at`, `commit_id` and an `author_association` of `COLLABORATOR`, `CONTRIBUTOR`, `FIRST_TIMER`, `FIRST_TIME_CONTRIBUTOR`, `MANNEQUIN`, `MEMBER`, `NONE` or `OWNER`. `commit_id` is the field that makes a review an answer rather than a timestamp: it says WHICH revision was approved. ## Assertions - {"field":"branch-rules[?type=='pull_request' && parameters.require_code_owner_review==`true`] | [0]","op":"exists","controls":["cm-3.4"],"description":"A pull-request rule in effect on the assessed branch requires review from the code owners of the changed files — the platform's mechanism for putting a designated reviewer on every change that touches what they own. This is the membership claim in its enforceable form. It says a designated owner must approve; it does not say any owner is actually designated, which is the next clause, and it does not say the owner is the security representative CM-03 (04) names, which is the gap no clause closes."} - {"field":"codeowners-errors.errors","op":"count_eq","value":0,"controls":["cm-3.4"],"description":"The CODEOWNERS file in force on the assessed branch parses without a single syntax error. This is the clause the one above is worthless without, and the reason is the vendor's own sentence: \"If any line in your CODEOWNERS file contains invalid syntax, that line will be skipped.\" A skipped line does not fail anything — it silently removes the owners of the paths it covered, so the rule above stays green while requiring approval from nobody for exactly the directory whose line was broken. The endpoint that reports these errors is the only thing in this recipe that can see it. Its silence has a residue: nothing documents what it returns when there is no CODEOWNERS file at all, so read a zero here together with the file the third command fetches."} - {"field":"branch-rules[?type=='pull_request' && !(parameters.dismiss_stale_reviews_on_push)]","op":"count_eq","value":0,"controls":["cm-3.4"],"description":"No pull-request rule in effect lets an approval survive a later push. Without this parameter a code owner approves, the author pushes again, and the approval carries over to code no owner has seen — the record afterwards shows a designated reviewer approving the pull request, which is true, and does not show that they approved what merged. Offender form over rows present in the same response, and the parentheses are load-bearing: `!parameters.X` parses as `(!parameters).X`, which is null, which is falsy, so the unparenthesised form selects nothing at all. `!(parameters.dismiss_stale_reviews_on_push)` catches the parameter set to false and the parameter absent alike, both of which leave approvals standing."} ## Outside the boundary Platform: GitHub Enterprise Cloud What this recipe reads is a membership claim, and a membership claim is an identity claim: the platform's account of which of its users approved which change. Bringing it into the assessment makes the platform an information resource under SA-09 and CA-03 and an entry in the external-system inventory AC-20 already covers, and it does so for a control about WHO IS ON a body rather than about what a scanner found — so the dependency runs through the provider's identity federation as well as through the platform itself. A code owner is a platform identity, and the chain from that identity to a named person holding a named role runs through the identity provider, the group memberships synchronised into the platform, and the platform's own account of who clicked approve. CM-03 (04) is a class c and class d control, so every reader runs a Moderate or High system, and the offering named above is not necessarily the one such a reader can use: the Marketplace listing cited below is the listing for GitHub Enterprise Cloud, and a class c or class d reader has to check it against the class they operate at and look to whichever offering answers it — GitHub Enterprise Cloud for Government is a different product on different infrastructure with its own listing. No status value is written down here, because a certification status is a dated fact that changes. ## Notes CM-03 (04) requires an information security representative to be a MEMBER of the configuration change control element. This is the closest this plane comes to a membership claim it can check: a rule requiring the designated owners of the changed code to approve, a file naming who those owners are, and per-change approval records carrying identities, revisions and timestamps. What none of it establishes is that those identities ARE the security and privacy representatives the control names. That mapping lives in the change control charter, and a repository team called `security` is an assertion about a name. The gap is an identity mapping rather than a missing signal, which is exactly what the disposition said, and no amount of further collection on this platform closes it. THE SKIPPED LINE — this recipe's vacuity trap, and unusually it is documented by the vendor rather than inferred from an API shape. GitHub states plainly that "If any line in your CODEOWNERS file contains invalid syntax, that line will be skipped." So a `pull_request` rule with `require_code_owner_review` set to true, sitting over a CODEOWNERS file whose one line covering the infrastructure directory has a typo, requires review from the code owners of that directory — of which there are now none. The rule is green, the platform requests no reviewer, and the change merges on whatever approvals its author could find. Nothing in the rules API can see this, and nothing in a screenshot of the branch protection settings can either. `GET /repos/{owner}/{repo}/codeowners/errors` is the only endpoint in this recipe that sees it, and it is the entire reason the second clause exists. A MISSING FILE AND A CLEAN FILE ARE NOT DISTINGUISHED BY THE CLAUSE, AND THE THIRD COMMAND IS WHY. Nothing fetched documents what the errors endpoint returns when there is no CODEOWNERS file at all, so an empty `errors` array is the passing shape for a valid file and the plausible shape for an absent one — the plane's standing emptiness problem, arriving through a door that looks like a validator. The third command reads the file itself for exactly this reason: it is collected so a human can confirm there IS a file and see who it names. No clause is written over its contents, because who ought to own which path is the identity mapping this recipe cannot make, and a clause counting lines would be a clause asserting that a file is long. WHY THE STALE-APPROVAL CLAUSE IS HERE AND A LAST-PUSH ONE IS NOT. `dismiss_stale_reviews_on_push` is what stops an approval from outliving the change it approved: without it, a code owner approves, the author pushes again, and the approval carries over to code no owner has seen — a membership failure wearing the appearance of a membership success, and the one failure mode in this recipe that leaves a complete and convincing paper trail. `require_last_push_approval`, GitHub's option to "require an approval from someone other than the last person to push to a branch", is deliberately NOT asserted: it is a separation-of-duty property rather than a membership one, a small team can be operating correctly without it, and CM-03 (04) asks who sits on the element rather than whether two distinct people acted. WHAT A REVIEW RECORD PROVES AND WHERE IT STOPS. A review carries `state`, `user`, `submitted_at`, `commit_id` and `author_association`, so the record says a named platform identity approved a named revision at a named time — and `commit_id` is what makes it an approval of something rather than a timestamp. It does not say that the identity belongs to a person, that the person holds the role, or that the approval was informed. `author_association` is the closest thing to a role anywhere in the response and it is a repository-relationship enum — `MEMBER`, `COLLABORATOR`, `OWNER` — describing a relationship to the repository rather than a position in the organization, so no clause is written over it. The fourth and fifth commands are collected as a sample for a human to read against the charter, and no assertion reads them; a clause over an unbounded list of closed pull requests would be a clause about how many were sampled. NO `enforcement` CLAUSE APPEARS IN THIS RECIPE, and after the audit of this batch that is the correct answer for a better reason than the one first written. Every clause here except the second reads `/rules/branches/{branch}`, which GitHub documents as returning "all active rules that apply to the specified branch" and from which "Rules in rulesets with \"evaluate\" or \"disabled\" enforcement statuses are not returned" — so a dry-run ruleset cannot satisfy the first or third clause, and no guard against it is needed. The second clause reads a file parser that no ruleset governs at all: a CODEOWNERS file with a syntax error is broken whether the ruleset requiring code-owner review is active, evaluating or absent. An assessment wanting the dry-run finding itself gets it from `developer-change-control-and-integrity` on the same repository, where it belongs, being a property of the repository rather than of this control. KSI-CMT-RVP — the effectiveness of documented change management procedures is persistently reviewed — is claimed on the MECHANISM limb. A required approval per change, with the approver and the revision recorded, is the material a review of procedure effectiveness reads, and the rule is the documented procedure in executable form. Whether the procedure is EFFECTIVE is a judgement, and no API in this recipe makes it. KSI-PIY-RSD — the effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed — is claimed narrowly and should be read narrowly: requiring a security owner's approval at merge is one security consideration built into one point of the lifecycle. The indicator is about the whole lifecycle and about alignment with an external body of principles that nothing here reads. The evidence platform is itself an external system, and on this control the dependency runs through the identity provider as well; see `external_system`. ## References - {"title":"GitHub: about code owners — a CODEOWNERS file lives in \"the .github/, root, or docs/ directory of the repository\"; \"Code owners are automatically requested for review when someone opens a pull request that modifies code that they own\"; \"The people you choose as code owners must have write permissions for the repository\"; \"When the code owner is a team, that team must be visible and it must have write permissions, even if all the individual members of the team already have write permissions directly\"; and the sentence this recipe's second clause exists for — \"If any line in your CODEOWNERS file contains invalid syntax, that line will be skipped\"","url":"https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners"} - {"title":"GitHub REST: repositories — GET /repos/{owner}/{repo}/codeowners/errors, which lists \"any syntax errors that are detected in the CODEOWNERS file\"; its ref parameter is \"A branch, tag or commit name used to determine which version of the CODEOWNERS file to use. Default: the repository's default branch\", and each error carries line, column, kind, source, suggestion, message and path","url":"https://docs.github.com/en/rest/repos/repos"} - {"title":"GitHub REST: repository rules — GET /repos/{owner}/{repo}/rules/branches/{branch} returning the rule objects in effect on a branch, GET /repos/{owner}/{repo}/rulesets with includes_parents defaulting to true, and the ruleset history endpoints; ruleset fields id, name, target branch | tag | push | repository, source_type Repository | Organization | Enterprise, enforcement disabled | active | evaluate, bypass_actors with actor_type Integration | OrganizationAdmin | RepositoryRole | Team | DeployKey | User and bypass_mode always | pull_request | exempt, current_user_can_bypass, rules, created_at, updated_at","url":"https://docs.github.com/en/rest/repos/rules"} - {"title":"GitHub REST: organization rules — the same ruleset schema at organization scope, and the source of the exact rule `type` strings this recipe filters on: creation, update, deletion, required_linear_history, required_deployments, required_signatures, pull_request, required_status_checks, non_fast_forward, commit_message_pattern, branch_name_pattern, file_path_restriction, workflows, code_scanning; the pull_request rule's parameters, of which this batch reads required_approving_review_count, dismiss_stale_reviews_on_push, require_code_owner_review, require_last_push_approval, required_review_thread_resolution and allowed_merge_methods, the page also documenting dismissal_restriction and required_reviewers; the required_status_checks rule's parameters required_status_checks (context, integration_id), strict_required_status_checks_policy and do_not_enforce_on_create","url":"https://docs.github.com/en/rest/orgs/rules"} - {"title":"GitHub: available rules for rulesets — \"Required status checks ensure that all required CI tests are passing before collaborators can make changes to a branch or tag\", the strict \"Require branches to be up to date before merging\" option, \"You can require that all changes to the target branch be associated with a pull request\" with its approving-review count, stale-approval dismissal, code-owner review and last-push options, \"When you enable required commit signing on a branch, contributors and bots can only push commits that have been signed and verified to the branch\", \"You can prevent users from force pushing to the targeted branches or tags. This rule is enabled by default\", and the bypass-permission paragraph","url":"https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets"} - {"title":"GitHub REST: pull request reviews — GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews; review fields id, node_id, user, body, state (documented as a required string with NO enum on this page; APPROVED, COMMENTED, DISMISSED and PENDING are the values to expect, not a closed set this citation establishes), html_url, pull_request_url, submitted_at, commit_id, and author_association, which IS enumerated: COLLABORATOR, CONTRIBUTOR, FIRST_TIMER, FIRST_TIME_CONTRIBUTOR, MANNEQUIN, MEMBER, NONE, OWNER","url":"https://docs.github.com/en/rest/pulls/reviews"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems this control applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/unsupported-component-inventory-and-lifecycle-review # The exact component-and-version inventory the boundary's repositories build from — every package the dependency graph resolved, carrying the version string that is the only thing SA-22's question can be asked about — together with whether that graph is switched on across the boundary at all, and then the open advisories for which the ecosystem offers no patched version, which is the closest thing a pipeline emits to a component nobody maintains any more. The inventory is the load-bearing half and it is why this recipe exists separately from the vulnerability one: "is this component past end of support" is a question about a name and a version, and a check that cannot produce the version has not asked it. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/unsupported-component-inventory-and-lifecycle-review Recipe id: `unsupported-component-inventory-and-lifecycle-review` · cadence monthly · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-SCR-MIT` - control `sa-22` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?status=attached,enforced&per_page=100" # configuration-repositories-all gh api --paginate "/orgs//code-security/configurations//repositories?per_page=100" # sbom gh api "/repos///dependency-graph/sbom" # alerts-open gh api --paginate "/orgs//dependabot/alerts?state=open&per_page=100" # alerts-dismissed gh api --paginate "/orgs//dependabot/alerts?state=dismissed&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first, `configuration-repositories` the second, `configuration-repositories-all` the third, `sbom` the fourth, `alerts-open` the fifth and `alerts-dismissed` the sixth. The second and third call the SAME endpoint and the difference between them is the point rather than a duplication: the second narrows `status` to `attached,enforced` so the enumeration holds only repositories the configuration actually reached, and the third leaves `status` at its documented default of `all` so the `failed` rows are visible at all. A recipe carrying only the narrowed call cannot fail a clause about `failed`, because the row it is looking for was filtered out before the report was written. RUN COMMAND 4 ONCE PER REPOSITORY. The SBOM export is documented at `GET /repos/{owner}/{repo}/dependency-graph/sbom` and has no organization-scoped form, so the component inventory is assembled one repository at a time from the list command 2 returns; the two alert commands are organization-scoped and each alert carries its owning `repository`, so the advisory half arrives in one walk. From `configurations`, the fields this recipe reads and their documented defaults, which are not the same for the two settings it depends on: `dependency_graph` is `enabled | disabled | not_set` and defaults to `enabled`, while `dependabot_alerts` is the same enum and defaults to `disabled`. `target_type` is `global | organization | enterprise` and `enforcement` is `enforced | unenforced`. From `configuration-repositories`, the association `status`, whose documented values are `all, attached, attaching, detached, removed, enforced, failed, updating, removed_by_enterprise` and whose documented DEFAULT is `all` — the second command narrows it to `attached,enforced` so the enumeration holds only repositories the configuration actually reached, and the third leaves it unnarrowed so the `failed` rows a clause of its own reads below are present in a report at all. From `sbom`, an SPDX document under a required `sbom` key carrying `SPDXID`, `spdxVersion`, `creationInfo`, `name`, `dataLicense`, `documentNamespace`, a required `packages` array and a `relationships` array. Each package entry is documented with `SPDXID`, `name`, `versionInfo`, `downloadLocation`, `filesAnalyzed`, `licenseConcluded`, `licenseDeclared`, `supplier`, `copyrightText` and `externalRefs`, the last an array of `{referenceCategory, referenceLocator, referenceType}` — the purl that identifies the component precisely enough to look its support dates up. `versionInfo` is the field this recipe turns on, and the documented behaviour behind it is the opposite of the one an earlier draft of this recipe assumed. It is REQUIRED on every package entry — the schema's required list is `SPDXID, name, versionInfo, downloadLocation, filesAnalyzed` — so a component never arrives without the field, and a clause counting the entries that lack one could never fire. What the page documents instead is the real failing case: "The version of the package. If the package does not have an exact version specified, a version range is given." An unpinned component is present, carries the field, and carries a RANGE, which is the shape the clause below enumerates. From `alerts-open` and `alerts-dismissed`, `dependency` (`package.ecosystem`, `package.name`, `manifest_path`, `scope`, `relationship`), `state` (`open | dismissed | fixed | auto_dismissed`), `dismissed_reason` (`fix_started | inaccurate | no_bandwidth | not_used | tolerable_risk`), `dismissed_comment` (documented required, string or null, capped at 280 characters), `auto_dismissed_at`, and `security_advisory` with `ghsa_id`, `cve_id`, `severity`, `classification` (`general | malware`), `cwes`, `published_at`, `updated_at`, `withdrawn_at` and a `vulnerabilities` array whose entries carry `vulnerable_version_range` and a `first_patched_version` documented "object or null". Beside `security_advisory`, and not to be confused with it, each alert carries a required `security_vulnerability` object of its own — `package`, `severity`, `vulnerable_version_range` and its own `first_patched_version`, same "object or null" — and THAT is the entry pertaining to the alerted component, where `security_advisory.vulnerabilities[]` enumerates every affected range across every ecosystem the advisory covers. The no-patch clause below reads the former for that reason. The `has` filter is documented as supporting only `patch` on the REPOSITORY form and is left unenumerated on the organization form this recipe calls, so on neither form is there a documented way to select the alerts that lack a fix; the no-patch narrowing is therefore a client-side filter over a full paginated walk, and a collector that reads one page of thirty has produced a smaller answer rather than a filtered one. ## Assertions - {"field":"configurations[?target_type=='organization' && dependency_graph=='enabled'] | [0].id","op":"exists","controls":["sa-22"],"description":"At least one code security configuration the organization itself owns sets `dependency_graph` to `enabled`. Every other clause in this recipe is an offender count, and an organization that has never created a configuration returns an empty list for all of them: no configuration is enumerated, no repository is walked, no SBOM is exported, no alert is raised, and six `count_eq 0` clauses go green on a boundary where nothing was ever switched on. This is the positive clause that makes that state fail, and it is the same guard the three sibling recipes reading this report already carry — its absence here was the defect, not its presence there. The field is three-state and the middle value is the trap: `not_set` is neither on nor off, and a clause written against `disabled` passes an organization that never decided. It says a configuration exists and decided; it does not say which repositories it reaches, and repository-level enablement bypasses configurations entirely."} - {"field":"configurations[?target_type=='organization' && dependency_graph!='enabled']","op":"count_eq","value":0,"controls":["sa-22"],"description":"No configuration the organization ITSELF OWNS leaves the dependency graph unenabled. The `target_type` narrowing is deliberate and matches the sibling code-scanning recipe: a provider cannot edit a global or enterprise-owned configuration, so failing it for one would be failing it for a decision it has no permission to make. This is the negative half of the clause above and is not the precondition on its own: an offender count over an empty configuration list is green, which is exactly why the existence clause precedes it. What it adds is the case where a configuration DOES exist and leaves the graph off — there are then no packages to export, `sbom` is empty rather than wrong, and every clause below would be vacuously green."} - {"field":"configurations[?target_type=='organization' && dependabot_alerts!='enabled']","op":"count_eq","value":0,"controls":["sa-22"],"description":"No organization-owned configuration leaves Dependabot alerts unenabled. Asserted separately from the graph clause above because the two settings have DIFFERENT documented defaults — `dependency_graph` defaults to `enabled` and `dependabot_alerts` to `disabled` — so the common state is a repository whose components are resolved and whose advisories are never raised. That repository appears complete in the inventory half of this recipe and contributes nothing to the alert half, which is the quietest way this evidence can be half-true."} - {"field":"configuration-repositories-all[?status=='failed']","op":"count_eq","value":0,"controls":["sa-22"],"description":"No repository the configuration was applied to failed to receive it. `failed` is the status that produces silence rather than an error: the repository is attached in intent, resolves no dependency graph, exports no packages and raises no alerts, so the boundary's inventory is short by exactly that repository's components and nothing in the totals says so. It reads `configuration-repositories-all` and NOT the enumeration report, and that is a correction rather than a detail — the enumeration command narrows `status` to `attached,enforced`, which filters out the very row this clause exists to count, and a clause pointed at it would be unfailable by construction. The documented default for `status` is `all`, which is what the third command relies on."} - {"field":"sbom.sbom.packages[?contains(versionInfo,'>') || contains(versionInfo,'<') || contains(versionInfo,'^') || contains(versionInfo,'~') || contains(versionInfo,'*') || contains(versionInfo,',') || contains(versionInfo,' ')]","op":"count_eq","value":0,"controls":["sa-22"],"description":"No component in this repository's exported inventory arrives with a version RANGE instead of a pinned version. This is the clause SA-22 turns on and it took two corrections to write. The first is the path, and it is the one that mattered most: the root token is the REPORT name and the response's own top-level key is `sbom` again, because the SPDX document arrives nested under a required `sbom` key, so the clause reads `sbom.sbom.packages`. Written at `sbom.packages` it resolved to nothing, and an offender count over nothing is zero, which is green — the recipe's own centre-of-gravity clause was unfailable on every estate. The second is the field: an earlier form counted packages whose `versionInfo` was null, which could never fire, because GitHub documents `versionInfo` in the package object's required list. The documented failing case is the other one — \"If the package does not have an exact version specified, a version range is given\" — so the unpinned component is PRESENT, carries the field, and carries a range, and a null-counting clause read it as green. A range cannot be looked up against a vendor's lifecycle policy, which is the whole question SA-22 asks, so it is the failing row. State plainly what this form costs: the assertion grammar has no \"is not an exact version\" operator, so the clause enumerates the characters a range spelling uses and a range spelled some other way passes. That residue is a property of the grammar and is named here rather than hidden, which is the difference between a heuristic and an over-claim."} - {"field":"alerts-open[?security_vulnerability.first_patched_version==`null`]","op":"count_eq","value":0,"controls":["sa-22"],"description":"No open alert names a component for which the ecosystem has published no fixed version. The alert carries its OWN required `security_vulnerability` object — `package`, `severity`, `vulnerable_version_range` and a `first_patched_version` documented \"object or null\" — and that object is the entry pertaining to the alerted component. An earlier form of this clause read `security_advisory.vulnerabilities[]` instead and counted an alert whose ANY entry lacked a patch: that array enumerates every affected range across every ecosystem the advisory covers, so an advisory patched for this component and unpatched for some other one fired it. The clause over-fired rather than under-fired, which is the safe direction and is why it is listed third of three corrections rather than first, but it was not asking the question the description claimed. Offender form over a list built to hold offenders, and evaluated client-side: the `has` filter is documented as supporting only `patch` on the repository form and is left unenumerated on the organization form this recipe calls, so there is no documented way to select the alerts WITHOUT a fix and the narrowing needs the full paginated walk the command performs. Read the result as a hint that a lifecycle review is owed on those packages, never as the finding that they are past end of support; `scan_scope` names the list that decides that and it is not in this output."} - {"field":"alerts-dismissed[?(dismissed_reason=='no_bandwidth' || dismissed_reason=='tolerable_risk') && dismissed_comment==`null`]","op":"count_eq","value":0,"controls":["sa-22"],"description":"No alert was dismissed for lack of capacity or as tolerable risk without a written justification. These are the two documented reasons that mean the component STAYS, so this clause marks the population that was knowingly not replaced — which is the set SA-22's second limb then has to answer for. `dismissed_comment` is documented required, string or null, capped at 280 characters, so the literal-null comparison catches both an explicit null and an absent key and the failing row is present-and-false rather than dropped. What this establishes is narrow and the note says so: a typed comment records that somebody chose to keep the component, and it is evidence of neither replacement nor of an alternative support source having been arranged, which is what the control actually asks for."} ## Outside the boundary Platform: GitHub Enterprise Cloud The dependency resolver, the component inventory it produces and the advisory database the alerts are drawn from are all held and operated by a third party, so reading them brings the platform into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. SA-22 makes that dependency unusually pointed, because the control is ABOUT depending on components somebody else does or does not still maintain, and this evidence answers it by depending on a component somebody else maintains: what counts as a known weakness in a package is decided by an advisory database the provider does not write or version, and a re-review or a withdrawal there changes what this output says without anything in the provider's system changing. SA-22 sits in the class b, class c and class d baselines, so it reaches every reader of this product including Low systems, and the impact level a platform's Marketplace listing carries is not necessarily the one a given system needs — that is the SA-09 question, it is answered by reading the cited listing rather than by this sentence, and no value for it is written here because it is a dated fact that changes. This recipe was authored against GitHub Enterprise Cloud; github.com and the data-residency offering are different deployments on different infrastructure. ## Notes SA-22 asks two things: that unsupported components are replaced, and that alternative sources of continued support are provided for the ones that are not — in-house support, or an external provider the organization names. This plane can see the population and cannot see either answer, which is what `partial` records. An earlier draft of this note said the second limb was documented justification and approval; that is the shape of legacy baseline supplemental guidance rather than of the control, this repo's own dataset carries no guidance for SA-22 at all, and the difference matters here because the platform DOES hold a justification artifact and holds nothing whatsoever about an alternative support arrangement. Getting that wrong would have made the dismissal clause below look like it closed a limb it does not touch. WHY THIS IS A DIFFERENT RECIPE FROM THE DEPENDENCY-VULNERABILITY ONE AND NOT A SECOND VIEW OF IT. `dependency-vulnerability-monitoring` asks whether known-vulnerable components are found and fixed; this asks whether the provider knows what it ships and whether any of it has been abandoned. The two questions overlap in their telemetry and diverge in their failure cases, and the divergence is the point: a component with no advisories at all is clean by the first question and is precisely the profile of an unmaintained package by the second, because an advisory exists when somebody researches a package and nobody researches a dead one. That is why the inventory clause rather than the alert clauses is the centre of this recipe. THE NO-PATCH CLAUSE IS A HINT AND IS DELIBERATELY NOT WRITTEN AS A VERDICT. An open alert whose advisory carries no `first_patched_version` on any entry is the strongest end-of-support signal the documented API emits — nobody shipped a fix — and it is still not the control's finding. It is equally the shape of an advisory published hours ago, of a dispute upstream, and of a maintainer who fixed the issue without cutting a release. It is asserted because a growing set of them is a real and readable finding about the boundary, and it is described here as a hint because reading it as "these components are past end of support" would be authoring the reconciliation `scan_scope` says nobody has done. WHAT THE DISMISSAL CLAUSE DOES AND DOES NOT ESTABLISH. `dismissed_reason` of `no_bandwidth` or `tolerable_risk` on an alert nobody can patch is the platform's record that a component was knowingly KEPT, and that is its whole value: it enumerates the components SA-22's second limb is about, which is a real service and is not the limb itself. Nothing in this output says whether in-house support was arranged for any of them or whether an external provider was named, and no field on this endpoint could. The clause is worth asserting because a dismissal carrying an empty comment is unambiguously worse than one carrying a reason, and it is worth saying plainly that passing it establishes neither replacement nor alternative support. THE `withdrawn_at` FIELD IS COLLECTED AND NOT ASSERTED, AND THE REASON IS THE SAME ONE THAT KEEPS THE EXTERNAL-SYSTEM NOTE SHARP. An advisory can be withdrawn after this evidence was collected, which retroactively changes what a dated report meant. Nothing in the provider's system moved. It is read so a human comparing two months of this report can tell a fixed component from a withdrawn advisory, and it is not asserted because a recipe that failed on withdrawn advisories would be failing the provider for the database's corrections. CADENCE IS `monthly` RATHER THAN `continuous`, AND THAT IS A CLAIM ABOUT THE HUMAN STEP RATHER THAN ABOUT THE PLATFORM. The alert stream underneath is continuous and the sibling recipe on SR-06 collects it that way. What SA-22 asks for is a review of an inventory against published lifecycle dates, and that reconciliation is an act somebody performs on a schedule; exporting the SBOM is the same kind of act. A provider running it continuously has not done anything wrong, and one collecting the alerts continuously while never exporting the inventory has met the sibling recipe and not this one. KSI-SCR-MIT is the only indicator that reaches this control, and it is claimed for the identification limb of its own statement — persistently identify, review and mitigate potential supply chain risks — with the review and mitigation limbs left to the human step `scan_scope` names. ## References - {"title":"GitHub REST: export a software bill of materials for a repository — GET /repos/{owner}/{repo}/dependency-graph/sbom, returning an SPDX document under a required `sbom` key with required `SPDXID`, `spdxVersion`, `creationInfo`, `name`, `dataLicense`, `documentNamespace` and `packages`; each package documented with `name`, `versionInfo`, `downloadLocation`, `filesAnalyzed`, `licenseConcluded`, `licenseDeclared`, `supplier`, `copyrightText` and `externalRefs` entries of `{referenceCategory, referenceLocator, referenceType}`. Read access to the repository is what the endpoint requires, and there is no organization-scoped form","url":"https://docs.github.com/en/rest/dependency-graph/sboms"} - {"title":"GitHub REST: Dependabot alerts — GET /orgs/{org}/dependabot/alerts and the repository form; `state` open | dismissed | fixed | auto_dismissed, `dismissed_reason` fix_started | inaccurate | no_bandwidth | not_used | tolerable_risk, `dismissed_comment` documented required, string or null, max 280 characters, and `security_advisory.vulnerabilities[]` carrying `vulnerable_version_range` and a `first_patched_version` documented \"object or null\". The `has` filter is documented as supporting only `patch` on the repository form and is left unenumerated on the organization form this recipe calls, which is why the no-patch narrowing is client-side on either. Organization owner or security manager, `security_events` scope","url":"https://docs.github.com/en/rest/dependabot/alerts"} - {"title":"GitHub REST: code security configurations — `dependency_graph` enabled | disabled | not_set defaulting to ENABLED and `dependabot_alerts` the same enum defaulting to DISABLED, the asymmetry two clauses in this recipe are written around; `target_type` global | organization | enterprise, `enforcement` enforced | unenforced, and the repositories endpoint whose `status` accepts all | attached | attaching | detached | removed | enforced | failed | updating | removed_by_enterprise and defaults to `all`","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: dependency graph supported package ecosystems — the per-ecosystem manifest and lock files the graph recognises, and its own statement that the recommended files \"explicitly define which versions are used for all direct and all indirect dependencies\". Read for what it does NOT recommend: Gradle carries no recommended file unless dependencies arrive through automatic submission, and a project resolving from an unpinned manifest is the case where an indirect component reaches the SBOM as a version range rather than a pinned version","url":"https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/dependency-graph-supported-package-ecosystems"} - {"title":"GitHub: exporting a software bill of materials for your repository — the SBOM as \"an inventory of a project's dependencies and associated information such as versions, package identifiers, licenses, transitive paths, and copyright information\", and its documented exclusion that \"SBOMs do not include dependents (other projects that rely on your project)\"","url":"https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exporting-a-software-bill-of-materials-for-your-repository"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the system this recipe is being run for; SA-22 reaches class b, c and d, so the gap between a product's listed level and a reader's own is the SA-09 question this recipe's external-system note raises and does not answer","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/error-handling-information-exposure-scanning # Whether the queries that find information disclosure through an error message or a stack trace ran over this part of the boundary — which languages were selected, whether the recurring scan is still scheduled and when it last completed — and then the open findings those queries produced, identified by the CWE tags the queries carry rather than by their names. The run record is the load-bearing half here as it is on every scanning recipe: a finding names a leak that exists, and only the record of a scan having run over a selected language makes the absence of findings a statement about anything. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/error-handling-information-exposure-scanning Recipe id: `error-handling-information-exposure-scanning` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-CNA-MAT` - control `si-11` ## Collection Kind: `api` ```sh # configurations gh api --paginate "/orgs//code-security/configurations" # configuration-repositories gh api --paginate "/orgs//code-security/configurations//repositories?status=attached,enforced&per_page=100" # default-setup gh api "/repos///code-scanning/default-setup" # analyses gh api --paginate "/repos///code-scanning/analyses?tool_name=CodeQL&ref=refs/heads/&per_page=100" # alerts-open gh api --paginate "/orgs//code-scanning/alerts?state=open&tool_name=CodeQL&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `configurations` is the first, `configuration-repositories` the second, `default-setup` the third, `analyses` the fourth and `alerts-open` the fifth. RUN COMMANDS 3 AND 4 ONCE PER REPOSITORY, and read the run-record clauses ONCE PER ANALYSED LANGUAGE. Neither default setup nor analyses has an organization-scoped endpoint; the alerts endpoint does and returns the owning `repository` on each alert, so the findings arrive in one walk while the run record is assembled a repository at a time. `` in the two run-record clauses is a placeholder the collector fills once per entry in `default-setup.languages`, read off the `category` field of the response rather than constructed — GitHub documents `category` as what distinguishes analyses "for the same tool and commit, but performed on different languages or different parts of the code", the analyses endpoint has no `category` filter, and on a multi-language repository the newest unfiltered row is whichever language finished last. The command pins `ref` to the default branch for the same class of reason. From `default-setup`, `state` (`configured | not-configured`), `languages`, `query_suite`, `schedule` and `updated_at`. From `analyses`, `ref`, `commit_sha`, `analysis_key`, `environment`, `category`, `created_at`, `results_count`, `rules_count`, `tool` (name, version, guid), `sarif_id`, `deletable` and `warning`. From `alerts-open`, alerts whose `rule` object carries `id`, `name`, `severity`, `security_severity_level`, `description`, `full_description` and `tags` — that last array is what the CWE clause reads. CodeQL puts CWE classification there in the form `external/cwe/cwe-209`, and three query help pages were fetched for this recipe to establish that the error-handling queries carry it: `js/stack-trace-exposure` ("Information exposure through a stack trace", severity warning, security severity 5.4), `java/stack-trace-exposure` (same name, severity error, security severity 5.4) and `py/stack-trace-exposure` ("Information exposure through an exception", severity error, security severity 5.4). All three carry both `external/cwe/cwe-209` and `external/cwe/cwe-497` — alongside a plain `security` tag, so the array holds three entries and the two this recipe joins on are not the whole of it — and all three are listed in their language's `*-code-scanning.qls` suite as well as the extended and quality suites — which is the fact that entitles this recipe to be run against a default-setup repository at all rather than only against one that opted into `security-extended`. Two properties of `tags` decide how the clause below is written, and both are inherited from the sibling input-validation recipe rather than rediscovered. It is documented "array of string or null", and a null array is the case a `contains()` filter cannot state an opinion about, so a separate guard counts the rows that have no array at all. And the alerts endpoint has NO server-side tag filter — the organization-scoped form's documented filters are `tool_name`, `tool_guid`, `state`, `severity`, `sort`, `direction` and `assignees`, with `ref` available on the repository form only — so the CWE narrowing is client-side over a FULL paginated walk, and a collector that fetches one page of thirty and filters it has produced a smaller answer rather than a filtered one. ## Assertions - {"field":"default-setup.state","op":"eq","value":"configured","controls":["si-11"],"description":"This repository has code scanning configured, read from the repository itself rather than from an organization configuration that claims to govern it. First clause because it is the precondition for every other statement here: on `not-configured` the analyses list is empty, the CWE clause is vacuously green, and the recipe has measured nothing at all."} - {"field":"default-setup.languages[?@==''] | [0]","op":"exists","controls":["si-11"],"description":"The language this part of the boundary's error-handling code is written in is among those default setup selected. Read once per language on the provider's own list of implementation languages, which is external to every response here and is the whole point: `languages` is a selection, and a repository whose Go service was never selected reports `configured`, stays scheduled, returns fresh analyses and says nothing whatsoever about where that service writes its stack traces. This is the only limb of SI-11's coverage question that is writable, and it is writable only because the comparison value comes from outside."} - {"field":"default-setup.schedule","op":"eq","value":"weekly","controls":["si-11"],"description":"The recurring scan for this repository is still scheduled. GitHub documents the weekly schedule disabling itself after six months without a push or pull request, so a quiet boundary repository reports `configured`, has a real analysis history and is no longer being analysed. This clause is what entitles the freshness clause below to read a gap as a missed scan rather than as a repository nobody touched. The clause is `eq weekly` rather than a range because the documented enum for `schedule` is exactly `weekly` or `null`: default setup cannot express another cadence, so the only state this fails is a repository whose recurring scan is off. A repository on some other cadence is running advanced setup, and it fails the `default-setup.state` clause above before reaching this one."} - {"field":"analyses[?category==''] | [0].created_at","op":"max_age_days","value":7,"controls":["si-11"],"description":"The most recent CodeQL analysis FOR THIS LANGUAGE on the default branch is no more than seven days old. Seven comes from the `schedule: weekly` field asserted above, not from a sentence in the workflow documentation, which is scoped to the analysis workflow advanced setup installs and which a default-setup repository has no copy of. The category filter is load-bearing rather than tidy: the endpoint has no `category` filter and position zero of the unfiltered list is whichever language finished last, so on a multi-language repository an unfiltered clause can be satisfied by a run that never touched the code carrying the risk."} - {"field":"alerts-open[?rule.tags==`null`]","op":"count_eq","value":0,"controls":["si-11"],"description":"Every open alert carries the tag array the CWE clause below reads. A guard rather than a finding about the code: `tags` is documented \"array of string or null\", and a `contains()` filter over a null array is the case an evaluator either raises on or quietly drops — and inside an offender-form `count_eq 0` clause, dropping the row makes the result GREENER. The failing row has to be present-and-false before the clause after it can be read."} - {"field":"alerts-open[?contains(rule.tags,'external/cwe/cwe-209') || contains(rule.tags,'external/cwe/cwe-497')]","op":"count_eq","value":0,"controls":["si-11"],"description":"No open alert names an information-disclosure-through-error-handling weakness: CWE-209, information exposure through an error message, and CWE-497, exposure of sensitive system information. Both tags are asserted because the queries themselves carry both — verified on the JavaScript, Java and Python stack-trace-exposure query help pages — so narrowing to CWE-209 alone would assert less than the ruleset does. Offender form over a list built to hold offenders, and readable only once the guard above has established that every row has a tag array to test. It says the queries found no such path; whether a message that IS returned reveals something exploitable is the judgement the notes reserve for a human."} ## Outside the boundary Platform: GitHub Enterprise Cloud The analysis engine, the queries it ran and the findings it produced are held and operated by a third party, so reading them brings the platform into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. As on the sibling code-scanning recipes the dependency is sharper than the usual one, because the EVIDENCE ITSELF is a property of someone else's ruleset: what counts as a stack trace reaching a response is decided by queries the provider does not write, version or necessarily read, and a query-pack update can change what a clean result means without anything in the provider's system changing. What is handed over is the source code and a list of the places it leaks internals. SI-11 sits in the class c and class d baselines, so every reader of this recipe is running a Moderate or High system, and the impact level a platform's Marketplace listing carries is not necessarily the one those systems need — that is the SA-09 question, it is answered by reading the cited listing, and no value for it is written here because it is a dated fact that changes. This recipe was authored against GitHub Enterprise Cloud; github.com and the data-residency offering are different deployments on different infrastructure. ## Notes SI-11 has two limbs and this plane can see one of them. Error messages must provide the information necessary for corrective actions without revealing information that could be exploited, and they must be revealed only to defined personnel. The first is code, and a query that traces an exception to a response is real telemetry about it. The second is a runtime access decision — who can read the response, who can read the log the trace landed in — and no code scan observes it. This recipe is rated `partial` for the first limb alone and claims nothing about the second, which is what the register's disposition for this control said before it was authored and remains true after. WHETHER A PARTICULAR MESSAGE REVEALS EXPLOITABLE INFORMATION IS THE JUDGEMENT NOBODY AUTOMATES, AND THE QUERY DOES NOT PRETEND OTHERWISE. `js/stack-trace-exposure` finds a stack trace reaching an HTTP response; whether that trace names an internal host, a query fragment and a framework version, or says only that something failed, is a human reading of the finding. The clause below is offender form over the alerts those queries raised, so a green result is "the queries found no such path" — a narrower sentence than the control's, and the gap between them is the rating. WHY THE CWE TAGS AND NOT THE QUERY NAMES. `rule.id` is stable per query and per language, so a clause naming `js/stack-trace-exposure` would be green on a Java service by construction. The tag array is the language-independent join: the three query help pages fetched for this recipe — JavaScript, Java and Python — each carry `external/cwe/cwe-209` and `external/cwe/cwe-497`, so one clause covers those three without naming a query per language. It covers those three and not the whole enum, which the paragraph below states as a residue rather than leaving it to be inferred from the word "regardless". CWE-497 is included beside CWE-209 because the queries themselves carry both and dropping it would narrow the clause below what the ruleset actually asserts. THE RULESET-COVERAGE RESIDUE IS THE SAME ONE THE SIBLING RECIPE DOCUMENTED AND IT IS A PROPERTY OF THE API. The clause an assessment wants is "a query for CWE-209 was in this run", and it is not writable: `rule.tags` exists only on alerts that exist, so the tags are visible exactly when something was found and invisible in the case where the claim matters, and `rules_count` counts rules without naming them. What partially closes it here and did not close it there is the query-suite membership: the three pages fetched list these queries in `javascript-code-scanning.qls`, `java-code-scanning.qls` and `python-code-scanning.qls`, which is the DEFAULT suite, so a default-setup repository in one of those languages ran them. THREE OF THE NINE LANGUAGES DEFAULT SETUP ACCEPTS, AND SIX THAT WERE NOT CHECKED. The documented `languages` enum is `actions`, `c-cpp`, `csharp`, `go`, `java-kotlin`, `javascript-typescript`, `python`, `ruby` and `swift`, and the suite-membership fact above was established for JavaScript, Java and Python only. On a c-cpp, csharp, go, ruby, swift or actions repository the run-record clauses below pass and the CWE clause is green with nothing verified about whether a CWE-209 query was in that language's default suite at all. Whether equivalent tagged queries exist there was not fetched, is not claimed, and is the first thing to close if this recipe is extended. That is a published fact about the suite rather than an inference from the response, it is cited, and it is why `query_suite` is collected and not asserted — requiring `extended` would be authoring a preference as a control, and the queries this recipe reads are in the default suite anyway. THE SEVEN-DAY FRESHNESS CLAUSE TAKES ITS NUMBER FROM THE PLATFORM AND NOT FROM THE CONTROL. Seven is what `schedule: weekly` means, asserted a clause earlier so that a gap reads as a missed scan rather than as a repository nobody pushed to; GitHub documents the weekly schedule switching itself off after six months without a push or pull request, which is how a quiet boundary repository stays `configured`, keeps a real analysis history and is no longer analysed. On an actively developed repository the gap closes by itself because default setup also scans on pushes and pull requests. THE DEFAULT-BRANCH LIMIT APPLIES AS IT DOES ACROSS THIS PLATFORM. Alert status reflects the default branch, the organization-scoped alerts endpoint takes no `ref` filter, and the analyses command pins `ref` for that reason. This is a default-branch statement about a repository, not a repository-wide one. TWO OF THE THREE INDICATORS THAT REACH THIS CONTROL ARE DELIBERATELY NOT CLAIMED. KSI-MLA-ALA — authorizing log access — is SI-11's second limb almost exactly, and it is the limb this plane cannot see at all; crediting a code scan with it would be the clearest possible case of dressing a document up as a command. KSI-PIY-RSD is declined for the reason the input-validation recipe already gave when it declined the same indicator: a scan record is an input to a review of the SDLC's effectiveness rather than the review itself. KSI-CNA-MAT is claimed because a stack trace reaching a response is attack surface in the indicator's own terms — it hands an attacker internal paths, versions and structure, which is reconnaissance for exactly the lateral movement the indicator asks to be minimized — and because a recurring analysis over a named repository set is the persistent review it asks for. ## References - {"title":"GitHub REST: code scanning — GET /orgs/{org}/code-scanning/alerts, GET /repos/{owner}/{repo}/code-scanning/analyses and GET /repos/{owner}/{repo}/code-scanning/default-setup; alert `state` open | closed | dismissed | fixed, `dismissed_reason` false positive | won't fix | used in tests | mitigated, and a `rule` object carrying `id`, `name`, `severity`, `security_severity_level`, `description`, `full_description` and `tags`. The organization-scoped alerts endpoint's documented filters are `tool_name`, `tool_guid`, `state`, `severity`, `sort`, `direction` and `assignees` — no tag filter, which is why the CWE narrowing in this recipe is client-side, and no `ref` either, which is why this recipe's default-branch caveat is a caveat rather than a parameter. `ref` exists on the repository form of the endpoint only. Analyses carry `ref`, `commit_sha`, `analysis_key`, `environment`, `category`, `created_at`, `results_count`, `rules_count`, `tool`, `sarif_id`, `deletable` and `warning`. `security_events` scope","url":"https://docs.github.com/en/rest/code-scanning/code-scanning"} - {"title":"CodeQL query help: js/stack-trace-exposure, \"Information exposure through a stack trace\" — severity warning, security severity 5.4, tags `external/cwe/cwe-209` and `external/cwe/cwe-497`, listed in javascript-code-scanning.qls as well as the security-extended and security-and-quality suites. The default-suite membership is what lets this recipe be run against a default-setup repository rather than only against one that opted into an extended suite","url":"https://codeql.github.com/codeql-query-help/javascript/js-stack-trace-exposure/"} - {"title":"CodeQL query help: java/stack-trace-exposure, \"Information exposure through a stack trace\" — severity error, security severity 5.4, precision high, tags `external/cwe/cwe-209` and `external/cwe/cwe-497`, listed in java-code-scanning.qls, java-security-extended.qls and java-security-and-quality.qls. Fetched alongside the JavaScript and Python pages to establish that the tag pair is language-independent, which is the reason this recipe joins on tags rather than on `rule.id`","url":"https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/"} - {"title":"CodeQL query help: py/stack-trace-exposure, \"Information exposure through an exception\" — severity error, security severity 5.4, tags `external/cwe/cwe-209` and `external/cwe/cwe-497`, listed in python-code-scanning.qls, python-security-extended.qls and python-security-and-quality.qls","url":"https://codeql.github.com/codeql-query-help/python/py-stack-trace-exposure/"} - {"title":"GitHub REST: code security configurations — `code_scanning_default_setup` enabled | disabled | not_set defaulting to disabled, `target_type` global | organization | enterprise, `enforcement` enforced | unenforced, and the repositories endpoint whose `status` accepts all | attached | attaching | detached | removed | enforced | failed | updating | removed_by_enterprise and defaults to `all` — the default this recipe's enumeration narrows away from so that unreached repositories are not counted as covered","url":"https://docs.github.com/en/rest/code-security/configurations"} - {"title":"GitHub: configuring default setup for code scanning — the languages and query suite are a selection made per repository, and the documented behaviour that \"If no pushes and pull requests have occurred in a repository with default setup enabled for 6 months, the weekly schedule will be disabled to save your GitHub Actions minutes\", which is what the schedule clause in this recipe exists to catch","url":"https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the class c and class d systems SI-11 applies to; a certification status is a dated fact about a product, not about your deployment","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/infrastructure-policy-scan-coverage-and-deviations # Which policy decisions were actually enforced against the infrastructure definitions the boundary deploys from: that a policy scan ran, on which branch, how many rules it applied and when it last ran, together with the failures still open and the record of which were dismissed and with what justification. The load-bearing half is the scan record rather than the findings. SA-08 asks whether security engineering principles were applied, and a clean findings list is the same output whether every principle held or the scan applied no rules, ran last quarter, or parsed nothing — so the count of rules run and the date it ran are the part of this evidence that makes the rest of it mean anything. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/infrastructure-policy-scan-coverage-and-deviations Recipe id: `infrastructure-policy-scan-coverage-and-deviations` · cadence continuous · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-PIY-RSD` - control `sa-8` ## Collection Kind: `cli` ```sh # checkov-version checkov --version # checkov-sarif checkov -d --framework terraform --output sarif --output-file-path # checkov-json checkov -d --framework terraform --output json --output-file-path # repos gh api --paginate "/orgs//repos?per_page=100" # analyses gh api --paginate "/repos///code-scanning/analyses?tool_name=&ref=refs/heads/&sort=created&direction=desc&per_page=100" # alerts-open gh api --paginate "/repos///code-scanning/alerts?state=open&tool_name=&ref=refs/heads/&per_page=100" # alerts-dismissed gh api --paginate "/repos///code-scanning/alerts?state=dismissed&tool_name=&ref=refs/heads/&per_page=100" ``` ## Expected output Report names used below, and the command each comes from: `version` is the first, `sarif` the second, `scan-json` the third, `repos` the fourth, `analyses` the fifth, `alerts-open` the sixth and `alerts-dismissed` the seventh. EVERY REPORT EXCEPT `repos` IS ONE REPOSITORY'S. This recipe is run per repository and the reports are read together, which is a correction rather than a preference: an earlier form of it read the ORGANIZATION alert endpoints beside the repository analyses endpoint, so the existence guard below held for one repository while three offender counts ranged over forty. A guard and the counts it guards have to read the same population or the guard is decoration. `repos` stays organization-scoped because it is the enumeration — it is the list this recipe is run ONCE PER ENTRY OF, and the reconciliation between that list and the repositories that produced an analysis is the coverage step `scan_scope` names. `` IS NOT A CONSTANT AND MUST NOT BE GUESSED. The value the two alert commands and the analyses command filter on is the SARIF `tool.driver.name` the scanner emitted, which is a property of the scanner's output and is not documented on any page cited here. Read it once from an UNFILTERED analyses list for the repository — the same call with `tool_name` dropped — and use what is there. A filter naming a tool that never uploaded returns an empty list, and every offender count below is then green for the most banal possible reason. From `analyses`, GitHub documents `ref`, `commit_sha`, `analysis_key`, `environment`, `category`, `error`, `created_at`, `results_count`, `rules_count`, `id`, `url`, `sarif_id`, `tool` with `name`, `version` and `guid`, `deletable` and `warning`. Two of those carry documented caveats this recipe is written around. `rules_count` is "the number of rules that were run in the analysis", and the page adds that "For very old analyses this data is not available, and 0 is returned in this field". And the endpoint carries a closing-down notice for the `tool_name` field in its RESPONSE; the request-side filter is a separate parameter and the durable selector for a set of results is `tool.guid` or the analysis `category`, so treat the tool-name filter as a spelling to re-verify at collection time rather than as a stable key. `sort` is documented with a default of `created`, and the fifth command requests the ordering explicitly rather than relying on it. From `alerts-open` and `alerts-dismissed`, `number`, `created_at`, `updated_at`, `state` (documented in the RESPONSE as `open | dismissed | fixed | null`; `closed` is a value the request filter accepts and is not a state an alert comes back in, and the two enums are worth keeping apart for the same reason a console label and a rule identifier are), `fixed_at`, `dismissed_by`, `dismissed_at`, `dismissed_reason` (documented required, string or null, `false positive | won't fix | used in tests | mitigated | null` — FIVE values, and `mitigated` is the one an earlier reading of this page missed), `dismissed_comment` (documented string or null, maximum 280 characters), `rule` carrying `id`, `name`, `severity`, `security_severity_level` (`low | medium | high | critical`), `description`, `full_description`, `tags`, `help` and `help_uri`, `tool` with `name`, `version` and `guid`, `most_recent_instance` and `repository`. `severity` and `security_severity_level` are DIFFERENT fields on the same rule — the first is the SARIF level the scanner emitted, the second is the security scale GitHub populates from the SARIF `security-severity` property — and a third-party SARIF that omits that property leaves the second unset. A clause narrowing on it would then read a population that excludes exactly those alerts, which is why the unset case is asserted separately below rather than assumed away. `sarif` is the artifact the scan uploads and is not read directly by any clause here; the upload path is the `upload-sarif` action or the code scanning SARIF endpoint, and GitHub documents that it calculates `partialFingerprints` when the file omits them and that each uploaded file needs a unique `runAutomationDetails.id` so its results are a distinguishable set. `scan-json` and `version` are collected for the human step and are deliberately unasserted — see `notes`. ## Assertions - {"field":"analyses | [0].id","op":"exists","controls":["sa-8"],"description":"At least one policy-scan analysis exists for this repository's default branch. Every other clause here is an offender count over a list this repository produced, and a repository that has never uploaded a SARIF returns an empty one for all of them: no analysis, no alert, no finding, and four `count_eq 0` clauses go green on infrastructure code that was never scanned. This is the positive clause that makes that state fail, and it only makes it fail because every report it guards is scoped to the same repository — an earlier form of this recipe read the ORGANIZATION alert endpoints here, which left the guard true of one repository while the counts ranged over all of them, so a single scanned repository could carry thirty-nine unscanned ones to green. Within one repository the guard now holds. ACROSS the boundary nothing here holds: the analyses endpoint is repository-scoped by construction, so coverage is a per-repository question and its reconciliation against the boundary's repository list is the human step `scan_scope` names."} - {"field":"analyses | [0].created_at","op":"max_age_days","value":30,"controls":["sa-8"],"description":"The most recent analysis on the default branch ran within the last 30 days. A scan whose last run predates the current infrastructure is reporting on code that is no longer deployed, and it reports it as a clean list. Because every other report in this recipe is now scoped to the same repository and the same branch ref, this date is the currency of the whole reading rather than of the scan record alone — which is what the `evidence` field claims for it. The command requests `sort=created&direction=desc` rather than relying on the documented default of `created`, and it is worth stating what happens if the ordering is not honoured: the clause then reads an arbitrary analysis rather than the newest one, so it fires when it should not have. Over-firing is the direction to accept here — a false alarm sends a reader to look, and the alternative failure sends nobody."} - {"field":"analyses[?rules_count==`0`]","op":"count_eq","value":0,"controls":["sa-8"],"description":"No analysis on this branch applied zero rules. `rules_count` is documented as \"the number of rules that were run in the analysis\", and a scan that ran with an empty or narrowed-to-nothing policy pack — a `--check` filter that matched no policy, a framework selection that matched no files — produces no results and cannot fail, which arrives at the alert list looking exactly like a compliant estate. This clause is the difference between the two. It carries a documented over-fire and the documentation is where it comes from: \"For very old analyses this data is not available, and 0 is returned in this field\", so a repository whose history reaches back far enough will fire this on its oldest rows. That residue is named here rather than filtered out, because the filter that would remove it is a date cutoff and a date cutoff would also remove the case the clause exists for."} - {"field":"alerts-open[?rule.security_severity_level=='high' || rule.security_severity_level=='critical']","op":"count_eq","value":0,"controls":["sa-8"],"description":"No open high or critical policy failure remains against the boundary's infrastructure code. This is the implementation limb of SA-08 in the only form a pipeline emits it: a rule that fails a publicly readable store or an over-broad role is telemetry about a layered-protection or least-privilege principle not holding in the artifact being deployed. `security_severity_level` is documented `low | medium | high | critical`. It is a rule-level property rather than a finding-level judgement, so the clause inherits the scanner's severity opinion wholesale — a policy the provider considers critical and the tool rates medium passes here, and that mapping is part of the selection `scan_scope` says nobody has written down."} - {"field":"alerts-open[?rule.security_severity_level==`null`]","op":"count_eq","value":0,"controls":["sa-8"],"description":"No open alert from this scanner arrives without a security severity. This clause exists because of the one above rather than beside it. GitHub populates `security_severity_level` from the SARIF `security-severity` property, and a third-party SARIF that omits it leaves the field unset — so a scanner whose output carries no severities produces alerts that match neither `high` nor `critical`, and the severity clause reads a population that excludes every finding the tool emitted. The literal-null comparison catches an explicit null and an absent key alike, and a failure here means the severity clause above should be read as having asserted nothing yet."} - {"field":"alerts-dismissed[?dismissed_comment==`null`]","op":"count_eq","value":0,"controls":["sa-8"],"description":"No policy failure was dismissed without a written justification. `dismissed_comment` is documented as string or null with a maximum of 280 characters, so the literal-null comparison catches both an explicit null and an absent key and the failing row is present-and-false rather than dropped from the projection. A dismissal is where a principle is knowingly set aside in a named place, and the reason field is the only record of why; `won't fix` with an empty comment is a deviation nobody wrote down. Passing establishes that somebody typed a reason and establishes nothing about whether the reason was sound."} ## Outside the boundary Platform: GitHub Enterprise Cloud Two third parties, and they fail differently. The platform holds the results, so reading them brings it into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. The POLICY CONTENT is the second and the sharper one: what counts as a violated security engineering principle here is decided by a rule pack somebody else writes and versions, so a policy added, retired or retuned upstream changes what this output says with nothing in the provider's system having moved — the same shape SA-22's advisory database has, arriving one layer further up, in the definition of the finding rather than in the finding. SA-08 sits in the class b, class c and class d baselines, so it reaches every reader of this product including Low systems, and the impact level a platform's Marketplace listing carries is not necessarily the one a given system needs — that is the SA-09 question, it is answered by reading the cited listing rather than by this sentence, and no value for it is written here because it is a dated fact that changes. Authored against GitHub Enterprise Cloud; github.com and the data-residency offering are different deployments on different infrastructure. AND THE EVIDENCE HERE IS BEHIND A SEPARATE ENTITLEMENT, WHICH IS A PURCHASING FACT RATHER THAN A CAVEAT. GitHub states that "If you want to use code scanning on private repositories, you need a GitHub Code Security license", and every repository inside an authorization boundary is private. A reader on this platform without that licence does not get a thinner version of this evidence; they get no alerts endpoint to read, which is a different failure from the vacuity this recipe documents at length and is worth finding out before authoring a workflow. The scanner itself is run by the provider on its own runners and is the one part of this recipe that is not somebody else's system — which is also why its configuration, and not the platform's, is where this evidence is most easily made vacuous. ## Notes WHY PARTIAL, STATED AGAINST THE CONTROL'S OWN LIMBS. SA-08 requires the principles to be applied in specification, design, development, implementation and modification. Implementation is the limb a pipeline can see — a rule that fails a world-readable bucket or an over-broad role is telemetry about layered protection or least privilege actually holding in the artifact being deployed — and it is one limb of five. Which principles were selected, and how they were applied in specification and design, is an SDLC document; a passing rule evidences A principle without naming the one that was chosen. The dataset in this repo carries no FedRAMP-specific parameter or guidance for SA-08 at all, so there is no organization-defined value here to read a selection out of, which is the same absence SA-22 has and it lands in the same place: the selection is the provider's to write down. THE INLINE SUPPRESSION BLIND SPOT, AND IT IS THE LARGEST ONE HERE. Checkov's documented suppression syntax is a comment of the form `checkov:skip=:`, and the documentation is explicit that the comment is OPTIONAL. A check suppressed that way is not a finding: it produces no SARIF result, so it never becomes an alert, so no clause in this recipe can see it, and the suppression can carry no stated reason at all. The dismissal clause below reads dismissals made in the PLATFORM, which is a different act by a different person leaving a different record. A boundary can therefore hold a green alert list and a repository full of skips, and the two facts are collected by different commands here on purpose. WHY `scan-json` AND `version` ARE COLLECTED AND NOT ASSERTED. The third command is how a reader enumerates the skipped checks the paragraph above describes, along with parse errors and the resource count — the scan that parsed nothing is the vacuity case that reaches the alert list looking identical to the clean one. No clause reads it, because Checkov's JSON schema is not documented on any page cited here, and this repo does not assert over field names it has not verified. That is a limit of the citation and it is written down rather than papered over with a plausible path; a batch that fetches a schema for it can add the clauses and should. `--soft-fail` IS THE OTHER WAY THIS GOES GREEN. Checkov documents `--soft-fail` as "Runs checks but always returns a 0 exit code". A workflow can run the scan, upload the SARIF, populate every report this recipe reads, and never block a merge. Nothing in the analyses or alerts output says whether the scan gates anything — that question is a ruleset question and it belongs to the sibling recipes on CM-04 (02) and SA-10, which read required status checks and rule suites directly. Read this recipe as evidence that the policy scan RUNS and what it FINDS, never as evidence that a failing policy stops a deployment. WHAT THE DISMISSAL CLAUSE ESTABLISHES. `dismissed_reason` is documented required, string or null, with five values: `false positive`, `won't fix`, `used in tests`, `mitigated` and null. An earlier reading of that page recorded three of them and built this paragraph on `won't fix` alone, which was the wrong shape twice over — the enum was short, and `mitigated` is a direct competitor for the role the paragraph was giving `won't fix`. Both are records that a policy failure was closed by a decision rather than by a fix, and they say different things: `won't fix` is a principle deliberately not satisfied in a named place, `mitigated` is a claim that something else covers it, and THAT claim is a compensating-control argument no field here carries the text of. Between them they are the closest thing this plane holds to a recorded deviation, and the clause below asserts of both only that a justification was typed. The clause asserts that a justification was TYPED, not that it was a good one, and a dismissal with a written reason is unambiguously better evidence than one without — which is all it claims. KSI-PIY-RSD is the only indicator that reaches this control. Its statement is about the effectiveness of building security into the SDLC being PERSISTENTLY REVIEWED, and the review is a human act on a schedule; what this recipe supplies is the material that review reads and the evidence that the material is current. ## References - {"title":"Checkov: what is Checkov — \"a static code analysis tool for scanning infrastructure as code (IaC) files for misconfigurations that may lead to security or compliance problems\", covering Terraform, CloudFormation including AWS SAM, Azure Resource Manager, Serverless framework, Helm, Kubernetes and Docker, with \"more than 750 predefined policies to check for common misconfiguration issues\" and custom policies authored in Python or YAML","url":"https://www.checkov.io/1.Welcome/What%20is%20Checkov.html"} - {"title":"Checkov: CLI command reference — `--directory`/`-d` as the IaC root, `--framework` enumerating terraform, terraform_plan, cloudformation, kubernetes, helm, dockerfile, github_actions, secrets, sca_package and the rest, `--output`/`-o` accepting cli, csv, cyclonedx, cyclonedx_json, spdx, json, junitxml, github_failed_only, gitlab_sast and sarif, `--output-file-path`, `--check`/`--skip-check` by id or severity, and `--soft-fail`: \"Runs checks but always returns a 0 exit code\"","url":"https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html"} - {"title":"Checkov: suppressing and skipping policies — the inline comment form `checkov:skip=:`, in which the suppression comment is documented as OPTIONAL, and the skipped result the scan then reports instead of a finding. Read for what it means downstream: a suppressed check produces no SARIF result and therefore no code scanning alert","url":"https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html"} - {"title":"GitHub REST: code scanning — the alerts endpoints and their `tool_name`, `tool_guid`, `state`, `ref` and `severity` filters; alerts carrying a response `state` of open | dismissed | fixed | null (the request filter additionally accepts `closed`, which is not a state an alert returns in), `dismissed_reason` documented required, string or null, with the five values false positive | won't fix | used in tests | mitigated | null, `dismissed_comment` string or null with maxLength 280, and `rule.security_severity_level` low | medium | high | critical | null; and the repository analyses endpoint whose `rules_count` is \"the number of rules that were run in the analysis\" with the documented caveat that \"For very old analyses this data is not available, and 0 is returned in this field\", whose `sort` defaults to `created`, and which carries a closing-down notice for the `tool_name` field in its response","url":"https://docs.github.com/en/rest/code-scanning/code-scanning"} - {"title":"GitHub: about code scanning — \"Code scanning is interoperable with third-party code scanning tools that output Static Analysis Results Interchange Format (SARIF) data\", which is the path this recipe's scanner takes, and the entitlement that path sits behind: \"If you want to use code scanning on private repositories, you need a GitHub Code Security license\"","url":"https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning"} - {"title":"GitHub: uploading a SARIF file to GitHub — how a third-party scanner's results reach code scanning, through the `upload-sarif` action or the REST endpoint for results produced outside the repository; GitHub calculates `partialFingerprints` when the file omits them, and \"each SARIF file must include a unique `runAutomationDetails.id` to define the category for the results\" so multiple uploads remain distinguishable sets","url":"https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the system this recipe is being run for; SA-08 reaches class b, c and d, so the gap between a product's listed level and a reader's own is the SA-09 question this recipe's external-system note raises and does not answer","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"} --- ## https://ramprules.com/collect/mobile-code-admission-and-bundle-provenance # For a service that ships code to a browser, the two things a pipeline can say about the mobile code it delivers: what was allowed INTO it, and whether what shipped is what this pipeline built. The first is the dependency diff for the change — every component added, its ecosystem, its version, its licence and any advisory against it, separated by whether it reaches the runtime or stops at the build — and the gate that makes the check mandatory rather than advisory. The second is a provenance attestation over the built bundle, verified against the repository and workflow that are supposed to have produced it. Neither is a statement about which mobile code technologies the organization decided to permit, and that is the control's first limb. > FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14 > Canonical page: /collect/mobile-code-admission-and-bundle-provenance Recipe id: `mobile-code-admission-and-bundle-provenance` · cadence on-change · partial > **Authored opinion.** pipeline overlay v0.8.0, written > against dataset 2026.07.14.01. The upstream > FedRAMP rules name none of these tools; this mapping is ours. ## What it proves - KSI `KSI-PIY-RSD` - KSI `KSI-SCR-MIT` - control `sc-18` ## Collection Kind: `api` ```sh # repos gh api --paginate "/orgs//repos?per_page=100" # branch-rules gh api "/repos///rules/branches/" # dependency-review gh api "/repos///dependency-graph/compare/..." # verify-results gh attestation verify --repo / --signer-workflow //.github/workflows/ --format json ``` ## Expected output Report names used below, and the command each comes from: `repos` is the first, `branch-rules` the second, `dependency-review` the third and `verify-results` the fourth. From `branch-rules`, GitHub documents the endpoint as returning "all active rules that apply to the specified branch" — the effective set, which is what this recipe needs, because a rule can arrive from a repository ruleset or from an organization one and a reader asking whether the branch is gated does not care which. For the `required_status_checks` rule type the documented parameters are a required `required_status_checks` array of "Status checks that are required", each entry carrying a required `context` — "The status check context name that must be present on the commit" — and an optional `integration_id`, "The optional integration ID that this status check must originate from"; a required boolean `strict_required_status_checks_policy`, "Whether pull requests targeting a matching branch must be tested with the latest code" — whose documentation continues "This setting will not take effect unless at least one status check is enabled", which is why the clause asserting it is not the first clause in this recipe and why the existence clause that precedes it is not redundant with it; and an optional `do_not_enforce_on_create`. From `dependency-review`, the endpoint is `GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}` and `basehead` is documented as expecting the form `{base}...{head}`. Each returned change carries `change_type`, documented `added | removed`; required `manifest`, `ecosystem`, `name` and `version`; `package_url`, `license` and `source_repository_url`, each documented string or null; a required `vulnerabilities` array whose entries carry `severity`, `advisory_ghsa_id`, `advisory_summary` and `advisory_url`; and `scope`, documented `unknown | runtime | development`. From `verify-results`, the CLI documents `gh attestation verify [ | oci://] [--owner | --repo]`, so the same command verifies a built file and not only a registry image — which is the form this recipe needs, because a browser bundle is a file. With `--format json` it emits an array with one entry per verified attestation, each carrying `attestation` and a `verificationResult` holding the parsed bundle: `signature.certificate`, `verifiedTimestamps` and `statement`. `--signer-workflow` is documented as enforcing that the signing workflow matches `[host/]////`, and it is the flag that carries this clause's weight; `--predicate-type` defaults to `https://slsa.dev/provenance/v1`. ## Assertions - {"field":"branch-rules[?type=='required_status_checks'] | [0].parameters.required_status_checks | [0].context","op":"exists","controls":["sc-18"],"description":"At least one status check is REQUIRED to pass on the branch the delivered bundle is built from. This is the positive clause the two dependency clauses below depend on: both read a diff for a change that, on a branch with no such rule, could have been merged with the review job skipped, failing or never triggered — a check that runs and does not gate is not enforcement, and a report of its findings is not evidence of one. What the endpoint cannot say is WHICH context is the dependency review job: `context` is documented as \"The status check context name that must be present on the commit\" and that name is chosen by the provider's own workflow, so reconciling the listed contexts against the workflow that runs dependency review is the human step `scan_scope` names. The clause asserts a gate exists; the reader confirms it is this gate."} - {"field":"branch-rules[?type=='required_status_checks' && parameters.strict_required_status_checks_policy==`false`]","op":"count_eq","value":0,"controls":["sc-18"],"description":"No required-status-checks rule on this branch permits merging code that was not tested with the latest base. The parameter is documented and required — \"Whether pull requests targeting a matching branch must be tested with the latest code\", with the documentation adding that \"This setting will not take effect unless at least one status check is enabled\" — and with it false the check that passed may have run against a tree that is not the one that shipped. That second sentence is the reason the existence clause above is not redundant with this one: on a branch with no enabled check this parameter is inert whatever it says, so a `true` here is worth exactly as much as the clause above establishes. Mobile code is where that gap is least forgiving: the artifact the user's browser executes is built from the merged result, so a dependency admitted by a stale check is delivered without ever having been reviewed against what it was merged into. The literal comparison is to `false` rather than to `null`, and that is a choice the parameter's documented shape licenses rather than an oversight: it is required, so an absent key is not a state the endpoint returns. Were it to become optional, this clause would read the absent key as passing, which is the direction to watch."} - {"field":"dependency-review[?change_type=='added' && scope=='runtime' && length(vulnerabilities) > `0`]","op":"count_eq","value":0,"controls":["sc-18"],"description":"No component added into the runtime scope of this change carries a known advisory. `change_type` is documented `added | removed` and `scope` `unknown | runtime | development`, and the narrowing to added-and-runtime is what makes this a mobile code clause rather than a general dependency one: a development-scoped package is a build-time tool that is not delivered to a browser, and a removal cannot introduce anything. Offender form over a list built to hold offenders — `vulnerabilities` is a required array, so a clean component is present with an empty one rather than dropped, and the count is over rows that exist. It does NOT cover the whole delivered population on its own: `unknown` is the third documented value and a component that lands there is absent from this clause's rows rather than false in them, which is why the clause below exists. Read `notes` for what the runtime scope does not delimit even when it is populated."} - {"field":"dependency-review[?change_type=='added' && scope=='unknown' && length(vulnerabilities) > `0`]","op":"count_eq","value":0,"controls":["sc-18"],"description":"No component added with an UNDETERMINED scope carries a known advisory either. This clause is the audit correction of the batch and it is the same defect the sibling recipe on SA-08 guards against one file over, arriving through a different field: `scope` is documented `unknown | runtime | development`, an ecosystem that does not classify production against development resolves every component to `unknown`, and a clause narrowing to `runtime` then reads a population that excludes the entire change. A critical advisory on a delivered dependency passed the runtime clause silently, on a repository that had done nothing wrong — absent from the rows rather than false in them, which is the vacuity shape this plane's card opens with. Both clauses are needed rather than one merged clause over `scope!='development'`, because the two say different things to a reader: the one above is a finding about delivered code, and this one is equally a finding about an ecosystem whose scope metadata cannot be used to tell delivered from build-time at all."} - {"field":"dependency-review[?change_type=='added' && license==`null`]","op":"count_eq","value":0,"controls":["sc-18"],"description":"No component was admitted whose licence the platform could not determine. `license` is documented string or null, and the null is not a formality here: SC-18's first limb is a decision about which mobile code is acceptable, and an acceptability decision cannot be made about code whose terms are unknown. It is also the row an allow-list check must skip — the action's `allow-licenses` and `deny-licenses` operate on this same field, so an undeterminable licence passes a deny-list by being absent from it rather than by being permitted. Asserting it here rather than leaving it to the action is deliberate: the action's outcome is a check run's conclusion, and this report is the thing a reader can re-read a month later."} - {"field":"verify-results | [0].verificationResult.statement.subject","op":"exists","controls":["sc-18"],"description":"The verification returned at least one attestation whose parsed statement names the subject it covers. The subject is the digest of the delivered bundle, so this is the clause that ties the mobile code shipped to a build the platform signed for — the enforcement limb's \"signed by a trusted source\" in the only form this pipeline emits it. The clause is deliberately thin and the command carries the weight: `--repo` and `--signer-workflow` are what make a successful verification mean THIS repository and THIS workflow rather than an attestation existing somewhere for these bytes, and a reader who drops them has a green clause and a much weaker claim. It establishes provenance and integrity for the artifact and nothing about the behaviour of the code inside it."} ## Outside the boundary Platform: GitHub Enterprise Cloud The dependency metadata, the advisory data behind it, the signing infrastructure that issues the attestation and the trust root it is verified against are all held and operated by a third party, so reading them brings the platform into the assessment as an information resource under SA-09 and CA-03 and into the external-system inventory AC-20 covers. SC-18 makes the signing half pointed in a way the other pipeline recipes are not: the control's own discussion contemplates mobile code being digitally signed by a TRUSTED SOURCE, and the evidence that it was signed is produced, held and validated by the same third party whose trust root decides what trusted means. SC-18 sits in the class c and class d baselines and NOT in class b, so every reader of this recipe is a Moderate or High system, which sharpens rather than softens the SA-09 question: the impact level a platform's Marketplace listing carries is not necessarily the one a given system needs, and because this control starts at Moderate a reader here never matches a lower-listed offering by default. Read the cited listing and treat any gap as the SA-09 finding rather than as a footnote; no value for it is written here because it is a dated fact that changes, and a gap that is real today may be closed or widened by the time this recipe is run. The admission half is also behind a separate entitlement, which is a purchasing fact rather than a caveat: GitHub documents the dependency review action as "available for all public repositories, as well as private repositories that have GitHub Code Security or GitHub Advanced Security enabled", and every repository inside an authorization boundary is private. A reader without it does not get a weaker version of these two clauses; they get no diff to read. The attestation half carries no such gate on the pages cited here. Authored against GitHub Enterprise Cloud; github.com and the data-residency offering are different deployments on different infrastructure. ## Notes WHY PARTIAL, AGAINST THE CONTROL'S TWO LIMBS. SC-18 has a definition limb — establishing which mobile code technologies are acceptable — and an enforcement limb: authorizing, monitoring and controlling their use, with the discussion contemplating mobile code digitally signed by a trusted source. This plane reaches the second limb and cannot reach the first. A gate enforces an acceptability list and does not establish one, and no output collected here names a single decision about a technology. That is the same shape the sibling recipes on CM-03 (04) and SA-22 carry, and it is why this is `partial` rather than `full` even though two of its clauses are as mechanical as any in this overlay. DEPENDENCY REVIEW ONLY SEES PULL REQUESTS THAT TOUCH A MANIFEST. GitHub documents the feature for "pull requests that contain changes to package manifests or lock files". A change that alters the delivered mobile code without touching one — a vendored script edited in place, an inline handler added to a template, a CDN URL swapped in a page, a build configuration change that pulls a different chunk — produces a diff with no entries, and both dependency clauses below are then vacuously green over a change that did exactly what this control is about. The clauses are written in offender form so an empty result is empty rather than false, and this note is the honest reading of what an empty result means. WHAT `scope=='runtime'` DOES AND DOES NOT DELIMIT. The scope value is the ecosystem's own classification of a dependency as production or development, and for a browser bundle it is the closest available proxy for "ends up in the code the user's browser executes". It is a proxy: the mapping from a runtime-scoped package to bytes actually emitted belongs to the bundler, not the platform, and tree-shaking, lazy chunks and server-only imports all break it. Where the scope IS populated it breaks in the safe direction — more components are claimed as delivered than are delivered. Where it is not, it broke the other way and this recipe shipped the clause wrong until the audit: a component the ecosystem cannot classify resolves to `unknown`, falls outside a clause narrowed to `runtime`, and takes its advisories out of the count with it. That is now asserted separately rather than described, because a residue that hides findings is not a residue, and the sentence you are reading replaced one that claimed the failure direction was safe in both cases. WHY THE ATTESTATION CLAUSE IS THIN AND THE COMMAND IS NOT. The clause below is an existence check over a parsed statement, and nearly all of this evidence's weight is carried by the flags on the command that produced it: `--repo` scopes the attestation lookup and `--signer-workflow` is documented as enforcing that the signing workflow matches a named path. A reader who drops those flags gets a verification that proves an attestation exists somewhere for the bytes, which is a much weaker claim than the one this recipe describes. The sibling recipe `build-provenance-attestation-verification` reads the same machinery at depth on SI-07 (07), including the version-specific reason a clause has to read the parsed statement rather than trust the exit code, and this recipe deliberately does not repeat it. WHAT AN ATTESTATION CANNOT SAY, IN THE PLATFORM'S OWN WORDS. GitHub's page states that "artifact attestations are not a guarantee that an artifact is secure. Instead, artifact attestations link you to the source code and the build instructions that produced them", and that defining and evaluating the policy is the consumer's job. For SC-18 that is the right size of claim and is worth stating as a limit rather than as a caveat: the enforcement limb asks that mobile code be signed by a trusted source, and this establishes that the delivered bundle came from a named repository and workflow. It says nothing whatsoever about what the code in it does. TWO INDICATORS REACH THIS CONTROL AND THEY ARE CLAIMED FOR DIFFERENT HALVES. KSI-SCR-MIT — persistently identify, review and mitigate supply chain risks — is claimed for the admission half, where a component with a known advisory or an undeterminable licence is identified before it enters the delivered artifact. KSI-PIY-RSD, whose statement is about the effectiveness of building security into the SDLC being persistently reviewed, is claimed for the gate itself: a required check and a signed build are the SDLC's shape, and their persistent review is the human act neither clause performs. ## References - {"title":"GitHub REST: dependency review — GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead} with `basehead` documented in the form `{base}...{head}`; each change carrying `change_type` added | removed, required `manifest`, `ecosystem`, `name` and `version`, `package_url`, `license` and `source_repository_url` each string or null, a required `vulnerabilities` array of `{severity, advisory_ghsa_id, advisory_summary, advisory_url}`, and `scope` unknown | runtime | development","url":"https://docs.github.com/en/rest/dependency-graph/dependency-review"} - {"title":"GitHub: about dependency review — \"Dependency review lets you catch insecure dependencies before you introduce them to your environment, and provides information on license, dependents, and age of dependencies\", scoped to \"pull requests that contain changes to package manifests or lock files\", with the action's check failing by default \"if it discovers any vulnerable packages\"","url":"https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review"} - {"title":"GitHub: configuring the dependency review action — the enforcement options an acceptability list is expressed through: `fail-on-severity` accepting critical, high, moderate or low, `allow-licenses`, `deny-licenses`, `allow-ghsas`, `fail-on-scopes` accepting development, runtime or unknown, `config-file` and `external-repo-token`","url":"https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-review-action"} - {"title":"GitHub REST: rules for a branch — GET /repos/{owner}/{repo}/rules/branches/{branch}, which \"Returns all active rules that apply to the specified branch\"; for `required_status_checks`, a required array of \"Status checks that are required\" whose entries carry a required `context` (\"The status check context name that must be present on the commit\") and an optional `integration_id`, plus the required boolean `strict_required_status_checks_policy` (\"Whether pull requests targeting a matching branch must be tested with the latest code\") and the optional `do_not_enforce_on_create`","url":"https://docs.github.com/en/rest/repos/rules"} - {"title":"GitHub CLI manual: gh attestation verify — the synopsis `gh attestation verify [ | oci://] [--owner | --repo] [flags]`, so a built file and not only a registry image can be verified; `--signer-workflow` enforcing that the signing workflow matches `[host/]////`, `--predicate-type` defaulting to https://slsa.dev/provenance/v1, and `--format json` emitting one entry per verified attestation carrying `attestation` and a `verificationResult` with `signature.certificate`, `verifiedTimestamps` and `statement`","url":"https://cli.github.com/manual/gh_attestation_verify"} - {"title":"GitHub: artifact attestations — \"Artifact attestations enable you to create unfalsifiable provenance and integrity guarantees for the software you build\", covering binaries, packages and manifests, and its own limit: \"artifact attestations are not a guarantee that an artifact is secure. Instead, artifact attestations link you to the source code and the build instructions that produced them\"","url":"https://docs.github.com/en/actions/concepts/security/artifact-attestations"} - {"title":"FedRAMP Marketplace: GitHub Enterprise Cloud — the listing to re-read rather than quote, and the place to check the impact level against the system this recipe is being run for; SC-18 reaches class c and class d only, so every reader of this recipe is Moderate or High and the gap between a product's listed level and their own is the SA-09 question this recipe's external-system note raises and does not answer","url":"https://www.fedramp.gov/marketplace/products/FR1812058188/"}