Skip to content
FedRAMP Rules Hub
JSON — GET /api/baseline

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Scope409 controls · 18 families

JSON — GET /api/baseline

Every control in a Rev5 baseline, and what proves it. Baseline membership is FedRAMP Rev5; evidence status is our authored AWS and pipeline overlays (AWS overlay v3.0.0, pipeline overlay v0.8.0).

Evidencecontrols across every Rev5 baseline

with a recipe
94 of 409
KSI-reached, no recipe
105 of 409the authoring backlog
orphan → narrative
210 of 409no telemetry will ever prove these — narrative means a document you write

Control index

evidence

409 controls

legend
recipe— an authored recipe collects evidence for this controlKSI only— a Key Security Indicator reaches it, but no recipe is authored yetorphan— no Key Security Indicator reaches it — a person writes it up instead = in the class B, C and D baselines, left to right
where do the control titles come from?

The FedRAMP rules reference NIST 800-53 controls by id only — no title text is in that dataset. The titles here are NIST’s own, read from a pinned commit of the OSCAL catalog that usnistgov/oscal-content publishes, and the full statement is on each control’s page. Hover a row to read its title; the KSI column still shows what reaches the control, which is the thing that decides what you have to do about it.

AC50 in scope · 16 covered

AT6 in scope · 0 covered

AU27 in scope · 11 covered

CA15 in scope · 1 covered

CM34 in scope · 14 covered

CP35 in scope · 3 covered

IA30 in scope · 6 covered

IR24 in scope · 10 covered

MA12 in scope · 0 covered

  • MA-01 — Policy and ProceduresIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-02 — Controlled MaintenanceIn baseline B, C, DKSI onlyKSI-CMT-LMC KSI-SVC-EIS
  • MA-02 (02) — Automated Maintenance ActivitiesIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-03 — Maintenance ToolsIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-03 (01) — Inspect ToolsIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-03 (02) — Inspect MediaIn baseline C, Dorphan—annual — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-03 (03) — Prevent Unauthorized RemovalIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-04 — Nonlocal MaintenanceIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-04 (03) — Comparable Security and SanitizationIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-05 — Maintenance PersonnelIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-05 (01) — Individuals Without Appropriate AccessIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-06 — Timely MaintenanceIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

MP10 in scope · 0 covered

  • MP-01 — Policy and ProceduresIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-02 — Media AccessIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-03 — Media MarkingIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-04 — Media StorageIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-05 — Media TransportIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-06 — Media SanitizationIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-06 (01) — Review, Approve, Track, Document, and VerifyIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-06 (02) — Equipment TestingIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-06 (03) — Nondestructive TechniquesIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-07 — Media UseIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PE26 in scope · 0 covered

  • PE-01 — Policy and ProceduresIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-02 — Physical Access AuthorizationsIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-03 — Physical Access ControlIn baseline B, C, Dorphan—annual — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-03 (01) — System AccessIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-04 — Access Control for TransmissionIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-05 — Access Control for Output DevicesIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-06 — Monitoring Physical AccessIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-06 (01) — Intrusion Alarms and Surveillance EquipmentIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-06 (04) — Monitoring Physical Access to SystemsIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-08 — Visitor Access RecordsIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-08 (01) — Automated Records Maintenance and ReviewIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-09 — Power Equipment and CablingIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-10 — Emergency ShutoffIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-11 — Emergency PowerIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-11 (01) — Alternate Power Supply — Minimal Operational CapabilityIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-12 — Emergency LightingIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-13 — Fire ProtectionIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-13 (01) — Detection Systems — Automatic Activation and NotificationIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-13 (02) — Suppression Systems — Automatic Activation and NotificationIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-14 — Environmental ControlsIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-14 (02) — Monitoring with Alarms and NotificationsIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-15 — Water Damage ProtectionIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-15 (01) — Automation SupportIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-16 — Delivery and RemovalIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-17 — Alternate Work SiteIn baseline C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-18 — Location of System ComponentsIn baseline Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PL7 in scope · 0 covered

  • PL-01 — Policy and ProceduresIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-02 — System Security and Privacy PlansIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-04 — Rules of BehaviorIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-04 (01) — Social Media and External Site/Application Usage RestrictionsIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-08 — Security and Privacy ArchitecturesIn baseline B, C, DKSI onlyKSI-PIY-RSD KSI-SVC-EIS
  • PL-10 — Baseline SelectionIn baseline B, C, DKSI onlyKSI-CNA-IBP KSI-SVC-ACM
  • PL-11 — Baseline TailoringIn baseline B, C, Dorphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PS11 in scope · 2 covered

RA13 in scope · 1 covered

SA25 in scope · 4 covered

SC35 in scope · 13 covered

SI35 in scope · 10 covered

SR14 in scope · 3 covered