Skip to content
FedRAMP Rules Hub
JSON — GET /api/evidence-plan

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

RPL — Recovery Planning

4 indicators, 5 controls in scope for class B; 2 of them have an authored recipe.

Class B vulnerability-response floor

VDR floor7 days

tightest MUST
7 days — VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
A response floor, not a collection interval — why

This is a class-widefloor on responding to a vulnerability, quoted in the dataset’s own units and never converted. It is not a per-check collection interval — the rules author none. Schedule against the MUST; the tightest entry may be a SHOULD.

  • automatable
  • partial — needs judgement
  • narrative — no API proves this
partialAWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name db-instance-backup-enabled --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name backup-plan-min-frequency-and-min-retention-check --compliance-types NON_COMPLIANT
$ aws configservice describe-configuration-recorder-status
$ aws configservice describe-config-rule-evaluation-status --config-rule-names db-instance-backup-enabled
$ aws configservice describe-config-rule-evaluation-status --config-rule-names backup-plan-min-frequency-and-min-retention-check
$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text
$ aws organizations list-accounts --query 'Accounts[].Id' --output text
provesKSI-RPL-ABO→CP-09
full playbook — output, GovCloud, provenance
partialRestore jobs that actually ran — the schedule they ran on, whether each one completed, how long it took, and what it produced — plus the point-in-time recovery window that makes transaction-level recovery possible
monthlycli
$ aws backup list-restore-testing-plans --query 'RestoreTestingPlans[].{Plan:RestoreTestingPlanName,Schedule:ScheduleExpression,LastRun:LastExecutionTime,StartWindowHours:StartWindowHours}'
$ aws backup list-restore-jobs --by-created-after 2026-04-01T00:00:00Z --query 'RestoreJobs[].{Id:RestoreJobId,Type:ResourceType,Status:Status,Message:StatusMessage,Created:CreationDate,Completed:CompletionDate,Validation:ValidationStatus,Restored:CreatedResourceArn}'
$ aws backup list-protected-resources --query 'Results[].{Arn:ResourceArn,Type:ResourceType,LastBackup:LastBackupTime,LastRecoveryPoint:LastRecoveryPointArn}'
$ aws configservice get-compliance-details-by-config-rule --config-rule-name aurora-resources-protected-by-backup-plan --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name rds-in-backup-plan --compliance-types NON_COMPLIANT
$ aws rds describe-db-instances --query 'DBInstances[].{Db:DBInstanceIdentifier,RetentionDays:BackupRetentionPeriod,LatestRestorable:LatestRestorableTime}'
$ aws configservice get-compliance-details-by-config-rule --config-rule-name dynamodb-pitr-enabled --compliance-types NON_COMPLIANT
provesKSI-RPL-ABOKSI-RPL-ARPKSI-RPL-RROKSI-RPL-TRC→CP-10
full playbook — output, GovCloud, provenance

Indicators in this theme

  • KSI-RPL-ABO6 controls
    Aligning Backups with Objectives

    The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed.

  • KSI-RPL-ARP16 controls
    Aligning Recovery Plan

    The alignment of recovery plans with defined recovery objectives is persistently reviewed.

  • KSI-RPL-RRO2 controls
    Reviewing Recovery Objectives

    The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities.

  • KSI-RPL-TRC10 controls
    Testing Recovery Capabilities

    The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested.

No accounts — your progress ticks never leave this browser.