Skip to content
FedRAMP Rules Hub
JSON — GET /api/evidence-plan

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

INR — Incident Response

3 indicators, 11 controls in scope for class C; 11 of them have an authored recipe.

Class C vulnerability-response floor

VDR floor3 days

tightest MUST
3 days — VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
A response floor, not a collection interval — why

This is a class-widefloor on responding to a vulnerability, quoted in the dataset’s own units and never converted. It is not a per-check collection interval — the rules author none. Schedule against the MUST; the tightest entry may be a SHOULD.

  • automatable
  • partial — needs judgement
  • narrative — no API proves this
partialGuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference
quarterlycli
$ aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"severity":{"Gte":[4]},"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'
$ aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <FINDING_ID_1> <FINDING_ID_2> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Time:UpdatedAt,Desc:Description}'
$ aws securityhub get-insights --query 'Insights[].{Arn:InsightArn,Name:Name,Filters:Filters,GroupBy:GroupByAttr}'
$ aws securityhub get-insight-results --insight-arn <INSIGHT_ARN>
$ aws s3api list-objects-v2 --bucket <EVIDENCE_BUCKET> --prefix after-action-reports/ --query 'Contents[].{Key:Key,Size:Size,Modified:LastModified}'
provesKSI-INR-AAR→IR-03IR-04IR-04 (01)IR-08
full playbook — output, GovCloud, provenance
partialSecurity Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps
monthlycli
$ aws securityhub get-findings --filters '{"WorkflowStatus":[{"Value":"RESOLVED","Comparison":"EQUALS"}],"SeverityLabel":[{"Value":"HIGH","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Id,Updated:UpdatedAt}'
$ aws guardduty list-detectors --query 'DetectorIds[0]'
$ aws guardduty get-detector --detector-id <DETECTOR_ID> --query '{Status:Status,Features:Features[].{Name:Name,Status:Status}}'
$ aws events list-rules --name-prefix guardduty --query 'Rules[].{Name:Name,Pattern:EventPattern,Targets:State}'
$ aws ssm list-documents --filters Key=Owner,Values=Self --filters Key=DocumentType,Values=Automation --query 'DocumentIdentifiers[].{Name:Name,Owner:Owner,Version:DocumentVersion,Type:DocumentType}'
$ aws cloudwatch describe-alarms --alarm-name-prefix SecurityHub --query 'MetricAlarms[].{Name:AlarmName,State:StateValue,Actions:AlarmActions,Metric:MetricName}'
provesKSI-INR-RIR→IR-04IR-04 (01)IR-06IR-06 (01)IR-06 (03)IR-07IR-07 (01)IR-08SI-04 (05)
full playbook — output, GovCloud, provenance
partialRecurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation
quarterlycli
$ aws guardduty list-findings --detector-id <DETECTOR_ID> --finding-criteria '{"Criterion":{"updatedAt":{"Gte":["<SINCE_EPOCH>"]}}}' --query 'FindingIds[]'
$ aws guardduty get-findings --detector-id <DETECTOR_ID> --finding-ids <IDS> --query 'Findings[].{Id:Id,Type:Type,Severity:Severity,Resource:Resource.ResourceType,Region:Region,Count:Service.Count,Account:AccountId}'
$ aws securityhub get-findings --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' --query 'Findings[].{Id:Id,Title:Title,Type:Types[0],Severity:Severity.Label,Resource:Resources[0].Type,First:FirstObservedAt,Last:LastObservedAt}'
$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=signin.amazonaws.com --start-time 2024-01-01T00:00:00Z --end-time 2024-12-31T23:59:59Z --max-results 50 --query 'Events[].{Name:EventName,Time:EventTime,User:Username}'
provesKSI-INR-RPI→IR-03IR-04IR-04 (01)IR-05IR-08
full playbook — output, GovCloud, provenance

Indicators in this theme

  • KSI-INR-AAR4 controls
    Generating After Action Reports

    Incident after action reports are generated and lessons learned are persistently incorporated.

  • KSI-INR-RIR10 controls
    Reviewing Incident Response Procedures

    The effectiveness of documented incident response procedures is persistently reviewed.

  • KSI-INR-RPI5 controls
    Reviewing Past Incidents

    Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.

No accounts — your progress ticks never leave this browser.