Skip to content
FedRAMP Rules Hub
JSON — GET /api/evidence-plan

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

PIY — Policy and Inventory

4 indicators, 24 controls in scope for class C; 8 of them have an authored recipe.

Class C vulnerability-response floor

VDR floor3 days

tightest MUST
3 days — VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
A response floor, not a collection interval — why

This is a class-widefloor on responding to a vulnerability, quoted in the dataset’s own units and never converted. It is not a per-check collection interval — the rules author none. Schedule against the MUST; the tightest entry may be a SHOULD.

  • automatable
  • partial — needs judgement
  • narrative — no API proves this
partialThe machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them
dailycli
$ aws configservice describe-configuration-recorder-status --query 'ConfigurationRecordersStatus[].{Name:name,Recording:recording,LastStatus:lastStatus,LastStart:lastStartTime,Error:lastErrorMessage}'
$ aws configservice get-discovered-resource-counts
$ aws configservice select-resource-config --expression "SELECT resourceId, resourceType, awsRegion WHERE resourceType = 'AWS::EC2::Instance'"
$ aws ssm get-inventory --aggregators Expression=AWS:InstanceInformation.PlatformType
$ aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:Application
provesKSI-PIY-GIVKSI-CMT-RMVKSI-SVC-ACM→CM-02 (02)CM-08CM-08 (01)
full playbook — output, GovCloud, provenance
partialA Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data
monthlycli
$ aws configservice select-aggregate-resource-config --configuration-aggregator-name <ORG_AGGREGATOR> --expression "SELECT awsRegion, resourceType, COUNT(*) WHERE resourceType IN ('AWS::S3::Bucket', 'AWS::RDS::DBInstance', 'AWS::DynamoDB::Table', 'AWS::EFS::FileSystem') GROUP BY awsRegion, resourceType"
$ aws resourcegroupstaggingapi get-resources --tag-filters Key=DataClassification --region us-gov-west-1
$ aws macie2 get-automated-discovery-configuration
$ aws macie2 describe-buckets --query 'buckets[].{bucket:bucketName,region:region,score:sensitivityScore,monitored:automatedDiscoveryMonitoringStatus,lastAnalyzed:lastAutomatedDiscoveryTime,unclassifiable:unclassifiableObjectCount.total}'
provesKSI-PIY-GIVKSI-SVC-EIS→CM-12CM-12 (01)
full playbook — output, GovCloud, provenance
partialThe rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when.
continuousapi
$ gh api --paginate "/orgs/<ORG>/repos?per_page=100"
$ gh api "/repos/<ORG>/<REPO>/rules/branches/<DEFAULT_BRANCH>"
$ gh api "/repos/<ORG>/<REPO>/codeowners/errors?ref=<DEFAULT_BRANCH>"
$ gh api -H "Accept: application/vnd.github.raw" "/repos/<ORG>/<REPO>/contents/.github/CODEOWNERS?ref=<DEFAULT_BRANCH>"
$ gh api --paginate "/repos/<ORG>/<REPO>/pulls?state=closed&base=<DEFAULT_BRANCH>&per_page=100"
$ gh api --paginate "/repos/<ORG>/<REPO>/pulls/<PULL_NUMBER>/reviews?per_page=100"
provesKSI-CMT-RVPKSI-PIY-RSD→CM-03 (04)
full playbook — output, GovCloud, provenance
partialWhich policy decisions were actually enforced against the infrastructure definitions the boundary deploys from: that a policy scan ran, on which branch, how many rules it applied and when it last ran, together with the failures still open and the record of which were dismissed and with what justification. The load-bearing half is the scan record rather than the findings. SA-08 asks whether security engineering principles were applied, and a clean findings list is the same output whether every principle held or the scan applied no rules, ran last quarter, or parsed nothing — so the count of rules run and the date it ran are the part of this evidence that makes the rest of it mean anything.
continuouscli
$ checkov --version
$ checkov -d <IAC_ROOT> --framework terraform --output sarif --output-file-path <OUT_DIR>
$ checkov -d <IAC_ROOT> --framework terraform --output json --output-file-path <OUT_DIR>
$ gh api --paginate "/orgs/<ORG>/repos?per_page=100"
$ gh api --paginate "/repos/<ORG>/<REPO>/code-scanning/analyses?tool_name=<IAC_TOOL_NAME>&ref=refs/heads/<DEFAULT_BRANCH>&sort=created&direction=desc&per_page=100"
$ gh api --paginate "/repos/<ORG>/<REPO>/code-scanning/alerts?state=open&tool_name=<IAC_TOOL_NAME>&ref=refs/heads/<DEFAULT_BRANCH>&per_page=100"
$ gh api --paginate "/repos/<ORG>/<REPO>/code-scanning/alerts?state=dismissed&tool_name=<IAC_TOOL_NAME>&ref=refs/heads/<DEFAULT_BRANCH>&per_page=100"
provesKSI-PIY-RSD→SA-08
full playbook — output, GovCloud, provenance
partialFor a service that ships code to a browser, the two things a pipeline can say about the mobile code it delivers: what was allowed INTO it, and whether what shipped is what this pipeline built. The first is the dependency diff for the change — every component added, its ecosystem, its version, its licence and any advisory against it, separated by whether it reaches the runtime or stops at the build — and the gate that makes the check mandatory rather than advisory. The second is a provenance attestation over the built bundle, verified against the repository and workflow that are supposed to have produced it. Neither is a statement about which mobile code technologies the organization decided to permit, and that is the control's first limb.
on-changeapi
$ gh api --paginate "/orgs/<ORG>/repos?per_page=100"
$ gh api "/repos/<ORG>/<REPO>/rules/branches/<DEFAULT_BRANCH>"
$ gh api "/repos/<ORG>/<REPO>/dependency-graph/compare/<BASE_SHA>...<HEAD_SHA>"
$ gh attestation verify <BUNDLE_PATH> --repo <ORG>/<REPO> --signer-workflow <ORG>/<REPO>/.github/workflows/<BUILD_WORKFLOW> --format json
provesKSI-PIY-RSDKSI-SCR-MIT→SC-18
full playbook — output, GovCloud, provenance

Indicators in this theme

  • KSI-PIY-GIV7 controls
    Generating Inventories

    Authoritative sources are used to automatically generate real-time inventories of all information resources when needed.

  • KSI-PIY-RIS9 controls
    Reviewing Investments in Security

    The effectiveness of the provider's investments in achieving security goals is persistently reviewed.

  • KSI-PIY-RSD12 controls
    Reviewing Security in the SDLC

    The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed.

  • KSI-PIY-RVD1 controls
    Reviewing Vulnerability Disclosures

    The effectiveness of the provider's vulnerability disclosure program is persistently reviewed.

No accounts — your progress ticks never leave this browser.