FedRAMP Moderate (NIST SP 800-53 Rev 5 baseline): the evidence behind each requirement

323 controls and enhancements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

A FedRAMP baseline is a subset of NIST SP 800-53 Rev 5, enhancements included.

AC - Access Control

AC-1Policy and Procedures hard AC-2Account Management hard AC-2(1)Automated System Account Management easy AC-2(2)Automated Temporary and Emergency Account Management moderate AC-2(3)Disable Accounts moderate AC-2(4)Automated Audit Actions easy AC-2(5)Inactivity Logout easy AC-2(7)Privileged User Accounts easy AC-2(9)Restrictions on Use of Shared and Group Accounts easy AC-2(12)Account Monitoring for Atypical Usage easy AC-2(13)Disable Accounts for High-Risk Individuals hard AC-3Access Enforcement hard AC-4Information Flow Enforcement moderate AC-4(21)Physical or Logical Separation of Information Flows hard AC-5Separation of Duties hard AC-6Least Privilege hard AC-6(1)Authorize Access to Security Functions easy AC-6(2)Non-Privileged Access for Nonsecurity Functions hard AC-6(5)Privileged Accounts hard AC-6(7)Review of User Privileges easy AC-6(9)Log Use of Privileged Functions easy AC-6(10)Prohibit Non-Privileged Users from Executing Privileged Functions easy AC-7Unsuccessful Logon Attempts hard AC-8System Use Notification hard AC-11Device Lock moderate AC-11(1)Device Lock | Pattern-hiding Displays (AC-11(1)) moderate AC-12Session Termination moderate AC-14Permitted Actions Without Identification or Authentication hard AC-17Remote Access hard AC-17(1)Monitoring and Control easy AC-17(2)Protection of Confidentiality and Integrity Using Encryption easy AC-17(3)Managed Access Control Points hard AC-17(4)Privileged Commands and Access easy AC-18Wireless Access moderate AC-18(1)Authentication and Encryption easy AC-18(3)Wireless Access | Disable Wireless Networking (AC-18(3)) hard AC-19Access Control for Mobile Devices moderate AC-19(5)Full Device or Container-Based Encryption hard AC-20Use of External Systems hard AC-20(1)Limits on Authorized Use hard AC-20(2)Portable Storage Devices Restricted Use easy AC-21Information Sharing hard AC-22Publicly Accessible Content hard

AT - Awareness and Training

AT-1Policy and Procedures hard AT-2Literacy Training and Awareness hard AT-2(2)Insider Threat hard AT-2(3)Social Engineering and Mining easy AT-3Role-Based Training hard AT-4Training Records moderate

AU - Audit and Accountability

AU-1Policy and Procedures hard AU-2Event Logging moderate AU-3Content of Audit Records moderate AU-3(1)Additional Audit Information hard AU-4Audit Log Storage Capacity moderate AU-5Response to Audit Logging Process Failures easy AU-6Audit Record Review, Analysis, and Reporting hard AU-6(1)Automated Process Integration hard AU-6(3)Correlate Audit Record Repositories easy AU-7Audit Record Reduction and Report Generation hard AU-7(1)Automatic Processing hard AU-8Time Stamps moderate AU-9Protection of Audit Information moderate AU-9(4)Access by Subset of Privileged Users hard AU-11Audit Record Retention moderate AU-12Audit Record Generation hard

CA - Assessment, Authorization, and Monitoring

CA-1Policy and Procedures hard CA-2Control Assessments hard CA-2(1)Independent Assessors hard CA-2(3)Control Assessments | Leveraging Results from External Organizations (CA-2(3)) hard CA-3Information Exchange hard CA-5Plan of Action and Milestones hard CA-6Authorization hard CA-7Continuous Monitoring hard CA-7(1)Independent Assessment hard CA-7(4)Continuous Monitoring | Risk Monitoring (CA-7(4)) hard CA-8Penetration Testing hard CA-8(1)Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1)) hard CA-8(2)Penetration Testing | Red Team Exercises (CA-8(2)) hard CA-9Internal System Connections hard

CM - Configuration Management

CM-1Policy and Procedures easy CM-2Baseline Configuration moderate CM-2(2)Automation Support for Accuracy and Currency hard CM-2(3)Retention of Previous Configurations easy CM-2(7)Configure Systems and Components for High-Risk Areas hard CM-3Configuration Change Control moderate CM-3(2)Testing, Validation, and Documentation of Changes hard CM-3(4)Security and Privacy Representatives hard CM-4Impact Analyses easy CM-4(2)Impact Analyses | Verification of Controls (CM-4(2)) easy CM-5Access Restrictions for Change easy CM-5(1)Access Restrictions for Change | Automated Access Enforcement and Audit Records (CM-5(1)) easy CM-5(5)Access Restrictions for Change | Privilege Limitation for Production and Operation (CM-5(5)) hard CM-6Configuration Settings easy CM-6(1)Automated Management, Application, and Verification hard CM-7Least Functionality easy CM-7(1)Periodic Review hard CM-7(2)Prevent Program Execution hard CM-7(5)Authorized Software Allow-by-Exception hard CM-8System Component Inventory moderate CM-8(1)Updates During Installation and Removal hard CM-8(3)Automated Unauthorized Component Detection easy CM-9Configuration Management Plan moderate CM-10Software Usage Restrictions easy CM-11User-Installed Software moderate CM-12Information Location (CM-12) hard CM-12(1)Information Location | Automated Tools to Support Information Location (CM-12(1)) hard

CP - Contingency Planning

CP-1Policy and Procedures moderate CP-2Contingency Plan hard CP-2(1)Coordinate with Related Plans hard CP-2(3)Resume Mission and Business Functions hard CP-2(8)Contingency Plan | Identify Critical Assets (CP-2(8)) hard CP-3Contingency Training moderate CP-4Contingency Plan Testing moderate CP-4(1)Coordinate with Related Plans hard CP-6Alternate Storage Site moderate CP-6(1)Alternate Storage Site | Separation from Primary Site (CP-6(1)) hard CP-6(3)Alternate Storage Site | Accessibility (CP-6(3)) hard CP-7Alternate Processing Site moderate CP-7(1)Alternate Processing Site | Separation from Primary Site (CP-7(1)) hard CP-7(2)Alternate Processing Site | Accessibility (CP-7(2)) hard CP-7(3)Alternate Processing Site | Priority of Service (CP-7(3)) hard CP-8Telecommunications Services hard CP-8(1)Telecommunications Services | Priority of Service Provisions (CP-8(1)) hard CP-8(2)Telecommunications Services | Single Points of Failure (CP-8(2)) hard CP-9System Backup moderate CP-9(1)Testing for Reliability and Integrity easy CP-9(8)System Backup | Cryptographic Protection (CP-9(8)) easy CP-10System Recovery and Reconstitution moderate CP-10(2)System Recovery and Reconstitution | Transaction Recovery (CP-10(2)) easy

IA - Identification and Authentication

IA-1Policy and Procedures hard IA-2Identification and Authentication (Organizational Users) easy IA-2(1)MFA to Privileged Accounts easy IA-2(2)MFA to Non-Privileged Accounts easy IA-2(5)Identification and Authentication (Organizational Users) | Individual Authentication with Group… hard IA-2(6)Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6)) hard IA-2(8)Access to Accounts Replay Resistant hard IA-2(12)Acceptance of PIV Credentials easy IA-3Device Identification and Authentication easy IA-4Identifier Management easy IA-4(4)Identifier Management | Identify User Status (IA-4(4)) hard IA-5Authenticator Management moderate IA-5(1)Password-Based Authentication easy IA-5(2)Public Key-Based Authentication easy IA-5(6)Protection of Authenticators hard IA-5(7)Authenticator Management | No Embedded Unencrypted Static Authenticators (IA-5(7)) easy IA-6Authentication Feedback moderate IA-7Cryptographic Module Authentication hard IA-8Identification and Authentication (Non-Organizational Users) easy IA-8(1)Identification and Authentication (Non-organizational Users) | Acceptance of PIV Credentials from Other… hard IA-8(2)Identification and Authentication (Non-organizational Users) | Acceptance of External Authenticators (IA-8(2)) hard IA-8(4)Identification and Authentication (Non-organizational Users) | Use of Defined Profiles (IA-8(4)) hard IA-11Re-Authentication easy IA-12Identity Proofing (IA-12) easy IA-12(2)Identity Proofing | Identity Evidence (IA-12(2)) hard IA-12(3)Identity Proofing | Identity Evidence Validation and Verification (IA-12(3)) hard IA-12(5)Identity Proofing | Address Confirmation (IA-12(5)) hard

IR - Incident Response

IR-1Policy and Procedures hard IR-2Incident Response Training hard IR-3Incident Response Testing hard IR-3(2)Incident Response Testing | Coordination with Related Plans (IR-3(2)) hard IR-4Incident Handling hard IR-4(1)Automated Incident Handling Processes hard IR-5Incident Monitoring hard IR-6Incident Reporting hard IR-6(1)Automated Reporting hard IR-6(3)Incident Reporting | Supply Chain Coordination (IR-6(3)) easy IR-7Incident Response Assistance hard IR-7(1)Incident Response Assistance | Automation Support for Availability of Information and Support (IR-7(1)) hard IR-8Incident Response Plan hard IR-9Information Spillage Response (IR-9) hard IR-9(2)Information Spillage Response | Training (IR-9(2)) hard IR-9(3)Information Spillage Response | Post-spill Operations (IR-9(3)) hard IR-9(4)Information Spillage Response | Exposure to Unauthorized Personnel (IR-9(4)) hard

MA - Maintenance

MA-1Policy and Procedures moderate MA-2Controlled Maintenance easy MA-3Maintenance Tools (MA-3) moderate MA-3(1)Maintenance Tools | Inspect Tools (MA-3(1)) hard MA-3(2)Maintenance Tools | Inspect Media (MA-3(2)) easy MA-3(3)Maintenance Tools | Prevent Unauthorized Removal (MA-3(3)) hard MA-4Nonlocal Maintenance moderate MA-5Maintenance Personnel moderate MA-5(1)Maintenance Personnel | Individuals Without Appropriate Access (MA-5(1)) hard MA-6Timely Maintenance (MA-6) hard

MP - Media Protection

MP-1Policy and Procedures moderate MP-2Media Access hard MP-3Media Marking moderate MP-4Media Storage easy MP-5Media Transport easy MP-6Media Sanitization moderate MP-7Media Use moderate

PE - Physical and Environmental Protection

PE-1Policy and Procedures moderate PE-2Physical Access Authorizations hard PE-3Physical Access Control moderate PE-4Access Control for Transmission (PE-4) hard PE-5Access Control for Output Devices (PE-5) moderate PE-6Monitoring Physical Access moderate PE-6(1)Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment (PE-6(1)) hard PE-8Visitor Access Records hard PE-9Power Equipment and Cabling (PE-9) hard PE-10Emergency Shutoff (PE-10) moderate PE-11Emergency Power (PE-11) hard PE-12Emergency Lighting hard PE-13Fire Protection hard PE-13(1)Fire Protection | Detection Systems: Automatic Activation and Notification (PE-13(1)) hard PE-13(2)Fire Protection | Suppression Systems: Automatic Activation and Notification (PE-13(2)) hard PE-14Environmental Controls moderate PE-15Water Damage Protection (PE-15) moderate PE-16Delivery and Removal easy PE-17Alternate Work Site hard

PL - Planning

PL-1Policy and Procedures hard PL-2System Security and Privacy Plans hard PL-4Rules of Behavior moderate PL-4(1)Rules of Behavior | Social Media and External Site/Application Usage Restrictions (PL-4(1)) hard PL-8Security and Privacy Architectures hard PL-10Baseline Selection. Select a control baseline for the system hard PL-11Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions hard

PS - Personnel Security

PS-1Policy and Procedures hard PS-2Position Risk Designation hard PS-3Personnel Screening moderate PS-3(3)Personnel Screening | Information Requiring Special Protective Measures (PS-3(3)) hard PS-4Personnel Termination hard PS-5Personnel Transfer moderate PS-6Access Agreements hard PS-7External Personnel Security hard PS-8Personnel Sanctions hard PS-9Position Descriptions (PS-9) hard

RA - Risk Assessment

RA-1Policy and Procedures hard RA-2Security Categorization hard RA-3Risk Assessment hard RA-3(1)Risk Assessment | Supply Chain Risk Assessment (RA-3(1)) hard RA-5Vulnerability Monitoring and Scanning moderate RA-5(2)Update Vulnerabilities to be Scanned hard RA-5(3)Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage (RA-5(3)) easy RA-5(5)Privileged Access easy RA-5(11)Vulnerability Monitoring and Scanning | Public Disclosure Program (RA-5(11)) hard RA-7Risk Response hard RA-9Criticality Analysis (RA-9) hard

SA - System and Services Acquisition

SA-1Policy and Procedures hard SA-2Allocation of Resources hard SA-3System Development Life Cycle hard SA-4Acquisition Process hard SA-4(1)Acquisition Process | Functional Properties of Controls (SA-4(1)) hard SA-4(2)Acquisition Process | Design and Implementation Information for Controls (SA-4(2)) hard SA-4(9)Acquisition Process | Functions, Ports, Protocols, and Services in Use (SA-4(9)) hard SA-4(10)Use of Approved PIV Products hard SA-5System Documentation hard SA-8Security and Privacy Engineering Principles hard SA-9External System Services hard SA-9(1)External System Services | Risk Assessments and Organizational Approvals (SA-9(1)) hard SA-9(2)Identification of Functions, Ports, Protocols, and Services hard SA-9(5)External System Services | Processing, Storage, and Service Location (SA-9(5)) hard SA-10Developer Configuration Management hard SA-11Developer Testing and Evaluation hard SA-11(1)Developer Testing and Evaluation | Static Code Analysis (SA-11(1)) easy SA-11(2)Developer Testing and Evaluation | Threat Modeling and Vulnerability Analyses (SA-11(2)) hard SA-15Development Process, Standards, and Tools (SA-15) hard SA-15(3)Development Process, Standards, and Tools | Criticality Analysis (SA-15(3)) hard SA-22Unsupported System Components (SA-22) hard

SC - System and Communications Protection

SC-1Policy and Procedures hard SC-2Separation of System and User Functionality moderate SC-4Information in Shared System Resources moderate SC-5Denial-of-Service Protection easy SC-7Boundary Protection hard SC-7(3)Access Points hard SC-7(4)External Telecommunications Services hard SC-7(5)Deny by Default Allow by Exception easy SC-7(7)Split Tunneling for Remote Devices hard SC-7(8)Route Traffic to Authenticated Proxy Servers easy SC-7(12)Boundary Protection | Host-based Protection (SC-7(12)) easy SC-7(18)Boundary Protection | Fail Secure (SC-7(18)) easy SC-8Transmission Confidentiality and Integrity moderate SC-8(1)Cryptographic Protection hard SC-10Network Disconnect moderate SC-12Cryptographic Key Establishment and Management moderate SC-13Cryptographic Protection moderate SC-15Collaborative Computing Devices and Applications moderate SC-17Public Key Infrastructure Certificates moderate SC-18Mobile Code hard SC-20Secure Name/Address Resolution Service (Authoritative) moderate SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver) moderate SC-22Architecture and Provisioning for Name/Address Resolution Service moderate SC-23Session Authenticity easy SC-28Protection of Information at Rest moderate SC-28(1)Cryptographic Protection hard SC-39Process Isolation moderate SC-45System Time Synchronization (SC-45) hard SC-45(1)System Time Synchronization | Synchronization with Authoritative Time Source (SC-45(1)) hard

SI - System and Information Integrity

SI-1Policy and Procedures moderate SI-2Flaw Remediation easy SI-2(2)Automated Flaw Remediation Status easy SI-2(3)Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions (SI-2(3)) easy SI-3Malicious Code Protection easy SI-4System Monitoring easy SI-4(1)System Monitoring | System-wide Intrusion Detection System (SI-4(1)) hard SI-4(2)Automated Tools and Mechanisms for Real-Time Analysis hard SI-4(4)Inbound and Outbound Communications Traffic hard SI-4(5)System-Generated Alerts easy SI-4(16)System Monitoring | Correlate Monitoring Information (SI-4(16)) hard SI-4(18)System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) hard SI-4(23)System Monitoring | Host-based Devices (SI-4(23)) hard SI-5Security Alerts, Advisories, and Directives easy SI-6Security and Privacy Function Verification (SI-6) easy SI-7Software, Firmware, and Information Integrity easy SI-7(1)Integrity Checks hard SI-7(7)Integration of Detection and Response hard SI-8Spam Protection easy SI-8(2)Spam Protection | Automatic Updates (SI-8(2)) easy SI-10Information Input Validation moderate SI-11Error Handling hard SI-12Information Management and Retention easy SI-16Memory Protection easy

SR - Supply Chain Risk Management

SR-1Policy and Procedures (SR-1) hard SR-2Supply Chain Risk Management Plan (SR-2) hard SR-2(1)Supply Chain Risk Management Plan | Establish SCRM Team (SR-2(1)) hard SR-3Supply Chain Controls and Processes (SR-3) hard SR-5Acquisition Strategies, Tools, and Methods (SR-5) hard SR-6Supplier Assessments and Reviews (SR-6) hard SR-8Notification Agreements (SR-8) hard SR-10Inspection of Systems or Components (SR-10) hard SR-11Component Authenticity (SR-11) hard SR-11(1)Component Authenticity | Anti-counterfeit Training (SR-11(1)) moderate SR-11(2)Component Authenticity | Configuration Control for Component Service and Repair (SR-11(2)) moderate SR-12Component Disposal (SR-12) hard