FedRAMP Consolidated Rules

EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.

Δεν υπάρχουν έγγραφα σε αυτή τη γλώσσα, εμφανίζονται τα αγγλικά.

Ζητήματα
Τύπος ζητήματος Τίτλος Πηγή
Standard FedRAMP Consolidated Rules for 2026

FedRAMP Consolidated Rules for 2026

Ζητήματα
Τίτλος Πηγή
+ FedRAMP Consolidated Rules for 2026
---+ FedRAMP Definitions
------+ FRD-ACV Accepted Vulnerability
------+ FRD-ADP Adaptive Change
------+ FRD-ADV Advisor
------+ FRD-AGY Agency
------+ FRD-AAP All Affected Parties
------+ FRD-ANA All Necessary Assessors
------+ FRD-ANP All Necessary Parties
------+ FRD-ART Artifacts
------+ FRD-ASR Assessor
------+ FRD-CCL Certification Class
------+ FRD-CCC Certification Class Change
------+ FRD-CRD Certification Data
------+ FRD-CRP Certification Package
------+ FRD-CPH Certification Path
------+ FRD-CPF Certification Profile
------+ FRD-CTY Certification Type
------+ FRD-CSO Cloud Service Offering
------+ FRD-DCE Debilitating Customer Effect
------+ FRD-DTM Deterministic Telemetry
------+ FRD-DCF Disruptive Customer Effect
------+ FRD-DFT Drift
------+ FRD-FPV False Positive Vulnerability
------+ FRD-FCD Federal Customer Data
------+ FRD-FCR FedRAMP Certification Report
------+ FRD-FCT FedRAMP Certified
------+ FRD-FIN FedRAMP Independent Assessment
------+ FRD-FPR FedRAMP Practices
------+ FRD-FRA FedRAMP Recognized
------+ FRD-FRI FedRAMP Reportable Incident
------+ FRD-FSI FedRAMP Security Inbox
------+ FRD-FIR Final Incident Report (FIR)
------+ FRD-FMV Fully Mitigated Vulnerability
------+ FRD-HAN Handle
------+ FRD-INT Incident
------+ FRD-IRS Information Resource
------+ FRD-INC Initial Certification
------+ FRD-IFA Initial FedRAMP Assessment
------+ FRD-IIR Initial Incident Report (IIR)
------+ FRD-IRV Internet-Reachable Vulnerability (IRV)
------+ FRD-KEV Known Exploited Vulnerability (KEV)
------+ FRD-LKY Likely
------+ FRD-LEV Likely Exploitable Vulnerability (LEV)
------+ FRD-MBI Machine-Based (Information Resources)
------+ FRD-MGN Machine-Generated
------+ FRD-MRD Machine-Readable
------+ FRD-MAY MAY
------+ FRD-MCE Minimal Customer Effect
------+ FRD-MAS Minimum Assessment Scope
------+ FRD-MST MUST
------+ FRD-MNT MUST NOT
------+ FRD-NCE Narrow Customer Effect
------+ FRD-ONC Ongoing Certification
------+ FRD-OCR Ongoing Certification Report (OCR)
------+ FRD-OIR Ongoing Incident Report (OIR)
------+ FRD-ODV Overdue Vulnerability
------+ FRD-PMV Partially Mitigated Vulnerability
------+ FRD-PFA Persistent FedRAMP Assessment
------+ FRD-PER Persistently
------+ FRD-PAI Potential Agency Impact
------+ FRD-PAC Privileged Account
------+ FRD-PRO Promptly
------+ FRD-PRV Provider
------+ FRD-QTR Quarterly Review
------+ FRD-RGL Regularly
------+ FRD-RMV Remediated Vulnerability
------+ FRD-RSP Responsibly
------+ FRD-RTR Routine Recurring Change
------+ FRD-SCT Security Category
------+ FRD-SDR Security Decision Record (SDR)
------+ FRD-SHD SHOULD
------+ FRD-SNT SHOULD NOT
------+ FRD-SGC Significant Change
------+ FRD-TPR Third-Party Information Resource
------+ FRD-TLA Top-Level Administrative Account
------+ FRD-TRF Transformative Change
------+ FRD-TRC Trust Center
------+ FRD-VLN Validation
------+ FRD-VRF Verification
------+ FRD-VUL Vulnerability
------+ FRD-VLD Vulnerability Detection
------+ FRD-VLR Vulnerability Response
---+ FedRAMP Rules
------+ AFC Addressing FedRAMP Communication
---------+ AFC-FRP FedRAMP Responsibilities
------------+ AFC-FRP-VRE Verified Emails
------------+ AFC-FRP-CDS Criticality Designators
------------+ AFC-FRP-UFS Use FedRAMP_Security Email in Emergencies
------------+ AFC-FRP-PNT Public Notice of Emergency Tests
------------+ AFC-FRP-RQA Required Actions
------------+ AFC-FRP-ERT Elevated Reaction Timeframes
------------+ AFC-FRP-COR Explain Corrective Actions
------------+ AFC-FRP-RPM Reaction Metrics
---------+ AFC-CSO General Provider Responsibilities
------------+ AFC-CSO-INB Maintain a FedRAMP Security Inbox
------------+ AFC-CSO-NOC Notification of Changes
------------+ AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov
------------+ AFC-CSO-RCV Receive Email Without Disruption
------------+ AFC-CSO-CRA Complete Required Actions
------------+ AFC-CSO-EMR Emergency Message Routing
------------+ AFC-CSO-IMA Important Message Actions
------------+ AFC-CSO-ACK Acknowledge Receipt
------+ AGU Agency Use of FedRAMP Certified Cloud Services
---------+ AGU-AGC General Agency Responsibilities
------------+ AGU-AGC-AIP Agency Internal Policies
------------+ AGU-AGC-NAA Notify FedRAMP After Authorization
------------+ AGU-AGC-GRC Governance, Risk, and Compliance Tools
------------+ AGU-AGC-NAI Notify Additional Information Requests
------------+ AGU-AGC-NAR No Additional Security Requirements
------------+ AGU-AGC-TPP No Certification Type or Path Preferences
------------+ AGU-AGC-WKG FedRAMP Working Groups
------------+ AGU-AGC-LIA Agency Liaison Program
------------+ AGU-AGC-SIN Shared FedRAMP Inbox
---------+ AGU-USE Use of FedRAMP Certifications
------------+ AGU-USE-ABU Authorization Before Use
------------+ AGU-USE-RCF Resolve Certification Package Conflicts
------------+ AGU-USE-RSG Review Secure Configuration Guides
------------+ AGU-USE-AFR Accept FedRAMP Rules
------------+ AGU-USE-NFC Notify FedRAMP of Monitoring Concerns
------------+ AGU-USE-ROR Review Ongoing Certification Reports
------------+ AGU-USE-DSO Designate Senior Official
------------+ AGU-USE-NPC Notify Provider of Concerns
------------+ AGU-USE-RIR Review All Information Resources
------------+ AGU-USE-CLA Using FedRAMP Class A Certifications
---------+ AGU-SPN Agency Sponsored Certifications
------------+ AGU-SPN-MRC Most Recent Consolidated Rules
------+ CCM Collaborative Continuous Monitoring
---------+ CCM-AGM Agency Guidance
------------+ CCM-AGM-ROR Review Ongoing Reports
------------+ CCM-AGM-CSC Consider Security Category
---------+ CCM-OCR Ongoing Certification Reports
------------+ CCM-OCR-AVL Report Availability
------------+ CCM-OCR-NRD Next Report Date
------------+ CCM-OCR-FBM Feedback Mechanism
------------+ CCM-OCR-AFS Anonymized Feedback Summary
------------+ CCM-OCR-LSI Limit Sensitive Information
------------+ CCM-OCR-SOR Spread Out Reports
------------+ CCM-OCR-RPS Responsible Public Certification Report Sharing
---------+ CCM-QTR Quarterly Reviews
------------+ CCM-QTR-MTG Quarterly Review Meeting
------------+ CCM-QTR-REG Meeting Registration Info
------------+ CCM-QTR-NRD Next Review Date
------------+ CCM-QTR-NID No Irresponsible Disclosure
------------+ CCM-QTR-SAR Schedule Around Reports
------------+ CCM-QTR-ACT Additional Content
------------+ CCM-QTR-RTR Record/Transcribe Reviews
------------+ CCM-QTR-RTP Restrict Third Parties
------------+ CCM-QTR-SRR Share Recordings Responsibly
------------+ CCM-QTR-SCR Share Content Responsibly
------+ CDS Certification Data Sharing
---------+ CDS-CSO General Provider Responsibilities
------------+ CDS-CSO-PUB Public Information
------------+ CDS-CSO-SVC Public Service List
------------+ CDS-CSO-FID Always Include FedRAMP ID
------------+ CDS-CSO-FRC FedRAMP Certification Reports
------------+ CDS-CSO-AVR Availability Reporting
------------+ CDS-CSO-UTC Use Trust Centers
------------+ CDS-CSO-CBF Consistency Between Formats
------------+ CDS-CSO-RIS Responsible Information Sharing
------------+ CDS-CSO-IRP Include Relevant Policies
------------+ CDS-CSO-HAD Historical FedRAMP Certification Data
------------+ CDS-CSO-PSM Per-Service Certification Materials
------------+ CDS-CSO-RPS Responsible Public Package Sharing
---------+ CDS-TRC FedRAMP-Compatible Trust Centers
------------+ CDS-TRC-USH Uninterrupted Sharing
------------+ CDS-TRC-PAC Programmatic Access
------------+ CDS-TRC-AAI Agency Access Inventory
------------+ CDS-TRC-ACL Access Logging
------------+ CDS-TRC-HMR Human and Machine-Readable Certification Data
------------+ CDS-TRC-SSM Self-Service Access Management
---------+ CDS-UTC Using a Trust Center
------------+ CDS-UTC-AAD Agency Access Denial
------------+ CDS-UTC-AGA Agency Access
---------+ CDS-CSF Rev5-Specific Provider Responsibilities
------------+ CDS-CSF-TCM Trust Center Migration
------+ CMU Cryptographic Module Use
---------+ CMU-CSO Cloud Service Provider Responsibilities
------------+ CMU-CSO-CMD Cryptographic Module Documentation
------------+ CMU-CSO-UVM Using Validated Cryptographic Modules
------------+ CMU-CSO-CAT Configuration of Agency Tenants
------+ CPO Certification Package Overview
---------+ CPO-CSO General Provider Responsibilities
------------+ CPO-CSO-OVR Overview of the Cloud Service Offering
------------+ CPO-CSO-MTD Certification Package Overview Metadata
------------+ CPO-CSO-OSA Overall Summary of Assessment in Certification Package
---------+ CPO-CSX 20x-Specific Provider Responsibilities
------------+ CPO-CSX-CPM Certification Package Maintenance for 20x
---------+ CPO-CSF Rev5-Specific Provider Responsibilities
------------+ CPO-CSF-CPM Certification Package Maintenance for Rev5
------+ FRC FedRAMP Certification
---------+ FRC-CSO General Provider Responsibilities
------------+ FRC-CSO-FCP FedRAMP Certification Profile
------------+ FRC-CSO-PKG FedRAMP Certification Package
------------+ FRC-CSO-JSN FedRAMP JSON Schemas
------------+ FRC-CSO-MRA Maintain Responsibility and Accountability
------------+ FRC-CSO-POP Pick One Program Certification Type
---------+ FRC-CLA FedRAMP Class A Certification Rules
------------+ FRC-CLA-ASF Approved Alternative Security Frameworks
------------+ FRC-CLA-EAM External Assessment Materials
------------+ FRC-CLA-MFR Mandatory FedRAMP Rules for Class A
------------+ FRC-CLA-RFR Recommended FedRAMP Rules for Class A
------------+ FRC-CLA-OFR Address Optional FedRAMP Rules for Class A
------------+ FRC-CLA-IVV Optional Independent Verification and Validation
---------+ FRC-APP Applying for FedRAMP Certification
------------+ FRC-APP-MLF Marketplace Listing First
------------+ FRC-APP-AFC Applying for FedRAMP Certification
------------+ FRC-APP-FCP Fresh FedRAMP Certification Package
------------+ FRC-APP-FIA Fresh Independent Assessment
------------+ FRC-APP-NTP No Third-Party Applicants
------------+ FRC-APP-USA Updating Stale Assessments
---------+ FRC-APS Applying for FedRAMP Certification with an Agency Sponsor
------------+ FRC-APS-ATO Agency Authorization to Operate
---------+ FRC-CCL Changing Certification Class
------------+ FRC-CCL-UCC Upgrading Certification Class
------------+ FRC-CCL-DCC Downgrading Certification Class
------------+ FRC-CCL-DNP Downgrade Notification Period
---------+ FRC-CSX 20x-Specific Provider Responsibilities
------------+ FRC-CSX-VVK Automated Verification and Validation of Key Security Indicators
------------+ FRC-CSX-VVR Automated Verification and Validation of FedRAMP Rules
------------+ FRC-CSX-MAS Application within MAS
---------+ FRC-CSF Rev5-Specific Provider Responsibilities
------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class B
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class C
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
------------+ FRC-CSF-ACP Assign Control Parameters
------------+ FRC-CSF-FFG Follow FedRAMP Rev5 Controls Guidance
------------+ FRC-CSF-RDY FedRAMP Ready Conversion
------+ IEC Incident Evaluation and Communication
---------+ IEC-FRP FedRAMP Responsibilities
------------+ IEC-FRP-ORV Ongoing Review
---------+ IEC-CSO General Provider Responsibilities
------------+ IEC-CSO-EFR Evaluate FedRAMP Reportability
------------+ IEC-CSO-DPR Default PAIN Rating
------------+ IEC-CSO-IIR Initial Incident Report
------------+ IEC-CSO-OIR Ongoing Incident Reports
------------+ IEC-CSO-FIR Final Incident Report
------------+ IEC-CSO-EFI Estimate Federal Impact
------------+ IEC-CSO-AIR Automated Incident Reporting
------+ IVV Independent Verification and Validation
---------+ IVV-CSO General Provider Responsibilities
------------+ IVV-CSO-FIA FedRAMP Independent Assessments
------------+ IVV-CSO-SEI Supply Evidence of Implementation
------------+ IVV-CSO-SEE Supply Evidence of Effectiveness
------------+ IVV-CSO-ICP Inclusion in Certification Package
------------+ IVV-CSO-DUS Document Use of Representative Samples
------------+ IVV-CSO-STE Supply Technical Explanations
------------+ IVV-CSO-USR Use Representative Samples
------------+ IVV-CSO-RAA Receiving Assessor Advice
---------+ IVV-IAS General Independent Assessor Responsibilities
------------+ IVV-IAS-VIM Verify Implementation
------------+ IVV-IAS-VEF Validate Effectiveness
------------+ IVV-IAS-SUM Assessment Summary
------------+ IVV-IAS-OSA Overall Summary of Assessment
------------+ IVV-IAS-VIP Verify Inclusion in Certification Package
------------+ IVV-IAS-EPX Engage Provider Experts
------------+ IVV-IAS-SHA Sharing Advice
---------+ IVV-CSX 20x-Specific Provider Responsibilities
------------+ IVV-CSX-AIA Annual Independent Assessments for 20x
---------+ IVV-CSF Rev5-Specific Provider Responsibilities
------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class C
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D
------------+ IVV-CSF-MCA Mandatory Control Assessment
------------+ IVV-CSF-ACF Assessment of Rev5 Controls with Findings
------------+ IVV-CSF-PCA Preferred Control Assessment
------+ MAS Minimum Assessment Scope
---------+ MAS-CSO General Provider Responsibilities
------------+ MAS-CSO-IIR Identify Information Resources
------------+ MAS-CSO-FLO Information Flows and Security Categories
------------+ MAS-CSO-TPR Third-Party Information Resources
------------+ MAS-CSO-MDI Metadata Inclusion
------------+ MAS-CSO-SUP Supplemental Information
------+ MKT Marketplace Listing
---------+ MKT-FRP FedRAMP Responsibilities
------------+ MKT-FRP-SOF Scope of FedRAMP
---------+ MKT-CSO General Provider Responsibilities
------------+ MKT-CSO-MLR Marketplace Listing Requirements
------------+ MKT-CSO-PML Provider Marketplace Listing Requests
---------+ MKT-IAS General Assessor Responsibilities
------------+ MKT-IAS-OFR Only FedRAMP Recognized Assessors
------------+ MKT-IAS-WEB Website Requirements for Assessors
------------+ MKT-IAS-LRQ Listing Requests for Assessors
---------+ MKT-CAS General Advisor Responsibilities
------------+ MKT-CAS-WEB Website Requirements for Advisors
------------+ MKT-CAS-LRQ Listing Requests for Advisors
------------+ MKT-CAS-RFR Advisor Responses to FedRAMP
---------+ MKT-IIP Provider Responsibilities for Initial Implementation Phase Listings
------------+ MKT-IIP-AGU Agency Use Cases
------------+ MKT-IIP-DCP Demonstrating Continuous Progress
------------+ MKT-IIP-DLA Deadline for Assessment
------+ REC FedRAMP Recognition of Independent Assessment Services
---------+ REC-FRP FedRAMP Responsibilities
------------+ REC-FRP-FOC Foreign Ownership Collection
------------+ REC-FRP-RAO Recognized Assessors Only
------------+ REC-FRP-DRD Double Revocation Disqualification
---------+ REC-IAS General Independent Assessor Responsibilities
------------+ REC-IAS-ACC A2LA Accreditation
------------+ REC-IAS-ADA Actually Do Assessments
------------+ REC-IAS-PSC Policy and Standards Compliance
------------+ REC-IAS-ANR Annual Surveillance Assessment
------------+ REC-IAS-RAS Full A2LA Reassessment
------------+ REC-IAS-RAR Re-entry after Revocation
------------+ REC-IAS-RQU Roles and Qualifications
------------+ REC-IAS-AFI Annual Foreign Interest Reports
------------+ REC-IAS-CFI Changes in Foreign Interest
------------+ REC-IAS-PST Performance Standards
------------+ REC-IAS-CAP Corrective Action Plan
------------+ REC-IAS-INV Invalid Deliverables
------------+ REC-IAS-SEP Advisory Separation
------+ SCG Secure Configuration Guide
---------+ SCG-CSO General Provider Responsibilities
------------+ SCG-CSO-RSC Recommended Secure Configuration
------------+ SCG-CSO-AUP Use Instructions
------------+ SCG-CSO-PUB Public Secure Configuration Guidance
------------+ SCG-CSO-SDF Secure Defaults
---------+ SCG-ENH Enhanced Capabilities
------------+ SCG-ENH-CMP Comparison Capability
------------+ SCG-ENH-EXP Export Capability
------------+ SCG-ENH-API API Capability
------------+ SCG-ENH-MRG Machine-Readable Guidance
------------+ SCG-ENH-VRH Versioning and Release History
------+ SCN Significant Change Notification
---------+ SCN-FRP FedRAMP Responsibilities
------------+ SCN-FRP-CAP Corrective Action Plan Conditions
---------+ SCN-CSO General Provider Responsibilities
------------+ SCN-CSO-EVA Evaluate Changes
------------+ SCN-CSO-MAR Maintain Audit Records
------------+ SCN-CSO-INF Required Information
------------+ SCN-CSO-HIS Historical Notifications
------------+ SCN-CSO-HRM Human and Machine-Readable Notifications
------------+ SCN-CSO-ARI Additional Relevant Information
------------+ SCN-CSO-NOM Notification Mechanisms
------------+ SCN-CSO-EMG Emergency Changes
---------+ SCN-ADP Adaptive Changes
------------+ SCN-ADP-NTF Notification Requirements
---------+ SCN-RTR Routine Recurring Changes
------------+ SCN-RTR-NNR No Notification Requirements
---------+ SCN-TRF Transformative Changes
------------+ SCN-TRF-NIP Notification of Initial Plans
------------+ SCN-TRF-NFP Notification of Final Plans
------------+ SCN-TRF-NAF Notification After Finishing
------------+ SCN-TRF-NAV Notification After Verification
------------+ SCN-TRF-UPD Update Documentation
------------+ SCN-TRF-TPR Third-Party Review
------+ SDR Security Decision Record
---------+ SDR-CSO General Provider Responsibilities
------------+ SDR-CSO-FRR FedRAMP Rules
------------+ SDR-CSO-MTD Security Decision Record Metadata
---------+ SDR-CSX 20x-Specific Provider Responsibilities
------------+ SDR-CSX-KSI Key Security Indicators
------------+ SDR-CSX-KMT Key Security Indicator Metrics
---------+ SDR-CSF Rev5-Specific Provider Responsibilities
------------+ SDR-CSF-CTF Rev5 Controls
------+ VDR Vulnerability Detection and Response
---------+ VDR-CSO General Provider Responsibilities
------------+ VDR-CSO-DET Vulnerability Detection
------------+ VDR-CSO-RES Vulnerability Response
------------+ VDR-CSO-FAV Failures Are Vulnerabilities
------------+ VDR-CSO-DFR Design For Resilience
------------+ VDR-CSO-ADT Automate Detection
------------+ VDR-CSO-DAC Detect After Changes
------------+ VDR-CSO-MSP Maintain Security
------------+ VDR-CSO-AKE Avoid KEVs
------------+ VDR-CSO-SIR Sampling
---------+ VDR-TFR Timeframes
------------+ VDR-TFR-NMV Non-Machine Verification and Validation
------------+ VDR-TFR-PDD Persistent Drift Detection
------------+ VDR-TFR-PCD Persistently Complete Detection
------------+ VDR-TFR-PVR Mitigation and Remediation Expectations
------------+ VDR-TFR-RMN Remaining Vulnerabilities
------------+ VDR-TFR-KEV Remediate KEVs
------------+ VDR-TFR-PSD Persistent Sample Detection
------------+ VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
------------+ VDR-TFR-MVF Persistent Machine Verification and Validation for Rev5
------+ VER Vulnerability Evaluation and Reporting
---------+ VER-FRP FedRAMP Responsibilities
------------+ VER-FRP-ARP Additional Requirements
------------+ VER-FRP-ADV Sensitive Details
---------+ VER-AGM Agency Guidance
------------+ VER-AGM-RVR Review Vulnerability Reports
------------+ VER-AGM-MAP Maintain Agency Plans of Action and Milestones
---------+ VER-EVA Evaluation
------------+ VER-EVA-ELX Evaluate Exploitability
------------+ VER-EVA-EIR Evaluate Internet-Reachability
------------+ VER-EVA-EPA Estimate Potential Agency Impact
------------+ VER-EVA-AIA Assume It's Automatable
------------+ VER-EVA-GRV Group Vulnerabilities
------------+ VER-EVA-EFP Evaluate False Positives
------------+ VER-EVA-EFA Evaluation Factors
---------+ VER-RPT Reporting
------------+ VER-RPT-PER Persistent Reporting
------------+ VER-RPT-VDT Vulnerability Details
------------+ VER-RPT-AVI Accepted Vulnerability Info
------------+ VER-RPT-NID Responsible Disclosure
------------+ VER-RPT-HLO High-Level Overviews
------------+ VER-RPT-RPD Responsible Public Disclosure
---------+ VER-TFR Timeframes
------------+ VER-TFR-MHR Monthly Activity Report
------------+ VER-TFR-MAV Mark Accepted Vulnerabilities
------------+ VER-TFR-MRH Historical Activity
------------+ VER-TFR-EVU Evaluate Vulnerabilities Quickly
------------+ VER-TFR-IRI Internet-Reachable Incidents
------------+ VER-TFR-NRI Non-Internet-Reachable Incidents
---+ Key Security Indicators
------+ KSI-CED Cybersecurity Education
---------+ KSI-CED-RAT Reviewing All Training
------+ KSI-CMT Change Management
---------+ KSI-CMT-LMC Logging Changes
---------+ KSI-CMT-RMV Redeploying vs Modifying
---------+ KSI-CMT-RVP Reviewing Change Procedures
---------+ KSI-CMT-VTD Validating Throughout Deployment
------+ KSI-CNA Cloud Native Architecture
---------+ KSI-CNA-DFP Defining Functionality and Privileges
---------+ KSI-CNA-EIS Enforcing Intended State
---------+ KSI-CNA-IBP Implementing Best Practices
---------+ KSI-CNA-MAT Minimizing Attack Surface
---------+ KSI-CNA-OFA Optimizing for Availability
---------+ KSI-CNA-RNT Restricting Network Traffic
---------+ KSI-CNA-RVP Reviewing Protections
---------+ KSI-CNA-ULN Using Logical Networking
------+ KSI-IAM Identity and Access Management
---------+ KSI-IAM-AAM Automating Account Management
---------+ KSI-IAM-APM Adopting Passwordless Methods
---------+ KSI-IAM-ELP Ensuring Least Privilege
---------+ KSI-IAM-JIT Authorizing Just-in-Time
---------+ KSI-IAM-SNU Securing Non-User Authentication
---------+ KSI-IAM-SUS Responding to Suspicious Activity
------+ KSI-INR Incident Response
---------+ KSI-INR-AAR Generating After Action Reports
---------+ KSI-INR-RIR Reviewing Incident Response Procedures
---------+ KSI-INR-RPI Reviewing Past Incidents
------+ KSI-MLA Monitoring, Logging, and Auditing
---------+ KSI-MLA-ALA Authorizing Log Access
---------+ KSI-MLA-EVC Evaluating Configurations
---------+ KSI-MLA-LET Logging Event Types
---------+ KSI-MLA-OSM Operating SIEM Capability
---------+ KSI-MLA-RVL Reviewing Logs
------+ KSI-PIY Policy and Inventory
---------+ KSI-PIY-GIV Generating Inventories
---------+ KSI-PIY-RES Reviewing Executive Support
---------+ KSI-PIY-RIS Reviewing Investments in Security
---------+ KSI-PIY-RSD Reviewing Security in the SDLC
---------+ KSI-PIY-RVD Reviewing Vulnerability Disclosures
------+ KSI-RPL Recovery Planning
---------+ KSI-RPL-ABO Aligning Backups with Objectives
---------+ KSI-RPL-ARP Aligning Recovery Plan
---------+ KSI-RPL-RRO Reviewing Recovery Objectives
---------+ KSI-RPL-TRC Testing Recovery Capabilities
------+ KSI-SCR Supply Chain Risk
---------+ KSI-SCR-MIT Mitigating Supply Chain Risk
---------+ KSI-SCR-MON Monitoring Supply Chain Risk
------+ KSI-SVC Service Configuration
---------+ KSI-SVC-ACM Automating Configuration Management
---------+ KSI-SVC-ASM Automating Secret Management
---------+ KSI-SVC-EIS Evaluating and Improving Security
---------+ KSI-SVC-PRR Preventing Residual Risk
---------+ KSI-SVC-RUD Removing Unwanted Data
---------+ KSI-SVC-SIN Securing Information
---------+ KSI-SVC-VCM Validating Communications
---------+ KSI-SVC-VRI Validating Resource Integrity
---+ Rev5 Control Guidance
------+ AC Control Guidance
---------+ AC-6(1) FedRAMP Control Guidance
---------+ AC-20 FedRAMP Control Guidance
---------+ AC-6(2) FedRAMP Control Guidance
---------+ AC-6(8) FedRAMP Control Guidance
------+ AU Control Guidance
---------+ AU-6 FedRAMP Control Guidance
---------+ AU-6(5) FedRAMP Control Guidance
---------+ AU-10 FedRAMP Control Guidance
---------+ AU-12 FedRAMP Control Guidance
------+ CA Control Guidance
---------+ CA-7 FedRAMP Control Guidance
---------+ CA-8 FedRAMP Control Guidance
---------+ CA-2 FedRAMP Control Guidance
---------+ CA-2(3) FedRAMP Control Guidance
------+ CM Control Guidance
---------+ CM-1 FedRAMP Control Guidance
---------+ CM-8 FedRAMP Control Guidance
---------+ CM-11 FedRAMP Control Guidance
---------+ CM-12 FedRAMP Control Guidance
---------+ CM-12(1) FedRAMP Control Guidance
---------+ CM-14 FedRAMP Control Guidance
------+ CP Control Guidance
---------+ CP-7(1) FedRAMP Control Guidance
---------+ CP-2(3) FedRAMP Control Guidance
---------+ CP-10(4) FedRAMP Control Guidance
------+ IA Control Guidance
---------+ IA-2 FedRAMP Control Guidance
---------+ IA-2(1) FedRAMP Control Guidance
---------+ IA-2(2) FedRAMP Control Guidance
---------+ IA-2(8) FedRAMP Control Guidance
---------+ IA-5 FedRAMP Control Guidance
---------+ IA-2(6) FedRAMP Control Guidance
---------+ IA-4(4) FedRAMP Control Guidance
------+ IR Control Guidance
---------+ IR-1 FedRAMP Control Guidance
---------+ IR-2 FedRAMP Control Guidance
---------+ IR-2(1) FedRAMP Control Guidance
---------+ IR-2(2) FedRAMP Control Guidance
---------+ IR-3 FedRAMP Control Guidance
---------+ IR-3(2) FedRAMP Control Guidance
---------+ IR-4 FedRAMP Control Guidance
---------+ IR-4(1) FedRAMP Control Guidance
---------+ IR-4(2) FedRAMP Control Guidance
---------+ IR-4(4) FedRAMP Control Guidance
---------+ IR-4(6) FedRAMP Control Guidance
---------+ IR-4(11) FedRAMP Control Guidance
---------+ IR-5 FedRAMP Control Guidance
---------+ IR-5(1) FedRAMP Control Guidance
---------+ IR-6 FedRAMP Control Guidance
---------+ IR-6(1) FedRAMP Control Guidance
---------+ IR-6(3) FedRAMP Control Guidance
---------+ IR-7 FedRAMP Control Guidance
---------+ IR-7(1) FedRAMP Control Guidance
---------+ IR-8 FedRAMP Control Guidance
---------+ IR-9 FedRAMP Control Guidance
---------+ IR-9(2) FedRAMP Control Guidance
---------+ IR-9(3) FedRAMP Control Guidance
---------+ IR-9(4) FedRAMP Control Guidance
------+ MA Control Guidance
---------+ MA-5 FedRAMP Control Guidance
---------+ MA-5(1) FedRAMP Control Guidance
------+ PS Control Guidance
---------+ PS-7 FedRAMP Control Guidance
------+ RA Control Guidance
---------+ RA-5 FedRAMP Control Guidance
---------+ RA-5(2) FedRAMP Control Guidance
---------+ RA-5(3) FedRAMP Control Guidance
---------+ RA-5(4) FedRAMP Control Guidance
---------+ RA-5(5) FedRAMP Control Guidance
---------+ RA-5(8) FedRAMP Control Guidance
---------+ RA-5(11) FedRAMP Control Guidance
---------+ RA-7 FedRAMP Control Guidance
------+ SA Control Guidance
---------+ SA-5 FedRAMP Control Guidance
---------+ SA-9(5) FedRAMP Control Guidance
---------+ SA-9(2) FedRAMP Control Guidance
------+ SC Control Guidance
---------+ SC-7 FedRAMP Control Guidance
---------+ SC-13 FedRAMP Control Guidance
------+ SI Control Guidance
---------+ SI-2 FedRAMP Control Guidance
---------+ SI-2(2) FedRAMP Control Guidance
---------+ SI-4 FedRAMP Control Guidance
---------+ SI-4(1) FedRAMP Control Guidance
---------+ SI-4(2) FedRAMP Control Guidance
---------+ SI-4(4) FedRAMP Control Guidance
---------+ SI-4(5) FedRAMP Control Guidance
---------+ SI-5 FedRAMP Control Guidance
---------+ SI-8 FedRAMP Control Guidance
------+ SR Control Guidance
---------+ SR-3 FedRAMP Control Guidance
---------+ SR-8 FedRAMP Control Guidance