FedRAMP Consolidated Rules

EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.

Ezen a nyelven nincsenek dokumentumok, az angol nyelvűek jelennek meg.

Feladatok
Feladattípus Megnevezés Forrás
Standard FedRAMP Consolidated Rules for 2026

FedRAMP Consolidated Rules for 2026

Feladatok
Megnevezés Forrás
+ FedRAMP Consolidated Rules for 2026
---+ FedRAMP Definitions
------+ FRD-ACV Accepted Vulnerability
------+ FRD-ADP Adaptive Change
------+ FRD-ADV Advisor
------+ FRD-AGY Agency
------+ FRD-AAP All Affected Parties
------+ FRD-ANA All Necessary Assessors
------+ FRD-ANP All Necessary Parties
------+ FRD-ART Artifacts
------+ FRD-ASR Assessor
------+ FRD-CCL Certification Class
------+ FRD-CCC Certification Class Change
------+ FRD-CRD Certification Data
------+ FRD-CRP Certification Package
------+ FRD-CPH Certification Path
------+ FRD-CPF Certification Profile
------+ FRD-CTY Certification Type
------+ FRD-CSO Cloud Service Offering
------+ FRD-DCE Debilitating Customer Effect
------+ FRD-DTM Deterministic Telemetry
------+ FRD-DCF Disruptive Customer Effect
------+ FRD-DFT Drift
------+ FRD-FPV False Positive Vulnerability
------+ FRD-FCD Federal Customer Data
------+ FRD-FCR FedRAMP Certification Report
------+ FRD-FCT FedRAMP Certified
------+ FRD-FIN FedRAMP Independent Assessment
------+ FRD-FPR FedRAMP Practices
------+ FRD-FRA FedRAMP Recognized
------+ FRD-FRI FedRAMP Reportable Incident
------+ FRD-FSI FedRAMP Security Inbox
------+ FRD-FIR Final Incident Report (FIR)
------+ FRD-FMV Fully Mitigated Vulnerability
------+ FRD-HAN Handle
------+ FRD-INT Incident
------+ FRD-IRS Information Resource
------+ FRD-INC Initial Certification
------+ FRD-IFA Initial FedRAMP Assessment
------+ FRD-IIR Initial Incident Report (IIR)
------+ FRD-IRV Internet-Reachable Vulnerability (IRV)
------+ FRD-KEV Known Exploited Vulnerability (KEV)
------+ FRD-LKY Likely
------+ FRD-LEV Likely Exploitable Vulnerability (LEV)
------+ FRD-MBI Machine-Based (Information Resources)
------+ FRD-MGN Machine-Generated
------+ FRD-MRD Machine-Readable
------+ FRD-MAY MAY
------+ FRD-MCE Minimal Customer Effect
------+ FRD-MAS Minimum Assessment Scope
------+ FRD-MST MUST
------+ FRD-MNT MUST NOT
------+ FRD-NCE Narrow Customer Effect
------+ FRD-ONC Ongoing Certification
------+ FRD-OCR Ongoing Certification Report (OCR)
------+ FRD-OIR Ongoing Incident Report (OIR)
------+ FRD-ODV Overdue Vulnerability
------+ FRD-PMV Partially Mitigated Vulnerability
------+ FRD-PFA Persistent FedRAMP Assessment
------+ FRD-PER Persistently
------+ FRD-PAI Potential Agency Impact
------+ FRD-PAC Privileged Account
------+ FRD-PRO Promptly
------+ FRD-PRV Provider
------+ FRD-QTR Quarterly Review
------+ FRD-RGL Regularly
------+ FRD-RMV Remediated Vulnerability
------+ FRD-RSP Responsibly
------+ FRD-RTR Routine Recurring Change
------+ FRD-SCT Security Category
------+ FRD-SDR Security Decision Record (SDR)
------+ FRD-SHD SHOULD
------+ FRD-SNT SHOULD NOT
------+ FRD-SGC Significant Change
------+ FRD-TPR Third-Party Information Resource
------+ FRD-TLA Top-Level Administrative Account
------+ FRD-TRF Transformative Change
------+ FRD-TRC Trust Center
------+ FRD-VLN Validation
------+ FRD-VRF Verification
------+ FRD-VUL Vulnerability
------+ FRD-VLD Vulnerability Detection
------+ FRD-VLR Vulnerability Response
---+ FedRAMP Rules
------+ AFC Addressing FedRAMP Communication
---------+ AFC-FRP FedRAMP Responsibilities
------------+ AFC-FRP-VRE Verified Emails
------------+ AFC-FRP-CDS Criticality Designators
------------+ AFC-FRP-UFS Use FedRAMP_Security Email in Emergencies
------------+ AFC-FRP-PNT Public Notice of Emergency Tests
------------+ AFC-FRP-RQA Required Actions
------------+ AFC-FRP-ERT Elevated Reaction Timeframes
------------+ AFC-FRP-COR Explain Corrective Actions
------------+ AFC-FRP-RPM Reaction Metrics
---------+ AFC-CSO General Provider Responsibilities
------------+ AFC-CSO-INB Maintain a FedRAMP Security Inbox
------------+ AFC-CSO-NOC Notification of Changes
------------+ AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov
------------+ AFC-CSO-RCV Receive Email Without Disruption
------------+ AFC-CSO-CRA Complete Required Actions
------------+ AFC-CSO-EMR Emergency Message Routing
------------+ AFC-CSO-IMA Important Message Actions
------------+ AFC-CSO-ACK Acknowledge Receipt
------+ AGU Agency Use of FedRAMP Certified Cloud Services
---------+ AGU-AGC General Agency Responsibilities
------------+ AGU-AGC-AIP Agency Internal Policies
------------+ AGU-AGC-NAA Notify FedRAMP After Authorization
------------+ AGU-AGC-GRC Governance, Risk, and Compliance Tools
------------+ AGU-AGC-NAI Notify Additional Information Requests
------------+ AGU-AGC-NAR No Additional Security Requirements
------------+ AGU-AGC-TPP No Certification Type or Path Preferences
------------+ AGU-AGC-WKG FedRAMP Working Groups
------------+ AGU-AGC-LIA Agency Liaison Program
------------+ AGU-AGC-SIN Shared FedRAMP Inbox
---------+ AGU-USE Use of FedRAMP Certifications
------------+ AGU-USE-ABU Authorization Before Use
------------+ AGU-USE-RCF Resolve Certification Package Conflicts
------------+ AGU-USE-RSG Review Secure Configuration Guides
------------+ AGU-USE-AFR Accept FedRAMP Rules
------------+ AGU-USE-NFC Notify FedRAMP of Monitoring Concerns
------------+ AGU-USE-ROR Review Ongoing Certification Reports
------------+ AGU-USE-DSO Designate Senior Official
------------+ AGU-USE-NPC Notify Provider of Concerns
------------+ AGU-USE-RIR Review All Information Resources
------------+ AGU-USE-CLA Using FedRAMP Class A Certifications
---------+ AGU-SPN Agency Sponsored Certifications
------------+ AGU-SPN-MRC Most Recent Consolidated Rules
------+ CCM Collaborative Continuous Monitoring
---------+ CCM-AGM Agency Guidance
------------+ CCM-AGM-ROR Review Ongoing Reports
------------+ CCM-AGM-CSC Consider Security Category
---------+ CCM-OCR Ongoing Certification Reports
------------+ CCM-OCR-AVL Report Availability
------------+ CCM-OCR-NRD Next Report Date
------------+ CCM-OCR-FBM Feedback Mechanism
------------+ CCM-OCR-AFS Anonymized Feedback Summary
------------+ CCM-OCR-LSI Limit Sensitive Information
------------+ CCM-OCR-SOR Spread Out Reports
------------+ CCM-OCR-RPS Responsible Public Certification Report Sharing
---------+ CCM-QTR Quarterly Reviews
------------+ CCM-QTR-MTG Quarterly Review Meeting
------------+ CCM-QTR-REG Meeting Registration Info
------------+ CCM-QTR-NRD Next Review Date
------------+ CCM-QTR-NID No Irresponsible Disclosure
------------+ CCM-QTR-SAR Schedule Around Reports
------------+ CCM-QTR-ACT Additional Content
------------+ CCM-QTR-RTR Record/Transcribe Reviews
------------+ CCM-QTR-RTP Restrict Third Parties
------------+ CCM-QTR-SRR Share Recordings Responsibly
------------+ CCM-QTR-SCR Share Content Responsibly
------+ CDS Certification Data Sharing
---------+ CDS-CSO General Provider Responsibilities
------------+ CDS-CSO-PUB Public Information
------------+ CDS-CSO-SVC Public Service List
------------+ CDS-CSO-FID Always Include FedRAMP ID
------------+ CDS-CSO-FRC FedRAMP Certification Reports
------------+ CDS-CSO-AVR Availability Reporting
------------+ CDS-CSO-UTC Use Trust Centers
------------+ CDS-CSO-CBF Consistency Between Formats
------------+ CDS-CSO-RIS Responsible Information Sharing
------------+ CDS-CSO-IRP Include Relevant Policies
------------+ CDS-CSO-HAD Historical FedRAMP Certification Data
------------+ CDS-CSO-PSM Per-Service Certification Materials
------------+ CDS-CSO-RPS Responsible Public Package Sharing
---------+ CDS-TRC FedRAMP-Compatible Trust Centers
------------+ CDS-TRC-USH Uninterrupted Sharing
------------+ CDS-TRC-PAC Programmatic Access
------------+ CDS-TRC-AAI Agency Access Inventory
------------+ CDS-TRC-ACL Access Logging
------------+ CDS-TRC-HMR Human and Machine-Readable Certification Data
------------+ CDS-TRC-SSM Self-Service Access Management
---------+ CDS-UTC Using a Trust Center
------------+ CDS-UTC-AAD Agency Access Denial
------------+ CDS-UTC-AGA Agency Access
---------+ CDS-CSF Rev5-Specific Provider Responsibilities
------------+ CDS-CSF-TCM Trust Center Migration
------+ CMU Cryptographic Module Use
---------+ CMU-CSO Cloud Service Provider Responsibilities
------------+ CMU-CSO-CMD Cryptographic Module Documentation
------------+ CMU-CSO-UVM Using Validated Cryptographic Modules
------------+ CMU-CSO-CAT Configuration of Agency Tenants
------+ CPO Certification Package Overview
---------+ CPO-CSO General Provider Responsibilities
------------+ CPO-CSO-OVR Overview of the Cloud Service Offering
------------+ CPO-CSO-MTD Certification Package Overview Metadata
------------+ CPO-CSO-OSA Overall Summary of Assessment in Certification Package
---------+ CPO-CSX 20x-Specific Provider Responsibilities
------------+ CPO-CSX-CPM Certification Package Maintenance for 20x
---------+ CPO-CSF Rev5-Specific Provider Responsibilities
------------+ CPO-CSF-CPM Certification Package Maintenance for Rev5
------+ FRC FedRAMP Certification
---------+ FRC-CSO General Provider Responsibilities
------------+ FRC-CSO-FCP FedRAMP Certification Profile
------------+ FRC-CSO-PKG FedRAMP Certification Package
------------+ FRC-CSO-JSN FedRAMP JSON Schemas
------------+ FRC-CSO-MRA Maintain Responsibility and Accountability
------------+ FRC-CSO-POP Pick One Program Certification Type
---------+ FRC-CLA FedRAMP Class A Certification Rules
------------+ FRC-CLA-ASF Approved Alternative Security Frameworks
------------+ FRC-CLA-EAM External Assessment Materials
------------+ FRC-CLA-MFR Mandatory FedRAMP Rules for Class A
------------+ FRC-CLA-RFR Recommended FedRAMP Rules for Class A
------------+ FRC-CLA-OFR Address Optional FedRAMP Rules for Class A
------------+ FRC-CLA-IVV Optional Independent Verification and Validation
---------+ FRC-APP Applying for FedRAMP Certification
------------+ FRC-APP-MLF Marketplace Listing First
------------+ FRC-APP-AFC Applying for FedRAMP Certification
------------+ FRC-APP-FCP Fresh FedRAMP Certification Package
------------+ FRC-APP-FIA Fresh Independent Assessment
------------+ FRC-APP-NTP No Third-Party Applicants
------------+ FRC-APP-USA Updating Stale Assessments
---------+ FRC-APS Applying for FedRAMP Certification with an Agency Sponsor
------------+ FRC-APS-ATO Agency Authorization to Operate
---------+ FRC-CCL Changing Certification Class
------------+ FRC-CCL-UCC Upgrading Certification Class
------------+ FRC-CCL-DCC Downgrading Certification Class
------------+ FRC-CCL-DNP Downgrade Notification Period
---------+ FRC-CSX 20x-Specific Provider Responsibilities
------------+ FRC-CSX-VVK Automated Verification and Validation of Key Security Indicators
------------+ FRC-CSX-VVR Automated Verification and Validation of FedRAMP Rules
------------+ FRC-CSX-MAS Application within MAS
---------+ FRC-CSF Rev5-Specific Provider Responsibilities
------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class B
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class C
---------------+ FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
------------+ FRC-CSF-ACP Assign Control Parameters
------------+ FRC-CSF-FFG Follow FedRAMP Rev5 Controls Guidance
------------+ FRC-CSF-RDY FedRAMP Ready Conversion
------+ IEC Incident Evaluation and Communication
---------+ IEC-FRP FedRAMP Responsibilities
------------+ IEC-FRP-ORV Ongoing Review
---------+ IEC-CSO General Provider Responsibilities
------------+ IEC-CSO-EFR Evaluate FedRAMP Reportability
------------+ IEC-CSO-DPR Default PAIN Rating
------------+ IEC-CSO-IIR Initial Incident Report
------------+ IEC-CSO-OIR Ongoing Incident Reports
------------+ IEC-CSO-FIR Final Incident Report
------------+ IEC-CSO-EFI Estimate Federal Impact
------------+ IEC-CSO-AIR Automated Incident Reporting
------+ IVV Independent Verification and Validation
---------+ IVV-CSO General Provider Responsibilities
------------+ IVV-CSO-FIA FedRAMP Independent Assessments
------------+ IVV-CSO-SEI Supply Evidence of Implementation
------------+ IVV-CSO-SEE Supply Evidence of Effectiveness
------------+ IVV-CSO-ICP Inclusion in Certification Package
------------+ IVV-CSO-DUS Document Use of Representative Samples
------------+ IVV-CSO-STE Supply Technical Explanations
------------+ IVV-CSO-USR Use Representative Samples
------------+ IVV-CSO-RAA Receiving Assessor Advice
---------+ IVV-IAS General Independent Assessor Responsibilities
------------+ IVV-IAS-VIM Verify Implementation
------------+ IVV-IAS-VEF Validate Effectiveness
------------+ IVV-IAS-SUM Assessment Summary
------------+ IVV-IAS-OSA Overall Summary of Assessment
------------+ IVV-IAS-VIP Verify Inclusion in Certification Package
------------+ IVV-IAS-EPX Engage Provider Experts
------------+ IVV-IAS-SHA Sharing Advice
---------+ IVV-CSX 20x-Specific Provider Responsibilities
------------+ IVV-CSX-AIA Annual Independent Assessments for 20x
---------+ IVV-CSF Rev5-Specific Provider Responsibilities
------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class C
---------------+ IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D
------------+ IVV-CSF-MCA Mandatory Control Assessment
------------+ IVV-CSF-ACF Assessment of Rev5 Controls with Findings
------------+ IVV-CSF-PCA Preferred Control Assessment
------+ MAS Minimum Assessment Scope
---------+ MAS-CSO General Provider Responsibilities
------------+ MAS-CSO-IIR Identify Information Resources
------------+ MAS-CSO-FLO Information Flows and Security Categories
------------+ MAS-CSO-TPR Third-Party Information Resources
------------+ MAS-CSO-MDI Metadata Inclusion
------------+ MAS-CSO-SUP Supplemental Information
------+ MKT Marketplace Listing
---------+ MKT-FRP FedRAMP Responsibilities
------------+ MKT-FRP-SOF Scope of FedRAMP
---------+ MKT-CSO General Provider Responsibilities
------------+ MKT-CSO-MLR Marketplace Listing Requirements
------------+ MKT-CSO-PML Provider Marketplace Listing Requests
---------+ MKT-IAS General Assessor Responsibilities
------------+ MKT-IAS-OFR Only FedRAMP Recognized Assessors
------------+ MKT-IAS-WEB Website Requirements for Assessors
------------+ MKT-IAS-LRQ Listing Requests for Assessors
---------+ MKT-CAS General Advisor Responsibilities
------------+ MKT-CAS-WEB Website Requirements for Advisors
------------+ MKT-CAS-LRQ Listing Requests for Advisors
------------+ MKT-CAS-RFR Advisor Responses to FedRAMP
---------+ MKT-IIP Provider Responsibilities for Initial Implementation Phase Listings
------------+ MKT-IIP-AGU Agency Use Cases
------------+ MKT-IIP-DCP Demonstrating Continuous Progress
------------+ MKT-IIP-DLA Deadline for Assessment
------+ REC FedRAMP Recognition of Independent Assessment Services
---------+ REC-FRP FedRAMP Responsibilities
------------+ REC-FRP-FOC Foreign Ownership Collection
------------+ REC-FRP-RAO Recognized Assessors Only
------------+ REC-FRP-DRD Double Revocation Disqualification
---------+ REC-IAS General Independent Assessor Responsibilities
------------+ REC-IAS-ACC A2LA Accreditation
------------+ REC-IAS-ADA Actually Do Assessments
------------+ REC-IAS-PSC Policy and Standards Compliance
------------+ REC-IAS-ANR Annual Surveillance Assessment
------------+ REC-IAS-RAS Full A2LA Reassessment
------------+ REC-IAS-RAR Re-entry after Revocation
------------+ REC-IAS-RQU Roles and Qualifications
------------+ REC-IAS-AFI Annual Foreign Interest Reports
------------+ REC-IAS-CFI Changes in Foreign Interest
------------+ REC-IAS-PST Performance Standards
------------+ REC-IAS-CAP Corrective Action Plan
------------+ REC-IAS-INV Invalid Deliverables
------------+ REC-IAS-SEP Advisory Separation
------+ SCG Secure Configuration Guide
---------+ SCG-CSO General Provider Responsibilities
------------+ SCG-CSO-RSC Recommended Secure Configuration
------------+ SCG-CSO-AUP Use Instructions
------------+ SCG-CSO-PUB Public Secure Configuration Guidance
------------+ SCG-CSO-SDF Secure Defaults
---------+ SCG-ENH Enhanced Capabilities
------------+ SCG-ENH-CMP Comparison Capability
------------+ SCG-ENH-EXP Export Capability
------------+ SCG-ENH-API API Capability
------------+ SCG-ENH-MRG Machine-Readable Guidance
------------+ SCG-ENH-VRH Versioning and Release History
------+ SCN Significant Change Notification
---------+ SCN-FRP FedRAMP Responsibilities
------------+ SCN-FRP-CAP Corrective Action Plan Conditions
---------+ SCN-CSO General Provider Responsibilities
------------+ SCN-CSO-EVA Evaluate Changes
------------+ SCN-CSO-MAR Maintain Audit Records
------------+ SCN-CSO-INF Required Information
------------+ SCN-CSO-HIS Historical Notifications
------------+ SCN-CSO-HRM Human and Machine-Readable Notifications
------------+ SCN-CSO-ARI Additional Relevant Information
------------+ SCN-CSO-NOM Notification Mechanisms
------------+ SCN-CSO-EMG Emergency Changes
---------+ SCN-ADP Adaptive Changes
------------+ SCN-ADP-NTF Notification Requirements
---------+ SCN-RTR Routine Recurring Changes
------------+ SCN-RTR-NNR No Notification Requirements
---------+ SCN-TRF Transformative Changes
------------+ SCN-TRF-NIP Notification of Initial Plans
------------+ SCN-TRF-NFP Notification of Final Plans
------------+ SCN-TRF-NAF Notification After Finishing
------------+ SCN-TRF-NAV Notification After Verification
------------+ SCN-TRF-UPD Update Documentation
------------+ SCN-TRF-TPR Third-Party Review
------+ SDR Security Decision Record
---------+ SDR-CSO General Provider Responsibilities
------------+ SDR-CSO-FRR FedRAMP Rules
------------+ SDR-CSO-MTD Security Decision Record Metadata
---------+ SDR-CSX 20x-Specific Provider Responsibilities
------------+ SDR-CSX-KSI Key Security Indicators
------------+ SDR-CSX-KMT Key Security Indicator Metrics
---------+ SDR-CSF Rev5-Specific Provider Responsibilities
------------+ SDR-CSF-CTF Rev5 Controls
------+ VDR Vulnerability Detection and Response
---------+ VDR-CSO General Provider Responsibilities
------------+ VDR-CSO-DET Vulnerability Detection
------------+ VDR-CSO-RES Vulnerability Response
------------+ VDR-CSO-FAV Failures Are Vulnerabilities
------------+ VDR-CSO-DFR Design For Resilience
------------+ VDR-CSO-ADT Automate Detection
------------+ VDR-CSO-DAC Detect After Changes
------------+ VDR-CSO-MSP Maintain Security
------------+ VDR-CSO-AKE Avoid KEVs
------------+ VDR-CSO-SIR Sampling
---------+ VDR-TFR Timeframes
------------+ VDR-TFR-NMV Non-Machine Verification and Validation
------------+ VDR-TFR-PDD Persistent Drift Detection
------------+ VDR-TFR-PCD Persistently Complete Detection
------------+ VDR-TFR-PVR Mitigation and Remediation Expectations
------------+ VDR-TFR-RMN Remaining Vulnerabilities
------------+ VDR-TFR-KEV Remediate KEVs
------------+ VDR-TFR-PSD Persistent Sample Detection
------------+ VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
------------+ VDR-TFR-MVF Persistent Machine Verification and Validation for Rev5
------+ VER Vulnerability Evaluation and Reporting
---------+ VER-FRP FedRAMP Responsibilities
------------+ VER-FRP-ARP Additional Requirements
------------+ VER-FRP-ADV Sensitive Details
---------+ VER-AGM Agency Guidance
------------+ VER-AGM-RVR Review Vulnerability Reports
------------+ VER-AGM-MAP Maintain Agency Plans of Action and Milestones
---------+ VER-EVA Evaluation
------------+ VER-EVA-ELX Evaluate Exploitability
------------+ VER-EVA-EIR Evaluate Internet-Reachability
------------+ VER-EVA-EPA Estimate Potential Agency Impact
------------+ VER-EVA-AIA Assume It's Automatable
------------+ VER-EVA-GRV Group Vulnerabilities
------------+ VER-EVA-EFP Evaluate False Positives
------------+ VER-EVA-EFA Evaluation Factors
---------+ VER-RPT Reporting
------------+ VER-RPT-PER Persistent Reporting
------------+ VER-RPT-VDT Vulnerability Details
------------+ VER-RPT-AVI Accepted Vulnerability Info
------------+ VER-RPT-NID Responsible Disclosure
------------+ VER-RPT-HLO High-Level Overviews
------------+ VER-RPT-RPD Responsible Public Disclosure
---------+ VER-TFR Timeframes
------------+ VER-TFR-MHR Monthly Activity Report
------------+ VER-TFR-MAV Mark Accepted Vulnerabilities
------------+ VER-TFR-MRH Historical Activity
------------+ VER-TFR-EVU Evaluate Vulnerabilities Quickly
------------+ VER-TFR-IRI Internet-Reachable Incidents
------------+ VER-TFR-NRI Non-Internet-Reachable Incidents
---+ Key Security Indicators
------+ KSI-CED Cybersecurity Education
---------+ KSI-CED-RAT Reviewing All Training
------+ KSI-CMT Change Management
---------+ KSI-CMT-LMC Logging Changes
---------+ KSI-CMT-RMV Redeploying vs Modifying
---------+ KSI-CMT-RVP Reviewing Change Procedures
---------+ KSI-CMT-VTD Validating Throughout Deployment
------+ KSI-CNA Cloud Native Architecture
---------+ KSI-CNA-DFP Defining Functionality and Privileges
---------+ KSI-CNA-EIS Enforcing Intended State
---------+ KSI-CNA-IBP Implementing Best Practices
---------+ KSI-CNA-MAT Minimizing Attack Surface
---------+ KSI-CNA-OFA Optimizing for Availability
---------+ KSI-CNA-RNT Restricting Network Traffic
---------+ KSI-CNA-RVP Reviewing Protections
---------+ KSI-CNA-ULN Using Logical Networking
------+ KSI-IAM Identity and Access Management
---------+ KSI-IAM-AAM Automating Account Management
---------+ KSI-IAM-APM Adopting Passwordless Methods
---------+ KSI-IAM-ELP Ensuring Least Privilege
---------+ KSI-IAM-JIT Authorizing Just-in-Time
---------+ KSI-IAM-SNU Securing Non-User Authentication
---------+ KSI-IAM-SUS Responding to Suspicious Activity
------+ KSI-INR Incident Response
---------+ KSI-INR-AAR Generating After Action Reports
---------+ KSI-INR-RIR Reviewing Incident Response Procedures
---------+ KSI-INR-RPI Reviewing Past Incidents
------+ KSI-MLA Monitoring, Logging, and Auditing
---------+ KSI-MLA-ALA Authorizing Log Access
---------+ KSI-MLA-EVC Evaluating Configurations
---------+ KSI-MLA-LET Logging Event Types
---------+ KSI-MLA-OSM Operating SIEM Capability
---------+ KSI-MLA-RVL Reviewing Logs
------+ KSI-PIY Policy and Inventory
---------+ KSI-PIY-GIV Generating Inventories
---------+ KSI-PIY-RES Reviewing Executive Support
---------+ KSI-PIY-RIS Reviewing Investments in Security
---------+ KSI-PIY-RSD Reviewing Security in the SDLC
---------+ KSI-PIY-RVD Reviewing Vulnerability Disclosures
------+ KSI-RPL Recovery Planning
---------+ KSI-RPL-ABO Aligning Backups with Objectives
---------+ KSI-RPL-ARP Aligning Recovery Plan
---------+ KSI-RPL-RRO Reviewing Recovery Objectives
---------+ KSI-RPL-TRC Testing Recovery Capabilities
------+ KSI-SCR Supply Chain Risk
---------+ KSI-SCR-MIT Mitigating Supply Chain Risk
---------+ KSI-SCR-MON Monitoring Supply Chain Risk
------+ KSI-SVC Service Configuration
---------+ KSI-SVC-ACM Automating Configuration Management
---------+ KSI-SVC-ASM Automating Secret Management
---------+ KSI-SVC-EIS Evaluating and Improving Security
---------+ KSI-SVC-PRR Preventing Residual Risk
---------+ KSI-SVC-RUD Removing Unwanted Data
---------+ KSI-SVC-SIN Securing Information
---------+ KSI-SVC-VCM Validating Communications
---------+ KSI-SVC-VRI Validating Resource Integrity
---+ Rev5 Control Guidance
------+ AC Control Guidance
---------+ AC-6(1) FedRAMP Control Guidance
---------+ AC-20 FedRAMP Control Guidance
---------+ AC-6(2) FedRAMP Control Guidance
---------+ AC-6(8) FedRAMP Control Guidance
------+ AU Control Guidance
---------+ AU-6 FedRAMP Control Guidance
---------+ AU-6(5) FedRAMP Control Guidance
---------+ AU-10 FedRAMP Control Guidance
---------+ AU-12 FedRAMP Control Guidance
------+ CA Control Guidance
---------+ CA-7 FedRAMP Control Guidance
---------+ CA-8 FedRAMP Control Guidance
---------+ CA-2 FedRAMP Control Guidance
---------+ CA-2(3) FedRAMP Control Guidance
------+ CM Control Guidance
---------+ CM-1 FedRAMP Control Guidance
---------+ CM-8 FedRAMP Control Guidance
---------+ CM-11 FedRAMP Control Guidance
---------+ CM-12 FedRAMP Control Guidance
---------+ CM-12(1) FedRAMP Control Guidance
---------+ CM-14 FedRAMP Control Guidance
------+ CP Control Guidance
---------+ CP-7(1) FedRAMP Control Guidance
---------+ CP-2(3) FedRAMP Control Guidance
---------+ CP-10(4) FedRAMP Control Guidance
------+ IA Control Guidance
---------+ IA-2 FedRAMP Control Guidance
---------+ IA-2(1) FedRAMP Control Guidance
---------+ IA-2(2) FedRAMP Control Guidance
---------+ IA-2(8) FedRAMP Control Guidance
---------+ IA-5 FedRAMP Control Guidance
---------+ IA-2(6) FedRAMP Control Guidance
---------+ IA-4(4) FedRAMP Control Guidance
------+ IR Control Guidance
---------+ IR-1 FedRAMP Control Guidance
---------+ IR-2 FedRAMP Control Guidance
---------+ IR-2(1) FedRAMP Control Guidance
---------+ IR-2(2) FedRAMP Control Guidance
---------+ IR-3 FedRAMP Control Guidance
---------+ IR-3(2) FedRAMP Control Guidance
---------+ IR-4 FedRAMP Control Guidance
---------+ IR-4(1) FedRAMP Control Guidance
---------+ IR-4(2) FedRAMP Control Guidance
---------+ IR-4(4) FedRAMP Control Guidance
---------+ IR-4(6) FedRAMP Control Guidance
---------+ IR-4(11) FedRAMP Control Guidance
---------+ IR-5 FedRAMP Control Guidance
---------+ IR-5(1) FedRAMP Control Guidance
---------+ IR-6 FedRAMP Control Guidance
---------+ IR-6(1) FedRAMP Control Guidance
---------+ IR-6(3) FedRAMP Control Guidance
---------+ IR-7 FedRAMP Control Guidance
---------+ IR-7(1) FedRAMP Control Guidance
---------+ IR-8 FedRAMP Control Guidance
---------+ IR-9 FedRAMP Control Guidance
---------+ IR-9(2) FedRAMP Control Guidance
---------+ IR-9(3) FedRAMP Control Guidance
---------+ IR-9(4) FedRAMP Control Guidance
------+ MA Control Guidance
---------+ MA-5 FedRAMP Control Guidance
---------+ MA-5(1) FedRAMP Control Guidance
------+ PS Control Guidance
---------+ PS-7 FedRAMP Control Guidance
------+ RA Control Guidance
---------+ RA-5 FedRAMP Control Guidance
---------+ RA-5(2) FedRAMP Control Guidance
---------+ RA-5(3) FedRAMP Control Guidance
---------+ RA-5(4) FedRAMP Control Guidance
---------+ RA-5(5) FedRAMP Control Guidance
---------+ RA-5(8) FedRAMP Control Guidance
---------+ RA-5(11) FedRAMP Control Guidance
---------+ RA-7 FedRAMP Control Guidance
------+ SA Control Guidance
---------+ SA-5 FedRAMP Control Guidance
---------+ SA-9(5) FedRAMP Control Guidance
---------+ SA-9(2) FedRAMP Control Guidance
------+ SC Control Guidance
---------+ SC-7 FedRAMP Control Guidance
---------+ SC-13 FedRAMP Control Guidance
------+ SI Control Guidance
---------+ SI-2 FedRAMP Control Guidance
---------+ SI-2(2) FedRAMP Control Guidance
---------+ SI-4 FedRAMP Control Guidance
---------+ SI-4(1) FedRAMP Control Guidance
---------+ SI-4(2) FedRAMP Control Guidance
---------+ SI-4(4) FedRAMP Control Guidance
---------+ SI-4(5) FedRAMP Control Guidance
---------+ SI-5 FedRAMP Control Guidance
---------+ SI-8 FedRAMP Control Guidance
------+ SR Control Guidance
---------+ SR-3 FedRAMP Control Guidance
---------+ SR-8 FedRAMP Control Guidance