bmad-plus 0.8.0 → 0.9.1

package/src/bmad-plus/packs/pack-shield/references/fedramp/control-families.md

@@ -1,281 +1,281 @@
-# NIST SP 800-53 Rev 5 Control Families — FedRAMP Deep Dive
-
-All 20 control families are required by FedRAMP. This guide covers each family's
-FedRAMP-specific requirements, common findings, and implementation notes.
-
-FedRAMP baselines (Rev 5): Low ≈ 156 | Moderate = 323 | High = 421 controls and control enhancements.
-
----
-
-## AC — Access Control
-
-**Key FedRAMP requirements:**
-- **AC-2**: Account management — must document account types, provisioning/de-provisioning process, periodic review (at minimum annually for privileged accounts)
-- **AC-3**: Access enforcement — RBAC required; document roles and associated privileges
-- **AC-6**: Least privilege — document how least privilege is enforced; privileged access must be explicitly justified
-- **AC-17**: Remote access — MFA required on all remote access; document all remote access methods
-- **AC-20**: Use of external systems — document all external connections; must be FedRAMP-authorized or have compensating controls
-
-**FedRAMP parameter overrides:** AC-2 requires account reviews at specific FedRAMP-defined frequencies (more stringent than base NIST). Review the FedRAMP parameter values workbook for your baseline.
-
-**Common findings:** Shared accounts not documented or controlled; no evidence of periodic access reviews; remote access methods not fully documented; excessive admin privileges.
-
----
-
-## AT — Awareness & Training
-
-**Key FedRAMP requirements:**
-- **AT-2**: Literacy training and awareness — annual security awareness training for all users; includes privacy training (Rev 5)
-- **AT-3**: Role-based training — additional training for personnel with security responsibilities; includes privacy-role training (Rev 5)
-- **AT-4**: Training records — maintain records of completion; auditors will request training logs
-
-**Common findings:** Training completion rate below 100%; no records of role-based training for ISSOs/security engineers; privacy training not included in AT-3 curriculum.
-
----
-
-## AU — Audit & Accountability
-
-**Key FedRAMP requirements:**
-- **AU-2**: Event logging — document which events are logged across all boundary components
-- **AU-3**: Content of audit records — logs must include: timestamp, source, event type, outcome, user/process identity
-- **AU-9**: Protection of audit information — log integrity; logs must be protected from tampering
-- **AU-11**: Audit record retention — **90 days online (hot storage); 1 year total** (FedRAMP-defined)
-- **AU-12**: Audit record generation — 100% of in-boundary components must generate logs
-
-**Common findings:** Not all boundary components sending logs to SIEM; log retention shorter than 90 days online; logs not protected from deletion by admins; no log review/alerting process documented.
-
----
-
-## CA — Assessment, Authorization & Monitoring
-
-**Key FedRAMP requirements:**
-- **CA-2**: Control assessments — 3PAO annual assessment required
-- **CA-5**: Plan of action and milestones — POA&M maintained and updated monthly
-- **CA-7**: Continuous monitoring — ConMon program documented and executed (see ConMon Monthly requirements)
-- **CA-8**: Penetration testing — required annually for High baseline; recommended for Moderate
-- **CA-9**: Internal system connections — all internal connections documented with ISAs/MOUs
-
-**Common findings:** ConMon activities not documented; POA&M items stale with no milestone updates; penetration testing not performed at required frequency.
-
----
-
-## CM — Configuration Management
-
-**Key FedRAMP requirements:**
-- **CM-2**: Baseline configuration — secure baselines defined for all component types; CIS Benchmarks or DISA STIGs recommended
-- **CM-3**: Configuration change control — formal CCB process with documented approval chain
-- **CM-6**: Configuration settings — FedRAMP-defined configuration settings must be implemented; deviations documented
-- **CM-7**: Least functionality — disable/remove unused functions, ports, protocols, services; document all allowed ports/protocols/services (PPS table in SSP Section 7)
-- **CM-8**: System component inventory — IIW maintained and current; covers all in-boundary assets
-
-**Common findings:** Configuration baselines not formally documented; deviations from baselines not tracked; PPS table incomplete or inconsistent with network diagrams; IIW not updated when new assets are added.
-
----
-
-## CP — Contingency Planning
-
-**Key FedRAMP requirements:**
-- **CP-2**: Contingency plan — documented ISCP using FedRAMP template; includes RTO/RPO
-- **CP-4**: Contingency plan testing — tested at least annually; tabletop minimum, functional preferred for High
-- **CP-6**: Alternate storage site — required for Moderate and High; geographically separated
-- **CP-9**: System backup — backup frequency, testing, and off-site storage documented
-
-**Common findings:** CP tested with tabletop only for High baseline (functional test required); RTO/RPO not validated through testing; alternate site not configured or tested; backup restoration not verified.
-
----
-
-## IA — Identification & Authentication
-
-**Key FedRAMP requirements:**
-- **IA-2**: Identification and authentication — MFA required for **all** accounts accessing federal systems; no exceptions for privileged accounts
-- **IA-2(1)**: MFA for privileged accounts — phishing-resistant MFA strongly preferred for High
-- **IA-5**: Authenticator management — NIST SP 800-63B alignment: no forced rotation schedules; require compromised-password lists and password strength meters
-- **IA-8**: Non-organizational users — PIV/CAC required or justified alternative for agency users on High baseline
-- **IA-12**: Identity proofing — required for Rev 5; document identity proofing process for privileged users
-
-**FedRAMP encryption requirement:** All authenticator storage must use FIPS 140-2/3 validated cryptographic modules.
-
-**Common findings:** MFA not enforced on all remote access; legacy password rotation policies inconsistent with NIST 800-63B; PIV/CAC not supported on High baseline without documented compensating controls.
-
----
-
-## IR — Incident Response
-
-**Key FedRAMP requirements:**
-- **IR-3**: Incident response testing — tested at least annually (tabletop minimum)
-- **IR-5**: Incident monitoring — automated alerting from SIEM required
-- **IR-6**: Incident reporting — **report to US-CERT/CISA within 1 hour of discovery** for high-priority incidents; report to agency AO within 1 hour for incidents affecting federal data; notify FedRAMP PMO Security Inbox
-- **IR-8**: Incident response plan — must be current, tested, and include FedRAMP-specific contacts and reporting SLAs
-
-**Common findings:** IRP does not include FedRAMP PMO Security Inbox in notification chain; 1-hour reporting SLA not documented; IRP not tested annually; no documented evidence of past incident handling.
-
----
-
-## MA — Maintenance
-
-**Key FedRAMP requirements:**
-- **MA-4**: Non-local maintenance — remote maintenance sessions must be documented, monitored, and terminated when complete; MFA required for remote maintenance
-- **MA-5**: Maintenance personnel — screening requirements for maintenance personnel who access the system
-
-**Common findings:** Remote maintenance not logged or monitored; maintenance personnel without appropriate clearances accessing federal data.
-
----
-
-## MP — Media Protection
-
-**Key FedRAMP requirements:**
-- **MP-5**: Media transport — encryption required for media containing federal data in transit
-- **MP-6**: Media sanitization — NIST SP 800-88 compliant sanitization procedures for media disposal; document and retain sanitization records
-- **MP-7**: Media use — restrict or prohibit use of portable media (USB drives) within boundary
-
-**Common findings:** No documented media sanitization procedures; portable media not restricted; cloud-native CSPs often need to document how MP controls apply to logical media (disk images, snapshots).
-
----
-
-## PE — Physical & Environmental Protection
-
-**Key FedRAMP requirements:**
-- PE controls are typically **fully inherited** from IaaS/PaaS providers (AWS GovCloud, Azure Government, GCP)
-- Document inherited PE controls in CIS/CRM workbook; customer-responsible PE controls (e.g., workstation access at CSP offices) must still be addressed
-- **PE-3**: Physical access control — must document physical access controls for any CSP-operated facilities within scope
-
-**Common findings:** PE controls marked as inherited without documenting which IaaS controls cover them; CSP office physical access not addressed even when within boundary scope.
-
----
-
-## PL — Planning
-
-**Key FedRAMP requirements:**
-- **PL-2**: System security and privacy plans — the SSP itself; must be complete, current, and approved
-- **PL-4**: Rules of behavior — SSP Appendix E; must be signed by all users
-- **PL-10**: Baseline selection — document the FedRAMP baseline selected and rationale
-
-**Common findings:** SSP not updated to reflect system changes; RoB signatures not maintained; baseline selection not formally documented.
-
----
-
-## PM — Program Management
-
-**Key FedRAMP requirements:**
-- PM controls are **enterprise-level** — they describe the organizational security program, not individual system controls
-- **PM-9**: Risk management strategy — enterprise risk management framework documented
-- **PM-28**: Risk framing — new in Rev 5; document how risk is framed at organizational level
-- PM controls are often addressed organizationally and referenced in the SSP
-
-**Common findings:** PM controls addressed for the system without organizational context; PM-28 (new Rev 5) missing from newer SSPs.
-
----
-
-## PS — Personnel Security
-
-**Key FedRAMP requirements:**
-- **PS-3**: Personnel screening — background checks for all personnel with access to federal data; document screening criteria
-- **PS-4**: Personnel termination — immediate access revocation upon termination; documented process required
-- **PS-5**: Personnel transfer — access review and adjustment upon role changes
-- **PS-6**: Access agreements — non-disclosure agreements and access agreements documented and signed
-
-**Common findings:** Termination process not documented or not consistently followed; contractors not covered by screening requirements; NDA records not maintained.
-
----
-
-## PT — PII Processing & Transparency (New in Rev 5)
-
-**Key FedRAMP requirements:**
-- **PT-1**: Policy and procedures — PII processing and transparency policy required
-- **PT-2**: Authority to process PII — legal authority for each PII type documented
-- **PT-3**: Personally identifiable information processing purposes — document why each PII element is collected
-- **PT-5**: Privacy notice — users informed of PII collection and use
-- **PT-6**: System of records notice — required if system is a Privacy Act System of Records
-
-**Note:** PT controls apply whenever the system collects, processes, stores, or transmits PII. If the system handles no PII, PT controls may be marked Not Applicable — but this determination must be documented and supported by the FIPS 199 categorization.
-
-**Common findings:** PT control family entirely missing from Rev 4 → Rev 5 transitioned SSPs; PII inventory not documented; Privacy Act System of Records determination not made.
-
----
-
-## RA — Risk Assessment
-
-**Key FedRAMP requirements:**
-- **RA-3**: Risk assessment — system-level risk assessment completed and updated
-- **RA-5**: Vulnerability monitoring and scanning — automated scanning required:
-  - OS/infrastructure: **monthly minimum**
-  - Web application: **monthly minimum**
-  - Database: **monthly minimum**
-  - Container images: per CI/CD pipeline and prior to deployment
-  - 100% coverage of in-boundary assets required
-- **RA-5(11)**: Public disclosure program — FedRAMP encourages CSPs to have a vulnerability disclosure policy (VDP)
-- **RA-7**: Risk response — document how scan findings are triaged and remediation prioritized
-
-**Common findings:** Scan coverage gaps (e.g., database servers not scanned, containers not included); scan frequency below monthly; no documented remediation SLA tracking.
-
----
-
-## SA — System & Services Acquisition
-
-**Key FedRAMP requirements:**
-- **SA-4**: Acquisition process — security requirements included in procurement contracts
-- **SA-9**: External system services — all external services documented; FedRAMP-authorized where applicable
-- **SA-11**: Developer testing and evaluation — secure development practices documented (SDLC)
-- **SA-15**: Development process, standards, and tools — SDLC security requirements
-
-**Common findings:** External SaaS tools used by CSP admins not in the external services table; no documented SDLC security requirements; third-party libraries not tracked.
-
----
-
-## SC — System & Communications Protection
-
-**Key FedRAMP requirements:**
-- **SC-5**: Denial of service protection — DDoS protection documented (often via IaaS/CDN)
-- **SC-7**: Boundary protection — firewall/WAF rules documented; all ingress/egress controlled
-- **SC-8**: Transmission confidentiality and integrity — **TLS 1.2 minimum; TLS 1.3 preferred** for all data in transit
-- **SC-12**: Cryptographic key establishment and management — key management procedures documented
-- **SC-28**: Protection of information at rest — encryption at rest with FIPS 140-2/3 validated modules
-- **SC-39**: Process isolation — application processes isolated from each other
-
-**Common findings:** TLS 1.0/1.1 still enabled on endpoints; key management undocumented; network segmentation not depicted in architecture diagrams; boundary not fully enforced (undocumented egress paths).
-
----
-
-## SI — System & Information Integrity
-
-**Key FedRAMP requirements:**
-- **SI-2**: Flaw remediation — patch management SLAs: Critical 30d / High 90d / Moderate 180d / Low 365d
-- **SI-3**: Malicious code protection — endpoint protection on all applicable components; real-time scanning
-- **SI-4**: System monitoring — SIEM with alerting; anomaly detection documented
-- **SI-7**: Software, firmware, and information integrity — file integrity monitoring (FIM) on critical system files
-- **SI-10**: Information input validation — input validation for all public-facing applications (ties to web app scanning)
-
-**Common findings:** Patch SLAs not tracked or enforced; FIM not deployed on critical servers; SIEM alerts not reviewed or tuned; malware protection not on all applicable endpoints (e.g., Linux servers overlooked).
-
----
-
-## SR — Supply Chain Risk Management (New in Rev 5)
-
-**Key FedRAMP requirements:**
-- **SR-1**: Policy and procedures — SCRM policy required (SSP Appendix P)
-- **SR-2**: Supply chain risk management plan — documented in Appendix P
-- **SR-3**: Supply chain controls and processes — supplier assessment process defined
-- **SR-4**: Provenance — track origin and custody of hardware and software components
-- **SR-5**: Acquisition strategies, tools, and methods — preferred suppliers and vetting criteria documented
-- **SR-8**: Notification agreements — notification from suppliers of security incidents or product changes
-- **SR-11**: Component authenticity — anti-counterfeit measures for hardware
-- **SR-12**: Component disposal — secure disposal of hardware and software components
-
-**Note:** SR is the newest family and frequently has gaps in SSPs transitioned from Rev 4. Prioritize SR-1, SR-2, and SR-3 for initial authorization; remaining controls can be phased in via POA&M with AO agreement.
-
-**Common findings:** Appendix P (SCRM Plan) is a template placeholder with no CSP-specific content; no SBOM process; critical software components (open source libraries) not tracked for vulnerabilities; SR controls entirely absent from Rev 4-era SSPs.
-
----
-
-## Summary: Control Count by Baseline (Rev 5)
-
-| Baseline | Controls & Enhancements | Primary Use |
-|----------|------------------------|-------------|
-| LI-SaaS | Subset of Low (~54 controls) | Low-impact SaaS with no PII, no sensitive federal data |
-| Low | ~156 | Limited adverse effect on federal mission/assets |
-| Moderate | 323 | Serious adverse effect — most common baseline |
-| High | 421 | Severe or catastrophic effect (law enforcement, health, financial) |
-
-> Control counts include base controls and all required control enhancements at each baseline.
-> FedRAMP parameter values (FedRAMP-defined values) may be stricter than base NIST requirements —
-> always check the FedRAMP parameter values workbook for your baseline.
+# NIST SP 800-53 Rev 5 Control Families — FedRAMP Deep Dive
+
+All 20 control families are required by FedRAMP. This guide covers each family's
+FedRAMP-specific requirements, common findings, and implementation notes.
+
+FedRAMP baselines (Rev 5): Low ≈ 156 | Moderate = 323 | High = 421 controls and control enhancements.
+
+---
+
+## AC — Access Control
+
+**Key FedRAMP requirements:**
+- **AC-2**: Account management — must document account types, provisioning/de-provisioning process, periodic review (at minimum annually for privileged accounts)
+- **AC-3**: Access enforcement — RBAC required; document roles and associated privileges
+- **AC-6**: Least privilege — document how least privilege is enforced; privileged access must be explicitly justified
+- **AC-17**: Remote access — MFA required on all remote access; document all remote access methods
+- **AC-20**: Use of external systems — document all external connections; must be FedRAMP-authorized or have compensating controls
+
+**FedRAMP parameter overrides:** AC-2 requires account reviews at specific FedRAMP-defined frequencies (more stringent than base NIST). Review the FedRAMP parameter values workbook for your baseline.
+
+**Common findings:** Shared accounts not documented or controlled; no evidence of periodic access reviews; remote access methods not fully documented; excessive admin privileges.
+
+---
+
+## AT — Awareness & Training
+
+**Key FedRAMP requirements:**
+- **AT-2**: Literacy training and awareness — annual security awareness training for all users; includes privacy training (Rev 5)
+- **AT-3**: Role-based training — additional training for personnel with security responsibilities; includes privacy-role training (Rev 5)
+- **AT-4**: Training records — maintain records of completion; auditors will request training logs
+
+**Common findings:** Training completion rate below 100%; no records of role-based training for ISSOs/security engineers; privacy training not included in AT-3 curriculum.
+
+---
+
+## AU — Audit & Accountability
+
+**Key FedRAMP requirements:**
+- **AU-2**: Event logging — document which events are logged across all boundary components
+- **AU-3**: Content of audit records — logs must include: timestamp, source, event type, outcome, user/process identity
+- **AU-9**: Protection of audit information — log integrity; logs must be protected from tampering
+- **AU-11**: Audit record retention — **90 days online (hot storage); 1 year total** (FedRAMP-defined)
+- **AU-12**: Audit record generation — 100% of in-boundary components must generate logs
+
+**Common findings:** Not all boundary components sending logs to SIEM; log retention shorter than 90 days online; logs not protected from deletion by admins; no log review/alerting process documented.
+
+---
+
+## CA — Assessment, Authorization & Monitoring
+
+**Key FedRAMP requirements:**
+- **CA-2**: Control assessments — 3PAO annual assessment required
+- **CA-5**: Plan of action and milestones — POA&M maintained and updated monthly
+- **CA-7**: Continuous monitoring — ConMon program documented and executed (see ConMon Monthly requirements)
+- **CA-8**: Penetration testing — required annually for High baseline; recommended for Moderate
+- **CA-9**: Internal system connections — all internal connections documented with ISAs/MOUs
+
+**Common findings:** ConMon activities not documented; POA&M items stale with no milestone updates; penetration testing not performed at required frequency.
+
+---
+
+## CM — Configuration Management
+
+**Key FedRAMP requirements:**
+- **CM-2**: Baseline configuration — secure baselines defined for all component types; CIS Benchmarks or DISA STIGs recommended
+- **CM-3**: Configuration change control — formal CCB process with documented approval chain
+- **CM-6**: Configuration settings — FedRAMP-defined configuration settings must be implemented; deviations documented
+- **CM-7**: Least functionality — disable/remove unused functions, ports, protocols, services; document all allowed ports/protocols/services (PPS table in SSP Section 7)
+- **CM-8**: System component inventory — IIW maintained and current; covers all in-boundary assets
+
+**Common findings:** Configuration baselines not formally documented; deviations from baselines not tracked; PPS table incomplete or inconsistent with network diagrams; IIW not updated when new assets are added.
+
+---
+
+## CP — Contingency Planning
+
+**Key FedRAMP requirements:**
+- **CP-2**: Contingency plan — documented ISCP using FedRAMP template; includes RTO/RPO
+- **CP-4**: Contingency plan testing — tested at least annually; tabletop minimum, functional preferred for High
+- **CP-6**: Alternate storage site — required for Moderate and High; geographically separated
+- **CP-9**: System backup — backup frequency, testing, and off-site storage documented
+
+**Common findings:** CP tested with tabletop only for High baseline (functional test required); RTO/RPO not validated through testing; alternate site not configured or tested; backup restoration not verified.
+
+---
+
+## IA — Identification & Authentication
+
+**Key FedRAMP requirements:**
+- **IA-2**: Identification and authentication — MFA required for **all** accounts accessing federal systems; no exceptions for privileged accounts
+- **IA-2(1)**: MFA for privileged accounts — phishing-resistant MFA strongly preferred for High
+- **IA-5**: Authenticator management — NIST SP 800-63B alignment: no forced rotation schedules; require compromised-password lists and password strength meters
+- **IA-8**: Non-organizational users — PIV/CAC required or justified alternative for agency users on High baseline
+- **IA-12**: Identity proofing — required for Rev 5; document identity proofing process for privileged users
+
+**FedRAMP encryption requirement:** All authenticator storage must use FIPS 140-2/3 validated cryptographic modules.
+
+**Common findings:** MFA not enforced on all remote access; legacy password rotation policies inconsistent with NIST 800-63B; PIV/CAC not supported on High baseline without documented compensating controls.
+
+---
+
+## IR — Incident Response
+
+**Key FedRAMP requirements:**
+- **IR-3**: Incident response testing — tested at least annually (tabletop minimum)
+- **IR-5**: Incident monitoring — automated alerting from SIEM required
+- **IR-6**: Incident reporting — **report to US-CERT/CISA within 1 hour of discovery** for high-priority incidents; report to agency AO within 1 hour for incidents affecting federal data; notify FedRAMP PMO Security Inbox
+- **IR-8**: Incident response plan — must be current, tested, and include FedRAMP-specific contacts and reporting SLAs
+
+**Common findings:** IRP does not include FedRAMP PMO Security Inbox in notification chain; 1-hour reporting SLA not documented; IRP not tested annually; no documented evidence of past incident handling.
+
+---
+
+## MA — Maintenance
+
+**Key FedRAMP requirements:**
+- **MA-4**: Non-local maintenance — remote maintenance sessions must be documented, monitored, and terminated when complete; MFA required for remote maintenance
+- **MA-5**: Maintenance personnel — screening requirements for maintenance personnel who access the system
+
+**Common findings:** Remote maintenance not logged or monitored; maintenance personnel without appropriate clearances accessing federal data.
+
+---
+
+## MP — Media Protection
+
+**Key FedRAMP requirements:**
+- **MP-5**: Media transport — encryption required for media containing federal data in transit
+- **MP-6**: Media sanitization — NIST SP 800-88 compliant sanitization procedures for media disposal; document and retain sanitization records
+- **MP-7**: Media use — restrict or prohibit use of portable media (USB drives) within boundary
+
+**Common findings:** No documented media sanitization procedures; portable media not restricted; cloud-native CSPs often need to document how MP controls apply to logical media (disk images, snapshots).
+
+---
+
+## PE — Physical & Environmental Protection
+
+**Key FedRAMP requirements:**
+- PE controls are typically **fully inherited** from IaaS/PaaS providers (AWS GovCloud, Azure Government, GCP)
+- Document inherited PE controls in CIS/CRM workbook; customer-responsible PE controls (e.g., workstation access at CSP offices) must still be addressed
+- **PE-3**: Physical access control — must document physical access controls for any CSP-operated facilities within scope
+
+**Common findings:** PE controls marked as inherited without documenting which IaaS controls cover them; CSP office physical access not addressed even when within boundary scope.
+
+---
+
+## PL — Planning
+
+**Key FedRAMP requirements:**
+- **PL-2**: System security and privacy plans — the SSP itself; must be complete, current, and approved
+- **PL-4**: Rules of behavior — SSP Appendix E; must be signed by all users
+- **PL-10**: Baseline selection — document the FedRAMP baseline selected and rationale
+
+**Common findings:** SSP not updated to reflect system changes; RoB signatures not maintained; baseline selection not formally documented.
+
+---
+
+## PM — Program Management
+
+**Key FedRAMP requirements:**
+- PM controls are **enterprise-level** — they describe the organizational security program, not individual system controls
+- **PM-9**: Risk management strategy — enterprise risk management framework documented
+- **PM-28**: Risk framing — new in Rev 5; document how risk is framed at organizational level
+- PM controls are often addressed organizationally and referenced in the SSP
+
+**Common findings:** PM controls addressed for the system without organizational context; PM-28 (new Rev 5) missing from newer SSPs.
+
+---
+
+## PS — Personnel Security
+
+**Key FedRAMP requirements:**
+- **PS-3**: Personnel screening — background checks for all personnel with access to federal data; document screening criteria
+- **PS-4**: Personnel termination — immediate access revocation upon termination; documented process required
+- **PS-5**: Personnel transfer — access review and adjustment upon role changes
+- **PS-6**: Access agreements — non-disclosure agreements and access agreements documented and signed
+
+**Common findings:** Termination process not documented or not consistently followed; contractors not covered by screening requirements; NDA records not maintained.
+
+---
+
+## PT — PII Processing & Transparency (New in Rev 5)
+
+**Key FedRAMP requirements:**
+- **PT-1**: Policy and procedures — PII processing and transparency policy required
+- **PT-2**: Authority to process PII — legal authority for each PII type documented
+- **PT-3**: Personally identifiable information processing purposes — document why each PII element is collected
+- **PT-5**: Privacy notice — users informed of PII collection and use
+- **PT-6**: System of records notice — required if system is a Privacy Act System of Records
+
+**Note:** PT controls apply whenever the system collects, processes, stores, or transmits PII. If the system handles no PII, PT controls may be marked Not Applicable — but this determination must be documented and supported by the FIPS 199 categorization.
+
+**Common findings:** PT control family entirely missing from Rev 4 → Rev 5 transitioned SSPs; PII inventory not documented; Privacy Act System of Records determination not made.
+
+---
+
+## RA — Risk Assessment
+
+**Key FedRAMP requirements:**
+- **RA-3**: Risk assessment — system-level risk assessment completed and updated
+- **RA-5**: Vulnerability monitoring and scanning — automated scanning required:
+  - OS/infrastructure: **monthly minimum**
+  - Web application: **monthly minimum**
+  - Database: **monthly minimum**
+  - Container images: per CI/CD pipeline and prior to deployment
+  - 100% coverage of in-boundary assets required
+- **RA-5(11)**: Public disclosure program — FedRAMP encourages CSPs to have a vulnerability disclosure policy (VDP)
+- **RA-7**: Risk response — document how scan findings are triaged and remediation prioritized
+
+**Common findings:** Scan coverage gaps (e.g., database servers not scanned, containers not included); scan frequency below monthly; no documented remediation SLA tracking.
+
+---
+
+## SA — System & Services Acquisition
+
+**Key FedRAMP requirements:**
+- **SA-4**: Acquisition process — security requirements included in procurement contracts
+- **SA-9**: External system services — all external services documented; FedRAMP-authorized where applicable
+- **SA-11**: Developer testing and evaluation — secure development practices documented (SDLC)
+- **SA-15**: Development process, standards, and tools — SDLC security requirements
+
+**Common findings:** External SaaS tools used by CSP admins not in the external services table; no documented SDLC security requirements; third-party libraries not tracked.
+
+---
+
+## SC — System & Communications Protection
+
+**Key FedRAMP requirements:**
+- **SC-5**: Denial of service protection — DDoS protection documented (often via IaaS/CDN)
+- **SC-7**: Boundary protection — firewall/WAF rules documented; all ingress/egress controlled
+- **SC-8**: Transmission confidentiality and integrity — **TLS 1.2 minimum; TLS 1.3 preferred** for all data in transit
+- **SC-12**: Cryptographic key establishment and management — key management procedures documented
+- **SC-28**: Protection of information at rest — encryption at rest with FIPS 140-2/3 validated modules
+- **SC-39**: Process isolation — application processes isolated from each other
+
+**Common findings:** TLS 1.0/1.1 still enabled on endpoints; key management undocumented; network segmentation not depicted in architecture diagrams; boundary not fully enforced (undocumented egress paths).
+
+---
+
+## SI — System & Information Integrity
+
+**Key FedRAMP requirements:**
+- **SI-2**: Flaw remediation — patch management SLAs: Critical 30d / High 90d / Moderate 180d / Low 365d
+- **SI-3**: Malicious code protection — endpoint protection on all applicable components; real-time scanning
+- **SI-4**: System monitoring — SIEM with alerting; anomaly detection documented
+- **SI-7**: Software, firmware, and information integrity — file integrity monitoring (FIM) on critical system files
+- **SI-10**: Information input validation — input validation for all public-facing applications (ties to web app scanning)
+
+**Common findings:** Patch SLAs not tracked or enforced; FIM not deployed on critical servers; SIEM alerts not reviewed or tuned; malware protection not on all applicable endpoints (e.g., Linux servers overlooked).
+
+---
+
+## SR — Supply Chain Risk Management (New in Rev 5)
+
+**Key FedRAMP requirements:**
+- **SR-1**: Policy and procedures — SCRM policy required (SSP Appendix P)
+- **SR-2**: Supply chain risk management plan — documented in Appendix P
+- **SR-3**: Supply chain controls and processes — supplier assessment process defined
+- **SR-4**: Provenance — track origin and custody of hardware and software components
+- **SR-5**: Acquisition strategies, tools, and methods — preferred suppliers and vetting criteria documented
+- **SR-8**: Notification agreements — notification from suppliers of security incidents or product changes
+- **SR-11**: Component authenticity — anti-counterfeit measures for hardware
+- **SR-12**: Component disposal — secure disposal of hardware and software components
+
+**Note:** SR is the newest family and frequently has gaps in SSPs transitioned from Rev 4. Prioritize SR-1, SR-2, and SR-3 for initial authorization; remaining controls can be phased in via POA&M with AO agreement.
+
+**Common findings:** Appendix P (SCRM Plan) is a template placeholder with no CSP-specific content; no SBOM process; critical software components (open source libraries) not tracked for vulnerabilities; SR controls entirely absent from Rev 4-era SSPs.
+
+---
+
+## Summary: Control Count by Baseline (Rev 5)
+
+| Baseline | Controls & Enhancements | Primary Use |
+|----------|------------------------|-------------|
+| LI-SaaS | Subset of Low (~54 controls) | Low-impact SaaS with no PII, no sensitive federal data |
+| Low | ~156 | Limited adverse effect on federal mission/assets |
+| Moderate | 323 | Serious adverse effect — most common baseline |
+| High | 421 | Severe or catastrophic effect (law enforcement, health, financial) |
+
+> Control counts include base controls and all required control enhancements at each baseline.
+> FedRAMP parameter values (FedRAMP-defined values) may be stricter than base NIST requirements —
+> always check the FedRAMP parameter values workbook for your baseline.