FedRAMP Rev 5
Federal Risk and Authorization Management Program Security Baselines
Showing 156 controls in LOW baseline
AC — Access Control (11 controls)
AC-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
AC-2Account Management
LI-SaaS
LOW
MODERATE
HIGH
AC-3Access Enforcement
LI-SaaS
LOW
MODERATE
HIGH
AC-7Unsuccessful Logon Attempts
LI-SaaS
LOW
MODERATE
HIGH
AC-8System Use Notification
LI-SaaS
LOW
MODERATE
HIGH
AC-14Permitted Actions Without Identification or Authentication
LI-SaaS
LOW
MODERATE
HIGH
AC-17Remote Access
LI-SaaS
LOW
MODERATE
HIGH
AC-18Wireless Access
LI-SaaS
LOW
MODERATE
HIGH
AC-19Access Control for Mobile Devices
LI-SaaS
LOW
MODERATE
HIGH
AC-20Use of External Systems
LI-SaaS
LOW
MODERATE
HIGH
AC-22Publicly Accessible Content
LI-SaaS
LOW
MODERATE
HIGH
AT — Awareness and Training (5 controls)
AU — Audit and Accountability (10 controls)
AU-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
AU-2Event Logging
LI-SaaS
LOW
MODERATE
HIGH
AU-3Content of Audit Records
LI-SaaS
LOW
MODERATE
HIGH
AU-4Audit Log Storage Capacity
LI-SaaS
LOW
MODERATE
HIGH
AU-5Response to Audit Logging Process Failures
LI-SaaS
LOW
MODERATE
HIGH
AU-6Audit Record Review, Analysis, and Reporting
LI-SaaS
LOW
MODERATE
HIGH
AU-8Time Stamps
LI-SaaS
LOW
MODERATE
HIGH
AU-9Protection of Audit Information
LI-SaaS
LOW
MODERATE
HIGH
AU-11Audit Record Retention
LI-SaaS
LOW
MODERATE
HIGH
AU-12Audit Record Generation
LI-SaaS
LOW
MODERATE
HIGH
CA — Assessment, Authorization, and Monitoring (10 controls)
CA-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
CA-2Control Assessments
LI-SaaS
LOW
MODERATE
HIGH
CA-2 (01)Control Assessments | Independent Assessors
LOW
MODERATE
HIGH
CA-3Information Exchange
LI-SaaS
LOW
MODERATE
HIGH
CA-5Plan of Action and Milestones
LI-SaaS
LOW
MODERATE
HIGH
CA-6Authorization
LI-SaaS
LOW
MODERATE
HIGH
CA-7Continuous Monitoring
LI-SaaS
LOW
MODERATE
HIGH
CA-7 (04)Continuous Monitoring | Risk Monitoring
LOW
MODERATE
HIGH
CA-8Penetration Testing
LI-SaaS
LOW
MODERATE
HIGH
CA-9Internal System Connections
LI-SaaS
LOW
MODERATE
HIGH
CM — Configuration Management (9 controls)
CM-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
CM-2Baseline Configuration
LI-SaaS
LOW
MODERATE
HIGH
CM-4Impact Analyses
LI-SaaS
LOW
MODERATE
HIGH
CM-5Access Restrictions for Change
LI-SaaS
LOW
MODERATE
HIGH
CM-6Configuration Settings
LI-SaaS
LOW
MODERATE
HIGH
CM-7Least Functionality
LI-SaaS
LOW
MODERATE
HIGH
CM-8System Component Inventory
LI-SaaS
LOW
MODERATE
HIGH
CM-10Software Usage Restrictions
LI-SaaS
LOW
MODERATE
HIGH
CM-11User-installed Software
LI-SaaS
LOW
MODERATE
HIGH
CP — Contingency Planning (6 controls)
IA — Identification and Authentication (16 controls)
IA-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
IA-2Identification and Authentication (organizational Users)
LI-SaaS
LOW
MODERATE
HIGH
IA-2 (01)Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts
LOW
MODERATE
HIGH
IA-2 (02)Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts
LOW
MODERATE
HIGH
IA-2 (08)Identification and Authentication (organizational Users) | Access to Accounts -- Replay Resistant
LOW
MODERATE
HIGH
IA-2 (12)Identification and Authentication (organizational Users) | Acceptance of PIV Credentials
LI-SaaS
LOW
MODERATE
HIGH
IA-4Identifier Management
LI-SaaS
LOW
MODERATE
HIGH
IA-5Authenticator Management
LI-SaaS
LOW
MODERATE
HIGH
IA-5 (01)Authenticator Management | Password-based Authentication
LOW
MODERATE
HIGH
IA-6Authentication Feedback
LI-SaaS
LOW
MODERATE
HIGH
IA-7Cryptographic Module Authentication
LI-SaaS
LOW
MODERATE
HIGH
IA-8Identification and Authentication (non-organizational Users)
LI-SaaS
LOW
MODERATE
HIGH
IA-8 (01)Identification and Authentication (non-organizational Users) | Acceptance of PIV Credentials from Other Agencies
LOW
MODERATE
HIGH
IA-8 (02)Identification and Authentication (non-organizational Users) | Acceptance of External Authenticators
LOW
MODERATE
HIGH
IA-8 (04)Identification and Authentication (non-organizational Users) | Use of Defined Profiles
LOW
MODERATE
HIGH
IA-11Re-authentication
LI-SaaS
LOW
MODERATE
HIGH
IR — Incident Response (7 controls)
IR-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
IR-2Incident Response Training
LI-SaaS
LOW
MODERATE
HIGH
IR-4Incident Handling
LI-SaaS
LOW
MODERATE
HIGH
IR-5Incident Monitoring
LI-SaaS
LOW
MODERATE
HIGH
IR-6Incident Reporting
LI-SaaS
LOW
MODERATE
HIGH
IR-7Incident Response Assistance
LI-SaaS
LOW
MODERATE
HIGH
IR-8Incident Response Plan
LI-SaaS
LOW
MODERATE
HIGH
MA — Maintenance (4 controls)
MP — Media Protection (4 controls)
PE — Physical and Environmental Protection (10 controls)
PE-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
PE-2Physical Access Authorizations
LI-SaaS
LOW
MODERATE
HIGH
PE-3Physical Access Control
LI-SaaS
LOW
MODERATE
HIGH
PE-6Monitoring Physical Access
LI-SaaS
LOW
MODERATE
HIGH
PE-8Visitor Access Records
LI-SaaS
LOW
MODERATE
HIGH
PE-12Emergency Lighting
LI-SaaS
LOW
MODERATE
HIGH
PE-13Fire Protection
LI-SaaS
LOW
MODERATE
HIGH
PE-14Environmental Controls
LI-SaaS
LOW
MODERATE
HIGH
PE-15Water Damage Protection
LI-SaaS
LOW
MODERATE
HIGH
PE-16Delivery and Removal
LI-SaaS
LOW
MODERATE
HIGH
PL — Planning (7 controls)
PL-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
PL-2System Security and Privacy Plans
LI-SaaS
LOW
MODERATE
HIGH
PL-4Rules of Behavior
LI-SaaS
LOW
MODERATE
HIGH
PL-4 (01)Rules of Behavior | Social Media and External Site/application Usage Restrictions
LOW
MODERATE
HIGH
PL-8Security and Privacy Architectures
LI-SaaS
LOW
MODERATE
HIGH
PL-10Baseline Selection
LI-SaaS
LOW
MODERATE
HIGH
PL-11Baseline Tailoring
LI-SaaS
LOW
MODERATE
HIGH
PS — Personnel Security (9 controls)
PS-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
PS-2Position Risk Designation
LI-SaaS
LOW
MODERATE
HIGH
PS-3Personnel Screening
LI-SaaS
LOW
MODERATE
HIGH
PS-4Personnel Termination
LI-SaaS
LOW
MODERATE
HIGH
PS-5Personnel Transfer
LI-SaaS
LOW
MODERATE
HIGH
PS-6Access Agreements
LI-SaaS
LOW
MODERATE
HIGH
PS-7External Personnel Security
LI-SaaS
LOW
MODERATE
HIGH
PS-8Personnel Sanctions
LI-SaaS
LOW
MODERATE
HIGH
PS-9Position Descriptions
LI-SaaS
LOW
MODERATE
HIGH
RA — Risk Assessment (8 controls)
RA-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
RA-2Security Categorization
LI-SaaS
LOW
MODERATE
HIGH
RA-3Risk Assessment
LI-SaaS
LOW
MODERATE
HIGH
RA-3 (01)Risk Assessment | Supply Chain Risk Assessment
LOW
MODERATE
HIGH
RA-5Vulnerability Monitoring and Scanning
LI-SaaS
LOW
MODERATE
HIGH
RA-5 (02)Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
LOW
MODERATE
HIGH
RA-5 (11)Vulnerability Monitoring and Scanning | Public Disclosure Program
LI-SaaS
LOW
MODERATE
HIGH
RA-7Risk Response
LI-SaaS
LOW
MODERATE
HIGH
SA — System and Services Acquisition (9 controls)
SA-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
SA-2Allocation of Resources
LI-SaaS
LOW
MODERATE
HIGH
SA-3System Development Life Cycle
LI-SaaS
LOW
MODERATE
HIGH
SA-4Acquisition Process
LI-SaaS
LOW
MODERATE
HIGH
SA-4 (10)Acquisition Process | Use of Approved PIV Products
LI-SaaS
LOW
MODERATE
HIGH
SA-5System Documentation
LI-SaaS
LOW
MODERATE
HIGH
SA-8Security and Privacy Engineering Principles
LI-SaaS
LOW
MODERATE
HIGH
SA-9External System Services
LI-SaaS
LOW
MODERATE
HIGH
SA-22Unsupported System Components
LI-SaaS
LOW
MODERATE
HIGH
SC — System and Communications Protection (14 controls)
SC-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
SC-5Denial-of-service Protection
LI-SaaS
LOW
MODERATE
HIGH
SC-7Boundary Protection
LI-SaaS
LOW
MODERATE
HIGH
SC-8Transmission Confidentiality and Integrity
LI-SaaS
LOW
MODERATE
HIGH
SC-8 (01)Transmission Confidentiality and Integrity | Cryptographic Protection
LOW
MODERATE
HIGH
SC-12Cryptographic Key Establishment and Management
LI-SaaS
LOW
MODERATE
HIGH
SC-13Cryptographic Protection
LI-SaaS
LOW
MODERATE
HIGH
SC-15Collaborative Computing Devices and Applications
LI-SaaS
LOW
MODERATE
HIGH
SC-20Secure Name/address Resolution Service (authoritative Source)
LI-SaaS
LOW
MODERATE
HIGH
SC-21Secure Name/address Resolution Service (recursive or Caching Resolver)
LI-SaaS
LOW
MODERATE
HIGH
SC-22Architecture and Provisioning for Name/address Resolution Service
LI-SaaS
LOW
MODERATE
HIGH
SC-28Protection of Information at Rest
LI-SaaS
LOW
MODERATE
HIGH
SC-28 (01)Protection of Information at Rest | Cryptographic Protection
LOW
MODERATE
HIGH
SC-39Process Isolation
LI-SaaS
LOW
MODERATE
HIGH
SI — System and Information Integrity (6 controls)
SI-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
SI-2Flaw Remediation
LI-SaaS
LOW
MODERATE
HIGH
SI-3Malicious Code Protection
LI-SaaS
LOW
MODERATE
HIGH
SI-4System Monitoring
LI-SaaS
LOW
MODERATE
HIGH
SI-5Security Alerts, Advisories, and Directives
LI-SaaS
LOW
MODERATE
HIGH
SI-12Information Management and Retention
LI-SaaS
LOW
MODERATE
HIGH
SR — Supply Chain Risk Management (11 controls)
SR-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
SR-2Supply Chain Risk Management Plan
LI-SaaS
LOW
MODERATE
HIGH
SR-2 (01)Supply Chain Risk Management Plan | Establish SCRM Team
LOW
MODERATE
HIGH
SR-3Supply Chain Controls and Processes
LI-SaaS
LOW
MODERATE
HIGH
SR-5Acquisition Strategies, Tools, and Methods
LI-SaaS
LOW
MODERATE
HIGH
SR-8Notification Agreements
LI-SaaS
LOW
MODERATE
HIGH
SR-10Inspection of Systems or Components
LI-SaaS
LOW
MODERATE
HIGH
SR-11Component Authenticity
LI-SaaS
LOW
MODERATE
HIGH
SR-11 (01)Component Authenticity | Anti-counterfeit Training
LOW
MODERATE
HIGH
SR-11 (02)Component Authenticity | Configuration Control for Component Service and Repair
LOW
MODERATE
HIGH
SR-12Component Disposal
LI-SaaS
LOW
MODERATE
HIGH