FedRAMP Moderate readiness (NIST SP 800-53 Rev. 5 base controls)
Version: FedRAMP Rev. 5 Moderate baseline (base controls only, enhancements folded in)
The FedRAMP Moderate baseline of NIST SP 800-53 Rev. 5 controls, with FedRAMP-specific parameters and selected enhancements noted in each base control summary. Applies to cloud service providers seeking a FedRAMP authorization to host moderate-impact federal agency data.
Where we stand
Controls
70%
Evidence
20%
Policies
24%
124 of 181 clauses mapped to adopted controls · 3 known gaps
As of (just now)
Percentages are over clauses mapped to at least one adopted control. Unmapped clauses are listed below and never count as passing. A known gap is a clause that applies to us and that no control covers yet.
Clause-by-clause readiness
| Clause | Title | Controls | Evidence | Policies | Last tested |
|---|---|---|---|---|---|
| AC Access Control | |||||
| AC-1 | Policy and Procedures Controls: BIZ-14, IAM-04 | Passing | Not current | Not approved | (29 d ago) |
| AC-2 | Account Management Controls: IAM-05, IAM-07, IAM-09 | Not passing | Not current | Not approved | (29 d ago) |
| AC-3 | Access Enforcement Controls: IAM-04, IAM-05 | Passing | Not current | Not approved | (29 d ago) |
| AC-4 | Information Flow Enforcement Controls: CLOUD-06 | Passing | Current | Approved | (29 d ago) |
| AC-5 | Separation of Duties Controls: BIZ-15, PDP-05 | Passing | Not current | Not approved | (29 d ago) |
| AC-6 | Least Privilege Controls: IAM-04, IAM-06, IAM-09 | Passing | Not current | Not approved | (29 d ago) |
| AC-7 | Unsuccessful Logon Attempts | Unmapped | Unmapped | Unmapped | Not yet |
| AC-8 | System Use Notification | Known gap | Known gap | Known gap | Not yet |
| AC-11 | Device Lock | Unmapped | Unmapped | Unmapped | Not yet |
| AC-12 | Session Termination | Unmapped | Unmapped | Unmapped | Not yet |
| AC-14 | Permitted Actions Without Identification or Authentication | Unmapped | Unmapped | Unmapped | Not yet |
| AC-17 | Remote Access Controls: DATA-03, IAM-02 | Not passing | Not current | Not approved | (8 h ago) |
| AC-18 | Wireless Access | Unmapped | Unmapped | Unmapped | Not yet |
| AC-19 | Access Control for Mobile Devices Controls: IT-02 | Not passing | Not current | Approved | Not yet |
| AC-20 | Use of External Systems Controls: IT-01 | Passing | Not current | Approved | Not yet |
| AC-21 | Information Sharing Controls: DATA-01 | Passing | Not current | Not approved | Not yet |
| AC-22 | Publicly Accessible Content Controls: CUST-03 | Passing | Not current | Approved | Not yet |
| AT Awareness and Training | |||||
| AT-1 | Policy and Procedures Controls: BIZ-14, PEOPLE-06 | Not passing | Not current | Not approved | (8 h ago) |
| AT-2 | Literacy Training and Awareness Controls: PEOPLE-06 | Not passing | Current | Approved | (8 h ago) |
| AT-3 | Role-based Training | Unmapped | Unmapped | Unmapped | Not yet |
| AT-4 | Training Records Controls: PEOPLE-06 | Not passing | Current | Approved | (8 h ago) |
| AU Audit and Accountability | |||||
| AU-1 | Policy and Procedures Controls: BIZ-14, MON-02 | Passing | Not current | Not approved | (4 mo ago) |
| AU-2 | Event Logging Controls: MON-02 | Passing | Not current | Not approved | (4 mo ago) |
| AU-3 | Content of Audit Records | Unmapped | Unmapped | Unmapped | Not yet |
| AU-4 | Audit Log Storage Capacity | Unmapped | Unmapped | Unmapped | Not yet |
| AU-5 | Response to Audit Logging Process Failures | Unmapped | Unmapped | Unmapped | Not yet |
| AU-6 | Audit Record Review, Analysis, and Reporting Controls: MON-03 | Not passing | Not current | Not approved | (3 mo ago) |
| AU-7 | Audit Record Reduction and Report Generation Controls: MON-01 | Not passing | Not current | Not approved | (3 mo ago) |
| AU-8 | Time Stamps | Unmapped | Unmapped | Unmapped | Not yet |
| AU-9 | Protection of Audit Information | Unmapped | Unmapped | Unmapped | Not yet |
| AU-11 | Audit Record Retention Controls: DATA-04 | Passing | Not current | Not approved | Not yet |
| AU-12 | Audit Record Generation Controls: MON-01, MON-02 | Not passing | Not current | Not approved | (3 mo ago) |
| CA Assessment, Authorization, and Monitoring | |||||
| CA-1 | Policy and Procedures Controls: BIZ-08, BIZ-14 | Passing | Not current | Not approved | Not yet |
| CA-2 | Control Assessments Controls: BIZ-08 | Passing | Not current | Approved | Not yet |
| CA-3 | Information Exchange Controls: VEND-02 | Passing | Not current | Not approved | Not yet |
| CA-5 | Plan of Action and Milestones Controls: BIZ-09 | Passing | Not current | Approved | Not yet |
| CA-6 | Authorization | Unmapped | Unmapped | Unmapped | Not yet |
| CA-7 | Continuous Monitoring Controls: MON-05 | Not passing | Not current | Not approved | (3 mo ago) |
| CA-8 | Penetration Testing Controls: MON-04 | Not passing | Current | Not approved | (8 h ago) |
| CA-9 | Internal System Connections | Unmapped | Unmapped | Unmapped | Not yet |
| CM Configuration Management | |||||
| CM-1 | Policy and Procedures Controls: BIZ-14, PDP-02 | Passing | Not current | Not approved | (23 d ago) |
| CM-2 | Baseline Configuration Controls: CLOUD-02, CLOUD-04 | Passing | Not current | Approved | (29 d ago) |
| CM-3 | Configuration Change Control Controls: PDP-02, PDP-03, PDP-04 | Not passing | Not current | Not approved | (8 h ago) |
| CM-4 | Impact Analyses Controls: PDP-14 | Passing | Current | Approved | (4 mo ago) |
| CM-5 | Access Restrictions for Change Controls: PDP-05, PDP-06 | Passing | Current | Not approved | (29 d ago) |
| CM-6 | Configuration Settings Controls: CLOUD-04 | Passing | Not current | Approved | Not yet |
| CM-7 | Least Functionality Controls: CLOUD-03, CLOUD-04 | Passing | Not current | Approved | Not yet |
| CM-8 | System Component Inventory Controls: IT-04, IT-05 | Passing | Not current | Not approved | Not yet |
| CM-9 | Configuration Management Plan Controls: CLOUD-02, PDP-02 | Passing | Not current | Not approved | (23 d ago) |
| CM-10 | Software Usage Restrictions | Unmapped | Unmapped | Unmapped | Not yet |
| CM-11 | User-installed Software | Unmapped | Unmapped | Unmapped | Not yet |
| CM-12 | Information Location | Unmapped | Unmapped | Unmapped | Not yet |
| CP Contingency Planning | |||||
| CP-1 | Policy and Procedures Controls: BIZ-01, BIZ-14 | Passing | Not current | Not approved | (3 mo ago) |
| CP-2 | Contingency Plan Controls: BIZ-01 | Passing | Not current | Not approved | (3 mo ago) |
| CP-3 | Contingency Training Controls: BIZ-20 | Passing | Not current | Not approved | Not yet |
| CP-4 | Contingency Plan Testing Controls: BIZ-20, DATA-15 | Passing | Not current | Not approved | Not yet |
| CP-6 | Alternate Storage Site Controls: DATA-13 | Passing | Not current | Not approved | (29 d ago) |
| CP-7 | Alternate Processing Site Controls: BIZ-01 | Passing | Not current | Not approved | (3 mo ago) |
| CP-8 | Telecommunications Services | Unmapped | Unmapped | Unmapped | Not yet |
| CP-9 | System Backup Controls: DATA-12, DATA-13, DATA-14, DATA-15 | Passing | Not current | Not approved | (29 d ago) |
| CP-10 | System Recovery and Reconstitution Controls: BIZ-01, DATA-15 | Passing | Not current | Not approved | (3 mo ago) |
| IA Identification and Authentication | |||||
| IA-1 | Policy and Procedures Controls: BIZ-14, IAM-01 | Passing | Not current | Not approved | (29 d ago) |
| IA-2 | Identification and Authentication (Organizational Users) Controls: IAM-01, IAM-02 | Not passing | Not current | Not approved | (8 h ago) |
| IA-3 | Device Identification and Authentication | Unmapped | Unmapped | Unmapped | Not yet |
| IA-4 | Identifier Management | Unmapped | Unmapped | Unmapped | Not yet |
| IA-5 | Authenticator Management Controls: IAM-03, IAM-08 | Passing | Not current | Not approved | (8 h ago) |
| IA-6 | Authentication Feedback Controls: IAM-01 | Passing | Current | Not approved | (29 d ago) |
| IA-7 | Cryptographic Module Authentication | Unmapped | Unmapped | Unmapped | Not yet |
| IA-8 | Identification and Authentication (Non-organizational Users) | Unmapped | Unmapped | Unmapped | Not yet |
| IA-11 | Re-authentication | Unmapped | Unmapped | Unmapped | Not yet |
| IA-12 | Identity Proofing Controls: PEOPLE-01 | Not passing | Current | Not approved | (4 mo ago) |
| IR Incident Response | |||||
| IR-1 | Policy and Procedures Controls: BIZ-02, BIZ-14 | Passing | Not current | Not approved | (3 mo ago) |
| IR-2 | Incident Response Training Controls: BIZ-21, PEOPLE-06 | Not passing | Current | Approved | (8 h ago) |
| IR-3 | Incident Response Testing Controls: BIZ-21 | Passing | Current | Approved | (4 mo ago) |
| IR-4 | Incident Handling Controls: BIZ-02, BIZ-03, MON-03 | Not passing | Not current | Not approved | (8 h ago) |
| IR-5 | Incident Monitoring Controls: BIZ-03 | Passing | Current | Not approved | (8 h ago) |
| IR-6 | Incident Reporting Controls: BIZ-02, BIZ-13 | Passing | Not current | Not approved | (29 d ago) |
| IR-7 | Incident Response Assistance Controls: BIZ-13, CUST-01 | Passing | Not current | Approved | (29 d ago) |
| IR-8 | Incident Response Plan Controls: BIZ-02 | Passing | Not current | Not approved | (3 mo ago) |
| IR-9 | Information Spillage Response Controls: BIZ-02 | Passing | Not current | Not approved | (3 mo ago) |
| MA Maintenance | |||||
| MA-1 | Policy and Procedures Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| MA-2 | Controlled Maintenance Controls: CLOUD-05 | Not passing | Not current | Approved | Not yet |
| MA-3 | Maintenance Tools | Unmapped | Unmapped | Unmapped | Not yet |
| MA-4 | Nonlocal Maintenance | Unmapped | Unmapped | Unmapped | Not yet |
| MA-5 | Maintenance Personnel | Unmapped | Unmapped | Unmapped | Not yet |
| MA-6 | Timely Maintenance Controls: VEND-04 | Not passing | Current | Not approved | (8 h ago) |
| MP Media Protection | |||||
| MP-1 | Policy and Procedures Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| MP-2 | Media Access Controls: DATA-01 | Passing | Not current | Not approved | Not yet |
| MP-3 | Media Marking Controls: DATA-01 | Passing | Not current | Not approved | Not yet |
| MP-4 | Media Storage Controls: IT-02, PHYS-01 | Not passing | Not current | Not approved | Not yet |
| MP-5 | Media Transport Controls: IT-02 | Not passing | Not current | Approved | Not yet |
| MP-6 | Media Sanitization | Unmapped | Unmapped | Unmapped | Not yet |
| MP-7 | Media Use | Unmapped | Unmapped | Unmapped | Not yet |
| PE Physical and Environmental Protection | |||||
| PE-1 | Policy and Procedures Controls: BIZ-14, PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-2 | Physical Access Authorizations Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-3 | Physical Access Control Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-4 | Access Control for Transmission Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-5 | Access Control for Output Devices | Unmapped | Unmapped | Unmapped | Not yet |
| PE-6 | Monitoring Physical Access Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-8 | Visitor Access Records Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-9 | Power Equipment and Cabling | Unmapped | Unmapped | Unmapped | Not yet |
| PE-10 | Emergency Shutoff | Unmapped | Unmapped | Unmapped | Not yet |
| PE-11 | Emergency Power | Unmapped | Unmapped | Unmapped | Not yet |
| PE-12 | Emergency Lighting | Unmapped | Unmapped | Unmapped | Not yet |
| PE-13 | Fire Protection | Unmapped | Unmapped | Unmapped | Not yet |
| PE-14 | Environmental Controls | Unmapped | Unmapped | Unmapped | Not yet |
| PE-15 | Water Damage Protection | Unmapped | Unmapped | Unmapped | Not yet |
| PE-16 | Delivery and Removal Controls: IT-04, PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE-17 | Alternate Work Site Controls: BIZ-13 | Passing | Current | Approved | (29 d ago) |
| PL Planning | |||||
| PL-1 | Policy and Procedures Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| PL-2 | System Security and Privacy Plans | Unmapped | Unmapped | Unmapped | Not yet |
| PL-4 | Rules of Behavior Controls: IT-01, PEOPLE-04 | Passing | Not current | Approved | (4 mo ago) |
| PL-8 | Security and Privacy Architectures | Unmapped | Unmapped | Unmapped | Not yet |
| PL-10 | Baseline Selection Controls: BIZ-07 | Passing | Not current | Approved | Not yet |
| PL-11 | Baseline Tailoring Controls: BIZ-07 | Passing | Not current | Approved | Not yet |
| PS Personnel Security | |||||
| PS-1 | Policy and Procedures Controls: BIZ-14, PEOPLE-01 | Not passing | Not current | Not approved | (4 mo ago) |
| PS-2 | Position Risk Designation Controls: PEOPLE-01, PEOPLE-08 | Not passing | Not current | Not approved | (4 mo ago) |
| PS-3 | Personnel Screening Controls: PEOPLE-01 | Not passing | Current | Not approved | (4 mo ago) |
| PS-4 | Personnel Termination Controls: PEOPLE-03 | Passing | Current | Not approved | (8 h ago) |
| PS-5 | Personnel Transfer Controls: IAM-09 | Passing | Current | Not approved | (29 d ago) |
| PS-6 | Access Agreements Controls: IT-01, PEOPLE-02, PEOPLE-04 | Passing | Not current | Not approved | (4 mo ago) |
| PS-7 | External Personnel Security Controls: VEND-02 | Passing | Not current | Not approved | Not yet |
| PS-8 | Personnel Sanctions Controls: PEOPLE-07 | Passing | Not current | Not approved | Not yet |
| PS-9 | Position Descriptions Controls: BIZ-15, PEOPLE-08 | Not passing | Not current | Not approved | Not yet |
| RA Risk Assessment | |||||
| RA-1 | Policy and Procedures Controls: BIZ-04, BIZ-14 | Passing | Not current | Not approved | Not yet |
| RA-2 | Security Categorization Controls: DATA-01 | Passing | Not current | Not approved | Not yet |
| RA-3 | Risk Assessment Controls: BIZ-04, BIZ-05 | Passing | Not current | Not approved | (4 mo ago) |
| RA-5 | Vulnerability Monitoring and Scanning Controls: CUST-01, MON-05, MON-06 | Not passing | Not current | Not approved | (3 mo ago) |
| RA-7 | Risk Response Controls: BIZ-04, BIZ-05, BIZ-09 | Passing | Not current | Not approved | (4 mo ago) |
| RA-9 | Criticality Analysis Controls: BIZ-01, IT-05 | Passing | Not current | Not approved | (3 mo ago) |
| SA System and Services Acquisition | |||||
| SA-1 | Policy and Procedures Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| SA-2 | Allocation of Resources | Unmapped | Unmapped | Unmapped | Not yet |
| SA-3 | System Development Life Cycle | Unmapped | Unmapped | Unmapped | Not yet |
| SA-4 | Acquisition Process Controls: VEND-02, VEND-03 | Passing | Not current | Not approved | Not yet |
| SA-5 | System Documentation Controls: CUST-03 | Passing | Not current | Approved | Not yet |
| SA-8 | Security and Privacy Engineering Principles Controls: APP-01 | Passing | Current | Approved | (4 mo ago) |
| SA-9 | External System Services Controls: VEND-02, VEND-03, VEND-04 | Not passing | Not current | Not approved | (8 h ago) |
| SA-10 | Developer Configuration Management Controls: PDP-02, PDP-06 | Passing | Not current | Not approved | (23 d ago) |
| SA-11 | Developer Testing and Evaluation Controls: APP-02, PDP-04 | Not passing | Not current | Not approved | (29 d ago) |
| SA-15 | Development Process, Standards, and Tools Controls: APP-01 | Passing | Current | Approved | (4 mo ago) |
| SA-22 | Unsupported System Components Controls: CLOUD-05 | Not passing | Not current | Approved | Not yet |
| SC System and Communications Protection | |||||
| SC-1 | Policy and Procedures Controls: BIZ-14, DATA-06 | Not passing | Not current | Not approved | Not yet |
| SC-2 | Separation of System and User Functionality Controls: IAM-06 | Passing | Current | Not approved | (29 d ago) |
| SC-4 | Information in Shared System Resources | Unmapped | Unmapped | Unmapped | Not yet |
| SC-5 | Denial-of-service Protection | Unmapped | Unmapped | Unmapped | Not yet |
| SC-7 | Boundary Protection Controls: CLOUD-03 | Passing | Not current | Approved | Not yet |
| SC-8 | Transmission Confidentiality and Integrity Controls: CLOUD-01, DATA-03 | Passing | Current | Not approved | (8 h ago) |
| SC-10 | Network Disconnect | Unmapped | Unmapped | Unmapped | Not yet |
| SC-12 | Cryptographic Key Establishment and Management Controls: DATA-06 | Not passing | Not current | Not approved | Not yet |
| SC-13 | Cryptographic Protection Controls: DATA-06 | Not passing | Not current | Not approved | Not yet |
| SC-15 | Collaborative Computing Devices and Applications | Unmapped | Unmapped | Unmapped | Not yet |
| SC-17 | Public Key Infrastructure Certificates Controls: CLOUD-01 | Passing | Current | Approved | (29 d ago) |
| SC-18 | Mobile Code | Unmapped | Unmapped | Unmapped | Not yet |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | Known gap | Known gap | Known gap | Not yet |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Known gap | Known gap | Known gap | Not yet |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service Controls: VEND-04 | Not passing | Current | Not approved | (8 h ago) |
| SC-23 | Session Authenticity Controls: DATA-03 | Passing | Current | Not approved | (8 h ago) |
| SC-28 | Protection of Information at Rest Controls: DATA-02 | Passing | Not current | Not approved | Not yet |
| SC-39 | Process Isolation Controls: CLOUD-04 | Passing | Not current | Approved | Not yet |
| SC-45 | System Time Synchronization | Unmapped | Unmapped | Unmapped | Not yet |
| SI System and Information Integrity | |||||
| SI-1 | Policy and Procedures Controls: BIZ-14, MON-06 | Not passing | Not current | Not approved | (3 mo ago) |
| SI-2 | Flaw Remediation Controls: CLOUD-05, IT-03, MON-06 | Not passing | Not current | Not approved | (8 h ago) |
| SI-3 | Malicious Code Protection | Unmapped | Unmapped | Unmapped | Not yet |
| SI-4 | System Monitoring Controls: MON-03 | Not passing | Not current | Not approved | (3 mo ago) |
| SI-5 | Security Alerts, Advisories, and Directives | Unmapped | Unmapped | Unmapped | Not yet |
| SI-6 | Security and Privacy Function Verification | Unmapped | Unmapped | Unmapped | Not yet |
| SI-7 | Software, Firmware, and Information Integrity | Unmapped | Unmapped | Unmapped | Not yet |
| SI-8 | Spam Protection | Unmapped | Unmapped | Unmapped | Not yet |
| SI-10 | Information Input Validation | Unmapped | Unmapped | Unmapped | Not yet |
| SI-11 | Error Handling Controls: APP-01 | Passing | Current | Approved | (4 mo ago) |
| SI-12 | Information Management and Retention Controls: DATA-04, DATA-05 | Passing | Not current | Not approved | Not yet |
| SI-16 | Memory Protection Controls: CLOUD-04 | Passing | Not current | Approved | Not yet |
| SR Supply Chain Risk Management | |||||
| SR-1 | Policy and Procedures Controls: BIZ-14 | Passing | Not current | Not approved | Not yet |
| SR-2 | Supply Chain Risk Management Plan | Unmapped | Unmapped | Unmapped | Not yet |
| SR-3 | Supply Chain Controls and Processes Controls: VEND-03 | Passing | Not current | Not approved | Not yet |
| SR-5 | Acquisition Strategies, Tools, and Methods Controls: VEND-02, VEND-03 | Passing | Not current | Not approved | Not yet |
| SR-6 | Supplier Assessments and Reviews Controls: VEND-04 | Not passing | Current | Not approved | (8 h ago) |
| SR-8 | Notification Agreements Controls: VEND-02 | Passing | Not current | Not approved | Not yet |
| SR-10 | Inspection of Systems or Components | Unmapped | Unmapped | Unmapped | Not yet |
| SR-11 | Component Authenticity | Unmapped | Unmapped | Unmapped | Not yet |
| SR-12 | Component Disposal Controls: DATA-05 | Passing | Not current | Not approved | Not yet |