Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 09 · Appendix

Appendix B — Requirements Mapping and Sources

A compliance-enabling crosswalk, not a compliance claim: each federal requirement that touches branch network and transport design (TIC 3.0, OMB M-19-26, M-22-09, M-26-14, M-26-15, CISA Protective DNS, BOD 23-02, BOD 26-02, BOD 26-04, NIST SP 800-53 Rev. 5, SP 800-52 Rev. 2, FIPS 140 and FedRAMP), what it actually asks, where the book addresses it and the evidence it calls for, followed by the book’s sources.

A requirement is only useful in a mapping if it says what the source asks for, and nothing more.

NoteIn this appendix

What each federal requirement that touches branch network and transport design asks for, in its own words where the wording matters; the chapters that address it and the evidence an assessor can expect; the requirements that are often cited but don’t exist; notes on reading the SP 800-53 controls; and the source list, with primary sources separated from third-party ones.

ImportantCompliance-enabling, not a compliance claim

This appendix helps an agency reuse the book’s design and evidence in its own system security plan. It doesn’t claim that following the book satisfies any requirement or control. The branch network, its enforcement points and its transport are part of the agency’s own systems; the agency authorizes them, and any cloud-delivered security service they depend on needs its own FedRAMP certification (Chapter 03). Control selection, implementation statements and assessment belong to the agency and its assessors. Requirement wording is summarized; the cited documents govern. Every source in this appendix was checked on October 21, 2026.

Requirements mapping

Requirement (source) What it asks of the branch network Addressed in Evidence
Capability-based TIC (OMB M-19-26) Rescinds the consolidation memoranda (M-08-05, M-08-16, M-08-27, M-09-32) and replaces mandatory routing through access points with capability-based use cases1 Ch 01, Ch 02, Ch 03 The agency’s TIC use-case mapping; architecture documentation for each branch pattern
TIC 3.0 Security Capabilities Catalog, v3.3 (CISA) Goals, not methods: 20 universal capabilities for every use case and PEP capabilities in 12 groups. Once a capability is needed, apply it at all access points to that network or data (policy enforcement parity). No telemetry duration or timeliness requirement, but law, OMB and CISA telemetry requirements still apply2 Ch 03, Ch 05, Ch 08 Capability-to-control mapping for each enforcement point; parity evidence across campus, branch and SASE paths
TIC 3.0 Branch Office Use Case, v3.0 (CISA) Three security patterns (branch to cloud, to web, to campus), each with options for where enforcement happens; greatest rigor on branch-to-web; where multiple conveyances such as redundant links or SD-WAN exist, security parity on every path; “agencies must preserve CISA visibility”3 Ch 03, Ch 05, Ch 08, Ch 10, Ch 11 Per-pattern data-flow diagrams; enforcement placement per path; path-priority and failover configuration showing parity
TIC 3.0 Cloud and Remote User use cases (CISA) Protections for agency use of cloud services and for users off the agency network; a SASE deployment at branches operates under Branch Office and Cloud, since there is no SASE use case4 Ch 03, Ch 05, Ch 12 Use-case mapping for each cloud service and remote access method
TIC telemetry continuity (TIC 3.0 Program Guidebook; CISA SASE guidance) TIC doesn’t replace or negate telemetry requirements. When branches leave MTIPS, the E1E telemetry from access-point sensors stops; agencies can send comparable telemetry to CISA’s Comprehensive Log Aggregation Warehouse (CLAW), which needs coordination among the agency, CISA and the provider56 Ch 03, Ch 09, Ch 11, Ch 13 CLAW onboarding record; CISA confirmation of equivalent visibility before MTIPS is decommissioned
Protective DNS for all egress (6 U.S.C. § 663 note; OMB M-22-09; CISA Encrypted DNS Implementation Guidance) Agencies must route all egress DNS to CISA’s Protective DNS, disable root hints on agency DNS infrastructure, and permit external third-party resolvers only from authorized internal DNS servers; agencies “are already required to have DNS requests routed through CISA-operated infrastructure”789 Ch 03, Ch 05, Ch 08 Forwarding chain from internal resolvers to Protective DNS; SD-WAN or SASE DNS configuration; tests showing no endpoint agent resolves through a vendor cloud
Encrypted DNS and HTTPS (OMB M-22-09) “Agencies must resolve DNS queries using encrypted DNS wherever it is technically supported”; enforce HTTPS for all web and API traffic in the environment; a zero trust architecture plan describing the approach to environmental isolation10 Ch 03, Ch 10 Resolver and endpoint encrypted DNS configuration; HTTPS enforcement; the isolation plan
Logging and network visibility (OMB M-26-14, which rescinds M-21-31) Prioritize continuous event monitoring and threat hunting, investigation, response and forensics; an Agency Logging Plan 90 days after CISA’s Logging Reference Architecture (published August 20, 2026); maturity Levels 1, 2 and 3 at 120, 180 and 320 days; minimum logs include “source and destination network address information, including protocols, ports, and session attributes”1112 Ch 03, Ch 10, Ch 13 Agency Logging Plan; maturity self-assessment per system; flow and session logs from every branch enforcement point
Management interfaces (CISA BOD 23-02) Management interfaces of routers, switches, firewalls, VPN concentrators, proxies and load balancers that are reachable from the internet: within 14 days remove them from the internet or, preferably, enforce access “through a policy enforcement point separate from the interface itself”13 Ch 03, Ch 10 External scan results; management-plane access path; PEP policy
End-of-support edge devices (CISA BOD 26-02) Internet-accessible devices on the agency boundary that are end of support: inventory by May 5, 2026; decommission those ending support by February 5, 2027; all identified devices removed by August 5, 2027; continuous discovery by February 5, 202814 Ch 02, Ch 03, Ch 05, Ch 07, Ch 08, Ch 09, Ch 10 EOS inventory submissions to CISA; decommission reports; replacement specifications
Risk-based vulnerability remediation (CISA BOD 26-04, which revokes BOD 22-01 and BOD 19-02) Remediation timelines set by asset exposure, KEV status, exploit automation and technical impact; Phase II by August 9, 2026; Phase III, including continuous tagging of internet-reachable assets, by December 7, 202615 Ch 02, Ch 03, Ch 05, Ch 08, Ch 10 Vulnerability management policy; asset tags for branch edges and controllers; CDM reporting
Post-quantum key exchange (OMB M-26-15; EO 14412) All network infrastructure terminating TLS or IPsec, “including firewalls, Virtual Private Network concentrators, cloud gateways,” must support PQC-capable key exchange using NIST algorithms; migration plan within 120 days (October 22, 2026); mitigate quantum risk as far as feasible by December 31, 20301617 Ch 03, Ch 10, Ch 11 Cryptographic inventory of branch devices; PQC capability in replacement specifications; the migration plan
TLS 1.3 (NIST SP 800-52 Rev. 2; EO 14306) SP 800-52 Rev. 2 requires TLS 1.3 support by January 1, 2024; EO 14306 separately sets “not later than January 2, 2030” for TLS 1.3 or a successor as a post-quantum readiness date1819 Ch 03, Ch 10 TLS configuration of branch-facing services and enforcement points
Encryption in transit (EO 14028 §3(d); BOD 18-01) Adopt encryption in transit “to the maximum extent consistent with Federal records laws and other applicable laws,” naming no protocol or layer; HTTPS and HSTS on public websites and STARTTLS on internet-facing mail servers2021 Ch 03 Encryption coverage by flow; public-facing HTTPS and mail scans
Cryptographic modules (FIPS 140; CMVP) All FIPS 140-2 certificates moved to the Historical List on September 22, 2026; CMVP supports their purchase and use for existing systems, and agencies set their own move to FIPS 140-322 Ch 03, Ch 09, Ch 10, Ch 11 Module certificates for every encrypting device; validation language in acquisition documents
Boundary protection (SP 800-53 SC-7, SC-7(4), SC-7(8)) Monitor and control communications at external managed interfaces; a managed interface and traffic flow policy for each external telecommunication service, with documented and reviewed exceptions; route defined traffic through authenticated proxies23 Ch 03, Ch 05, Ch 08, Ch 12, Appendix A Managed-interface inventory per branch; traffic flow policy; exception register and review records
Transmission protection (SP 800-53 SC-8, SC-8(1), SC-13) Protect transmitted information by physical or logical means; cryptographic mechanisms “include TLS and IPSec”; the agency selects cryptographic uses and types24 Ch 03, Ch 05, Ch 10 End-to-end TLS evidence; the cleartext-protocol exposure register with a disposition for each flow
Flow enforcement and nonsecure protocols (SP 800-53 AC-4, CM-7(1)) Enforce approved information flows; periodically review and disable nonsecure ports, protocols and services (FTP is named)25 Ch 03, Ch 10 Flow policy; protocol review records
Monitoring and remote access (SP 800-53 SI-4, CA-7, AC-17, AU-12) Detect attacks and indicators of attack; continuous monitoring strategy and metrics; control and monitor remote access; generate audit records26 Ch 03, Ch 05, Ch 07, Ch 13 Per-application and per-path telemetry; SIEM ingestion; continuous monitoring reports
Telecommunications diversity (SP 800-53 CP-8, CP-8(1), CP-8(2), CP-8(3)) Alternate telecommunications services; avoid sharing a single point of failure with the primary; CP-8(3), provider separation, is in the High baseline only2728 Ch 02, Ch 03, Ch 05, Ch 09, Ch 11 Circuit diversity records; provider and physical-path documentation
Device and network access authentication (SP 800-53 IA-3; 802.1X) Identify and authenticate devices before establishing a connection29 Ch 07; Book 07 Chapter 06 NAC and RADIUS policy; certificate enrollment records
Zero trust architecture (CISA Zero Trust Maturity Model v2.0; NIST SP 800-207) ZTMM is “a general guide,” not “a strict set of requirements”; its cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, Governance) apply to every pillar3031 Ch 03, Ch 04, Ch 05 Network-pillar maturity self-assessment
Authentication assurance (NIST SP 800-63B-4) Authenticator and reauthentication requirements by assurance level; the operative source for session and reauthentication intervals, which M-22-09 doesn’t set32 Ch 06; Book 04 Chapter 03 Conditional Access and session policy
Cloud service certification (FedRAMP Consolidated Rules for 2026) FedRAMP certifies cloud services; “each agency still authorizes its own federal information systems,” and an agency “should never create a standalone authorization to operate for a cloud service offering.” It sets no requirement on the route to a service33 Ch 03, Ch 05, Ch 12 FedRAMP Marketplace listing for each SASE or SSE service; the agency’s own system authorization and boundary diagram
Telecommunications contract vehicle (GSA EIS) Networx and WITS 3 have expired; EIS option period 1 runs to July 31, 2027; MTIPS is an EIS service343536 Ch 03, Ch 09, Ch 10 EIS task orders and service inventory

Requirements that are cited but don’t exist

The book’s sources, and much of what circulates about federal networking, cite requirements that a reader who checks will not find. They are listed so a reviewer can recognize them.

Claimed requirement What the record shows
A TIC 3.0 “SASE use case” There are four use cases: Traditional, Branch Office, Remote User and Cloud.37 CISA’s SASE document is guidance, not a use case.38
TIC 3.0 or any federal instrument requires SD-WAN or SASE The TIC documents are vendor and technology neutral; the Branch Office Use Case names SD-WAN only as an example of a conveyance whose paths need security parity.3940 M-22-09, M-26-14, M-26-15 and the Zero Trust Maturity Model don’t mention either.41424344
A CISA “SASE Roadmap for Federal Civilian Agencies” (2023) No document of that title appears in CISA’s TIC guidance; the SASE document CISA has published is the June 2026 guidance.4546
FedRAMP prohibits SD-WAN or requires hairpin routing FedRAMP certifies services and sets no routing requirement.47
An encrypted WAN overlay is required where the payload is already TLS-protected SC-8 can be met by physical or logical means; SC-8(3) and SC-8(4) are in no baseline.4849
M-22-09 mandates a 15-minute token refresh M-22-09 sets no token lifetime; reauthentication intervals come from SP 800-63B-4.5051
M-21-31 event-logging tiers EL0 to EL3 Rescinded May 22, 2026, by M-26-14.52
A citable FedRAMP Moderate control count FedRAMP Notice 0013 removed most FedRAMP-assigned parameters and gives no new counts.53
EO 14306 amends EO 14028 EO 14306 amends EO 13694 and EO 14144.54

Reading the SP 800-53 controls

  • SC-7(4) is the branch control. Its items require a managed interface and a traffic flow policy for each external telecommunication service, protection of what crosses each interface, and documented, periodically reviewed exceptions to the flow policy.55 A branch with its own internet circuit is an external telecommunication service. The exception items are what the Microsoft 365 Optimize exemption in Chapter 12 and Appendix A documents.
  • SC-8(1) names TLS and IPsec as alternatives. Its discussion lists both, and its assessment objects include mechanisms implementing alternative physical safeguards.56 Protection of headers and routing information is SC-8(3), which is in no baseline.57
  • Baseline membership. SC-7, SC-13, AC-17, SI-3, SI-4, CA-7 and AU-12 are in the Low, Moderate and High baselines. SC-7(4), SC-7(8), SC-8, SC-8(1), AC-4, CM-7(1), CP-8, CP-8(1) and CP-8(2) are in Moderate and High. CP-8(3) and CP-8(4) are High only. SC-8(2) through SC-8(5) are in none.58 FedRAMP’s Rev5 baselines are built on these, with most FedRAMP-assigned parameter values removed by Notice 0013.59
  • Release. Identifiers are from SP 800-53 Rev. 5, release 5.2.0.60

Sources

Every URL below was opened on October 21, 2026. Primary sources (federal documents, standards, and providers’ own documentation of their services) are listed separately from third-party sources, which the chapters label in their footnotes. Chapters cite product, measurement and cost sources specific to their subject in their own footnotes; those are not repeated here unless a requirement depends on them.

Primary sources: TIC 3.0 and CISA guidance

Primary sources: OMB memoranda, executive orders and CISA directives

Primary sources: NIST and other standards

Primary sources: FedRAMP and GSA

Primary sources: provider documentation

Third-party sources

Used only where no primary source could be retrieved. They are labeled “Third-party source” in each footnote.

TipContinue the book

← Previous: Appendix A — Optimize Exemption Decision Instruments · Book index · Next: Appendix C — Glossary →

  1. Office of Management and Budget, M-19-26, Update to the Trusted Internet Connections (TIC) Initiative, September 12, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf (accessed Oct 21, 2026).↩︎

  2. Cybersecurity and Infrastructure Security Agency, TIC Core Guidance Volume 3: Security Capabilities Catalog, Version 3.3, September 2026, §1.1, §2, §4, §4.1 (3.UNI.PEPAR) and §4.2, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Security_Capabilities_Catalogs_September_2026_17.pdf (accessed Oct 21, 2026).↩︎

  3. Cybersecurity and Infrastructure Security Agency, TIC 3.0 Branch Office Use Case, Version 3.0, September 2026, §3, §6, §7 and §8, https://www.cisa.gov/sites/default/files/2026-10/tic-3-branch-office-use-september-2026-508c.pdf (accessed Oct 21, 2026).↩︎

  4. Cybersecurity and Infrastructure Security Agency, “Trusted Internet Connections (TIC) 3.0 Core Guidance Documents,” revision date September 23, 2026, https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents (accessed Oct 21, 2026).↩︎

  5. Cybersecurity and Infrastructure Security Agency, TIC Core Guidance Volume 1: Program Guidebook, Version 1.2, September 2026, guiding principles, §10 and §13, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Program_Guidebook_September_2026_47.pdf (accessed Oct 21, 2026).↩︎

  6. Cybersecurity and Infrastructure Security Agency, The Journey to Zero Trust: Using Secure Access Service Edge in a Modern TIC 3.0 Solution, Version 1.0, June 2026, §5.5 and Appendix A, https://www.cisa.gov/sites/default/files/2026-07/The_Journey_to_Zero_Trust-Using_SAS_in_a_Modern_TIC3.0_Solution.pdf (accessed Oct 21, 2026).↩︎

  7. Cybersecurity and Infrastructure Security Agency, Encrypted DNS Implementation Guidance, May 16, 2024, executive summary and §2, https://www.cisa.gov/sites/default/files/2024-05/Encrypted%20DNS%20Implementation%20Guidance_508c.pdf (accessed Oct 21, 2026).↩︎

  8. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks) and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 21, 2026).↩︎

  9. Cybersecurity and Infrastructure Security Agency, “Protective Domain Name System (DNS) Resolver,” https://www.cisa.gov/resources-tools/services/protective-domain-name-system-dns-resolver (accessed Oct 21, 2026).↩︎

  10. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks) and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 21, 2026).↩︎

  11. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Agency Actions,” Appendix B and Appendix C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  12. Cybersecurity and Infrastructure Security Agency, “Logging Reference Architecture” (published August 20, 2026), https://www.cisa.gov/resources-tools/resources/logging-reference-architecture (accessed Oct 21, 2026).↩︎

  13. Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 23-02, June 13, 2023, https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02 (accessed Oct 21, 2026).↩︎

  14. Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 26-02, February 5, 2026, https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices (accessed Oct 21, 2026). Dates computed from the issue date.↩︎

  15. Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 26-04, June 10, 2026, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026). Dates computed from the issue date.↩︎

  16. Office of Management and Budget, M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026, §3 and the zero trust “Networks” item, https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf (accessed Oct 21, 2026).↩︎

  17. Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026, https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ (accessed Oct 21, 2026).↩︎

  18. NIST, SP 800-52 Rev. 2, August 2019, abstract, https://csrc.nist.gov/pubs/sp/800/52/r2/final (accessed Oct 21, 2026).↩︎

  19. Executive Order 14306, June 6, 2025, §§1–2, https://www.whitehouse.gov/presidential-actions/2025/06/sustaining-select-efforts-to-strengthen-the-nations-cybersecurity-and-amending-executive-order-13694-and-executive-order-14144/ (accessed Oct 21, 2026).↩︎

  20. Executive Order 14028, Improving the Nation’s Cybersecurity, May 12, 2021, §3(d), https://www.govinfo.gov/content/pkg/FR-2021-05-17/pdf/2021-10460.pdf (accessed Oct 21, 2026).↩︎

  21. Cybersecurity and Infrastructure Security Agency, Binding Operational Directive 18-01, Enhance Email and Web Security, October 16, 2017, https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security (accessed Oct 21, 2026).↩︎

  22. NIST Computer Security Resource Center, “FIPS 140-3 Transition Effort,” https://csrc.nist.gov/projects/fips-140-3-transition-effort (accessed Oct 21, 2026).↩︎

  23. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  24. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  25. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  26. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  27. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  28. NIST, SP 800-53B, Control Baselines for Information Systems and Organizations; membership checked against NIST’s OSCAL Rev. 5 Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (accessed Oct 21, 2026).↩︎

  29. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  30. Cybersecurity and Infrastructure Security Agency, Zero Trust Maturity Model, Version 2.0, April 2023, §3 and §5.6, https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf (accessed Oct 21, 2026).↩︎

  31. NIST, SP 800-207, Zero Trust Architecture, August 2020, https://csrc.nist.gov/pubs/sp/800/207/final (accessed Oct 21, 2026).↩︎

  32. NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, final July 31, 2025, https://csrc.nist.gov/pubs/sp/800/63/b/4/final (accessed Oct 21, 2026).↩︎

  33. FedRAMP, “Using a FedRAMP Certified Cloud Service,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/agencies/use/ (accessed Oct 21, 2026).↩︎

  34. General Services Administration, “Legacy IT contracts,” https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/legacy-it-contracts (accessed Oct 21, 2026).↩︎

  35. General Services Administration, “Enterprise Infrastructure Solutions,” https://www.gsa.gov/technology/it-contract-vehicles-and-purchasing-programs/telecommunications-and-network-services/enterprise-infrastructure-solutions (accessed Oct 21, 2026).↩︎

  36. Cybersecurity and Infrastructure Security Agency, TIC Core Guidance Volume 3: Security Capabilities Catalog, Version 3.3, September 2026, §1.1, §2, §4, §4.1 (3.UNI.PEPAR) and §4.2, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Security_Capabilities_Catalogs_September_2026_17.pdf (accessed Oct 21, 2026).↩︎

  37. Cybersecurity and Infrastructure Security Agency, “Trusted Internet Connections (TIC) 3.0 Core Guidance Documents,” revision date September 23, 2026, https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents (accessed Oct 21, 2026).↩︎

  38. Cybersecurity and Infrastructure Security Agency, The Journey to Zero Trust: Using Secure Access Service Edge in a Modern TIC 3.0 Solution, Version 1.0, June 2026, §5.5 and Appendix A, https://www.cisa.gov/sites/default/files/2026-07/The_Journey_to_Zero_Trust-Using_SAS_in_a_Modern_TIC3.0_Solution.pdf (accessed Oct 21, 2026).↩︎

  39. Cybersecurity and Infrastructure Security Agency, TIC Core Guidance Volume 1: Program Guidebook, Version 1.2, September 2026, guiding principles, §10 and §13, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Program_Guidebook_September_2026_47.pdf (accessed Oct 21, 2026).↩︎

  40. Cybersecurity and Infrastructure Security Agency, TIC 3.0 Branch Office Use Case, Version 3.0, September 2026, §3, §6, §7 and §8, https://www.cisa.gov/sites/default/files/2026-10/tic-3-branch-office-use-september-2026-508c.pdf (accessed Oct 21, 2026).↩︎

  41. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks) and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 21, 2026).↩︎

  42. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Agency Actions,” Appendix B and Appendix C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  43. Office of Management and Budget, M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026, §3 and the zero trust “Networks” item, https://www.whitehouse.gov/wp-content/uploads/2026/06/M-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf (accessed Oct 21, 2026).↩︎

  44. Cybersecurity and Infrastructure Security Agency, Zero Trust Maturity Model, Version 2.0, April 2023, §3 and §5.6, https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf (accessed Oct 21, 2026).↩︎

  45. Cybersecurity and Infrastructure Security Agency, “Trusted Internet Connections (TIC) 3.0 Core Guidance Documents,” revision date September 23, 2026, https://www.cisa.gov/resources-tools/resources/trusted-internet-connections-tic-30-core-guidance-documents (accessed Oct 21, 2026).↩︎

  46. Cybersecurity and Infrastructure Security Agency, The Journey to Zero Trust: Using Secure Access Service Edge in a Modern TIC 3.0 Solution, Version 1.0, June 2026, §5.5 and Appendix A, https://www.cisa.gov/sites/default/files/2026-07/The_Journey_to_Zero_Trust-Using_SAS_in_a_Modern_TIC3.0_Solution.pdf (accessed Oct 21, 2026).↩︎

  47. FedRAMP, “Using a FedRAMP Certified Cloud Service,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/agencies/use/ (accessed Oct 21, 2026).↩︎

  48. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  49. NIST, SP 800-53B, Control Baselines for Information Systems and Organizations; membership checked against NIST’s OSCAL Rev. 5 Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (accessed Oct 21, 2026).↩︎

  50. Office of Management and Budget, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022, §III.C (Networks) and “Encrypting DNS traffic,” https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf (accessed Oct 21, 2026).↩︎

  51. NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, final July 31, 2025, https://csrc.nist.gov/pubs/sp/800/63/b/4/final (accessed Oct 21, 2026).↩︎

  52. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Agency Actions,” Appendix B and Appendix C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  53. FedRAMP, Notice NTC-0013, Rev5 Baseline Changes, June 16, 2026, https://fedramp.gov/notices/0013 (accessed Oct 21, 2026).↩︎

  54. Executive Order 14306, June 6, 2025, §§1–2, https://www.whitehouse.gov/presidential-actions/2025/06/sustaining-select-efforts-to-strengthen-the-nations-cybersecurity-and-amending-executive-order-13694-and-executive-order-14144/ (accessed Oct 21, 2026).↩︎

  55. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  56. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

  57. NIST, SP 800-53B, Control Baselines for Information Systems and Organizations; membership checked against NIST’s OSCAL Rev. 5 Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (accessed Oct 21, 2026).↩︎

  58. NIST, SP 800-53B, Control Baselines for Information Systems and Organizations; membership checked against NIST’s OSCAL Rev. 5 Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (accessed Oct 21, 2026).↩︎

  59. FedRAMP, Notice NTC-0013, Rev5 Baseline Changes, June 16, 2026, https://fedramp.gov/notices/0013 (accessed Oct 21, 2026).↩︎

  60. NIST, SP 800-53 Rev. 5 (release 5.2.0), SC-7, SC-7(4), SC-7(8), SC-8, SC-8(1), SC-8(3), SC-13, AC-4, AC-17, CM-7(1), SI-4, CA-7, AU-12, CP-8 and its enhancements, and IA-3, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control text checked against NIST’s OSCAL Rev. 5 catalog (version 5.2.0), https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5 (both accessed Oct 21, 2026).↩︎

Back to top