Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 12 · Appendix

Appendix A — Requirements Mapping: Controls, Mandates and Books

A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. 5 controls security operations asserts (AU, CA-7, CM-6/7/8, RA-5, SI-2/3/4, IR-4/5, SC-7), with their NIST and FedRAMP baselines, and the mandates behind them (OMB M-26-14, BOD 26-04 and the KEV catalog, BOD 23-01, BOD 25-01, TIC 3.0, CISA incident notification, FedRAMP’s 2026 rules, NIST’s RMF and continuous monitoring guidance), each mapped to the Book 12 chapter that carries it and to the other workbook books; then the requirements that are cited but don’t say what is claimed, and the sources.

A control says what an assessor will look for, a mandate says when, and neither says who; a map is useful only if it keeps all three apart.

NoteIn this appendix

The NIST SP 800-53 Rev. 5 controls that security operations asserts, with their titles, what each asks, their baselines in NIST SP 800-53B and in FedRAMP’s 2026 Rev5 classes, the Book 12 chapter that carries each and the other workbook books that close part of it. Then the federal mandates: OMB M-26-14, BOD 26-04 and the KEV catalog, BOD 23-01, BOD 25-01, TIC 3.0, CISA’s incident notification guidelines, FedRAMP’s Consolidated Rules for 2026 and NIST’s RMF and continuous monitoring guidance. Then the requirements that are often cited for this book’s subject but don’t say what is claimed, and the source list.

ImportantCompliance-enabling, not a compliance claim

This appendix helps an agency reuse the workbook’s design and evidence in its own Agency Logging Plan, continuous monitoring strategy and system security plans. It doesn’t claim that following the workbook satisfies any requirement or control. Control selection, implementation statements and assessment belong to the agency and its assessors, and the authorizing official alone accepts residual risk. Requirement wording is summarized; the cited documents govern. Every source in this appendix was checked on October 21, 2026.

How to read the tables

  • Baselines gives two values. The first is the NIST SP 800-53B baseline that includes the control (L, M, H, or none), checked against NIST’s OSCAL baseline profiles.1 The second is the FedRAMP 2026 Rev5 classes whose baselines include it (B, C, D, or none), from FedRAMP’s control reference; Book 10 records Microsoft 365 GCC’s certification as Class C, Moderate.2 The agency’s own systems use the baseline its categorization selects.
  • Carried in names the Book 12 chapters that design or evidence the control.
  • Other books names the workbook books that build part of it.
  • Control identifiers and titles are from SP 800-53 Rev. 5, release 5.2.0, checked against the OSCAL catalog and the CSRC publication page.3

NIST SP 800-53 Rev. 5 controls

Audit and Accountability (AU)

Control Title What it asks, in short Baselines Carried in Other books
AU-2 Event Logging Identify the event types the system can log, coordinate with others who need audit information, select the event types to log with a rationale, and review the selection at a defined frequency L M H; B C D Ch 02, 03, 04, 10 Book 02, Book 05, Book 08
AU-3 Content of Audit Records Records establish what happened, when, where, the source, the outcome and the identity involved L M H; B C D Ch 02 Book 01, Chapter 11
AU-3(1) Additional Audit Information Generate defined additional information in audit records M H; C D Ch 02, 03 —
AU-4 Audit Log Storage Capacity Allocate storage capacity to accommodate retention requirements L M H; B C D Ch 04, 12 —
AU-5 Response to Audit Logging Process Failures Alert defined people within a defined time when logging fails, and take defined actions L M H; B C D Ch 05, 12 —
AU-6 Audit Record Review, Analysis, and Reporting Review and analyze records at a defined frequency for unusual activity, report findings, adjust review when risk changes L M H; B C D Ch 05, 10, 11 Book 06, R09
AU-6(1) Automated Process Integration Integrate review, analysis and reporting with automated mechanisms M H; C D Ch 05, 11, 12 —
AU-6(3) Correlate Audit Record Repositories Analyze and correlate records across repositories for organization-wide awareness M H; C D Ch 02, 05 Book 08 for the naming plane
AU-6(4) Central Review and Analysis Centrally review and analyze records from multiple components none; D Ch 05 —
AU-6(5) Integrated Analysis of Audit Records Integrate audit analysis with vulnerability scanning, performance and monitoring information H; D Ch 02, 06 —
AU-7 Audit Record Reduction and Report Generation Provide on-demand review, analysis and reporting without altering original records M H; C D Ch 05, 12 —
AU-8 Time Stamps Use internal clocks for timestamps that meet a defined granularity and use UTC or a fixed or recorded offset L M H; B C D Ch 02, 05 Book 08 for time services
AU-9 Protection of Audit Information Protect audit information and tools from unauthorized access, modification and deletion, and alert defined roles when that is detected L M H; B C D Ch 10, 12 —
AU-10 Non-repudiation Provide irrefutable evidence that an individual performed defined actions H; D Ch 09 —
AU-11 Audit Record Retention Retain records for a defined period for investigations and retention requirements L M H; B C D Ch 05 (in part), 10, 12 Book 01, Chapter 09
AU-12 Audit Record Generation Generate the selected records on defined components, with defined people able to select what is logged L M H; B C D Ch 03, 04 Book 05, Book 09
AU-12(1) System-wide and Time-correlated Audit Trail Compile records into a system-wide trail time-correlated to a defined tolerance H; D Ch 02, 12 Book 10, Chapter 06 for the join key

Assessment, Authorization, and Monitoring (CA) and Program Management (PM)

Control Title What it asks, in short Baselines Carried in Other books
CA-2 Control Assessments Plan and conduct assessments of control effectiveness and report results L M H; B C D Ch 11, 12 Book 11
CA-5 Plan of Action and Milestones Document planned remediation of weaknesses; update from assessments, audits and continuous monitoring L M H; not listed in FedRAMP’s 2026 Rev5 control reference4 Ch 10, 12 Book 14, Chapter 11, Book 10, Chapter 11, Book 11, Chapter 10
CA-7 Continuous Monitoring A system-level strategy with metrics, frequencies, ongoing assessment and monitoring, correlation, response actions and status reporting L M H; B C D Ch 12 Book 05, Chapter 10, Book 06, R09, Book 11
CA-7(1) Independent Assessment Use independent assessors for ongoing monitoring M H; C D Ch 10, 12 —
CA-7(3) Trend Analyses Use trend analysis to decide whether controls or monitoring need to change none; none Ch 11, 12 —
CA-7(4) Risk Monitoring Include effectiveness, compliance and change monitoring in the strategy L M H; B C D Ch 12 Book 11, Chapter 10 for drift
PM-31 Continuous Monitoring Strategy The organization-wide strategy, with metrics, frequencies, correlation, response and reporting none (program management); none Ch 10, 12 —
RA-7 Risk Response Respond to findings from assessments, monitoring and audits in line with risk tolerance L M H; B C D Ch 10, 12 Book 00, Chapter 07

Configuration Management (CM)

Control Title What it asks, in short Baselines Carried in Other books
CM-2 Baseline Configuration Develop, document and maintain a current baseline configuration L M H; B C D Ch 07 Book 05
CM-6 Configuration Settings Establish restrictive settings from common secure configurations, implement them, approve deviations, monitor changes L M H; B C D Ch 07, 08, 12 Book 05, Book 11 for SCuBA
CM-7 Least Functionality Configure only essential capabilities; prohibit or restrict the rest L M H; B C D Ch 08 Book 05, Book 11
CM-8 System Component Inventory An accurate, complete inventory without duplicate accounting, reviewed at a defined frequency L M H; B C D Ch 02, 06, 12 Book 08, Book 10, Chapter 06

Risk Assessment (RA) and System and Information Integrity (SI)

Control Title What it asks, in short Baselines Carried in Other books
RA-5 Vulnerability Monitoring and Scanning Scan at a defined frequency and when new vulnerabilities are reported, analyze results, remediate within defined response times L M H; B C D Ch 06 Book 05
RA-5(2) Update Vulnerabilities to Be Scanned Update the vulnerabilities scanned at a defined frequency, before a new scan or when new ones are identified L M H; B C D Ch 06 —
RA-5(5) Privileged Access Implement privileged access authorization to defined components for defined scanning activities M H; C D Ch 06 Book 04
SI-2 Flaw Remediation Identify, report and correct flaws; test updates; install security updates within a defined period; fold remediation into configuration management L M H; B C D Ch 06, 07 Book 05
SI-2(2) Automated Flaw Remediation Status Determine whether components have applicable security updates installed, with automated mechanisms M H; C D Ch 07 —
SI-2(3) Time to Remediate Flaws and Benchmarks for Corrective Actions Measure time from identification to remediation; set benchmarks none; C D Ch 06, 12 —
SI-3 Malicious Code Protection Signature- or non-signature-based malicious code protection at entry and exit points, updated and configured to respond L M H; B C D Ch 08 Book 05
SI-4 System Monitoring Monitor for attacks and unauthorized connections, analyze detected events, adjust with risk, obtain legal opinion, provide monitoring information to defined roles L M H; B C D Ch 05, 10, 11 Book 09
SI-4(2) Automated Tools and Mechanisms for Real-time Analysis Automated tools for near real-time event analysis M H; C D Ch 05 —
SI-4(4) Inbound and Outbound Communications Traffic Monitor inbound and outbound traffic for unusual or unauthorized activity M H; C D Ch 05 Book 08, Book 09
SI-4(5) System-generated Alerts Alert defined people when defined indications of compromise occur M H; C D Ch 11 —
SI-4(16) Correlate Monitoring Information Correlate information from monitoring tools across the system none; C D Ch 02, 05 —
SI-5 Security Alerts, Advisories, and Directives Receive, generate and disseminate alerts and directives; implement directives within their time frames or notify the issuer of noncompliance L M H; B C D Ch 06 —

Incident Response (IR) and System and Communications Protection (SC)

Control Title What it asks, in short Baselines Carried in Other books
IR-4 Incident Handling A handling capability covering preparation, detection and analysis, containment, eradication and recovery; lessons learned; consistent rigor L M H; B C D Ch 10, 11 —
IR-4(1) Automated Incident Handling Processes Support handling with automated mechanisms M H; C D Ch 11 —
IR-5 Incident Monitoring Track and document incidents L M H; B C D Ch 11, 12 —
IR-6 Incident Reporting Personnel report suspected incidents within a defined time; report incident information to defined authorities L M H; B C D Ch 10, 11 —
IR-8 Incident Response Plan A plan that provides a roadmap, defines reportable incidents, provides metrics for the capability, explicitly designates responsibility, and is reviewed, distributed and protected L M H; B C D Ch 10, 11 —
SC-7 Boundary Protection Monitor and control communications at external and key internal managed interfaces; separate public components; connect only through managed interfaces L M H; B C D Ch 05 for boundary-device telemetry, 08 for cloud-plane attack-path analysis Book 09, Book 10, Chapter 07

SC-7 is the one control in the list whose substance belongs to another book. Its telemetry, the logs boundary protection devices emit, is what Book 12 carries: SASE, firewall and DNS records landing in the SIEM and feeding SI-4(4) (Chapter 05), plus the cloud plane’s network exposure and attack-path analysis (Chapter 08). The boundary design is Book 09’s, and the cloud front door is Book 10’s.

Federal mandates

Mandate What it asks Carried in Other books Evidence
OMB M-26-14 (May 22, 2026), prioritization Organize logging around continuous event monitoring and around threat hunting, investigation, response and forensics, for all systems owned or operated by or for the agency, including IoT and OT; rescinds M-21-315 Ch 01, 10 Book 00, Chapter 01, Book 02, Book 08 The Agency Logging Plan
M-26-14, Agency Logging Plan Submit to OMB and CISA within 90 days of CISA’s Logging Reference Architecture; update it as needed6 Ch 10 Book 11, Chapter 07 for Zero Trust coverage The plan, its owner and its revision history
M-26-14, Appendix B item 1 Logs actively searchable for 6 months after creation and retrievable for 1 year; records schedules still apply7 Ch 05, 12 Book 08 Per-table retention export; tier assignments
M-26-14, Appendix B items 2–4 Logs readily available to the top-level SOC; accurate timestamps from a traceable time source; CDM, HWAM and SWAM data used to confirm log coverage8 Ch 02, 10, 12 Book 08, Book 09 Collection coverage metric; time-source configuration
M-26-14, Appendix B item 5 Logs supporting eleven activities, from the identity behind each operation to attack vectors, with automated alerts for all of them9 Ch 03, 04, 05, 12 Book 01, Chapter 03 Detection coverage metric against items a–k
M-26-14, Appendix C Maturity per system across inventory visibility, collection coverage, collection operations, data retention and log management, scored at the lowest watermark; Levels 1, 2 and 3 due 120, 180 and 320 days after the reference architecture10 Ch 12 Book 00, Chapter 01 for the dates Percentage of systems at each level
M-26-14, log access Provide logs to CISA and the FBI on request after a known or suspected compromise, in an agreed format and timeframe11 Ch 10 — Documented procedure and its owner
CISA BOD 26-04 (June 10, 2026) Revokes BOD 22-01 and BOD 19-02. Phase I: update vulnerability management policy, assign roles, monitor the KEV catalog, automate KEV status reporting through the CDM Dashboard or report manually every two weeks. Phase II (60 days): update processes for CVE and KEV data. Phase III (180 days): remediate within Table 1’s timelines; tag every asset reachable from outside the agency network12 Ch 06, 10, 12 Book 05 Policy and role assignment; KEV remediation-within-timeline metric; asset tags
CISA KEV catalog Maintained under BOD 26-04 with unchanged inclusion criteria; each entry carries a due date and a forensic triage flag; JSON and CSV feeds1314 Ch 06, 12 — Daily cross-reference of findings to the catalog
CISA BOD 23-01 (October 3, 2022) Automated asset discovery every 7 days; vulnerability enumeration of discovered assets every 14 days; results into the CDM Agency Dashboard within 72 hours15 Ch 01, 06, 12 Book 08 Discovery and enumeration cadence records; inventory coverage metric
CISA BOD 25-01 (December 17, 2024) Implement mandatory SCuBA configurations for in-scope cloud tenants; deploy the assessment tools and report results, continuously or at least quarterly16 Ch 12 Book 11, Chapters 04, 09, 10 Interval ScubaGear evidence; configuration conformance metric
TIC 3.0 Program Guidebook, v1.2 (September 2026) Agencies are responsible for TIC capabilities (M-19-26); TIC doesn’t replace telemetry requirements, including telemetry to CISA; automated, continuous validation through CDM replaces manual TIC Compliance Validation; TIC delegates represent the agency; cloud telemetry to CLAW per C-CIRA17 Ch 10, 12 Book 09, Chapter 03 TIC delegate designation; CLAW telemetry route
CISA Federal Incident Notification Guidelines Notify CISA within one hour of identification by the agency’s top-level CSIRT, SOC or IT department; major-incident criteria from the most recent OMB guidance18 Ch 10, 11 — Notification timestamps against identification
FedRAMP Consolidated Rules for 2026 Mandatory January 1, 2027, except that the VDR and VER rules were mandatory December 7, 2026. 46 Key Security Indicators in ten themes bind cloud service providers; agencies must review each provider’s Ongoing Certification Report, issued every 3 months; provider vulnerability timeframes are graded by potential agency impact192021 Ch 12 Book 10, Chapters 03 and 11 Record of each OCR review against the agency’s ATO
NARA GRS 3.2 System access records kept 6 years after password change or account termination where special accountability applies; cybersecurity logging items 035 and 036 cite the rescinded M-21-31 and are under revision2223 Ch 10, 12 Book 01, Chapter 09 The records officer’s disposition decision per log class
NIST SP 800-37 Rev. 2, Monitor step Tasks M-1 to M-6 assign monitoring, ongoing assessment, risk response, package updates, posture reporting and ongoing authorization24 Ch 10, 12 Book 01, Chapter 09 Posture reports; ongoing authorization decisions
NIST SP 800-137 Continuous monitoring as ongoing awareness to support risk decisions, with organization-defined metrics25 Ch 12 — The continuous monitoring strategy
NIST SP 800-61 Rev. 3 (April 2025) Incident response recommendations as a CSF 2.0 community profile; supersedes Rev. 226 Ch 11 — IR plan mapped to the CSF 2.0 functions
NIST SP 800-53A Rev. 5 Assessment by examine, interview and test, with objects listed per control27 Ch 12 Book 14, Federal Compliance & Authorization The artifact list in Chapter 12

Requirements that are cited but don’t say what is claimed

The source volumes behind this book were drafted during a year of rescissions and new directives. These are the claims most worth checking before they reach a plan.

Claimed requirement What the record shows
BOD 22-01 requires agencies to remediate KEV entries by their catalog due dates BOD 22-01 was revoked by BOD 26-04 on June 10, 2026, along with BOD 19-02. The KEV catalog continues under BOD 26-04, whose timelines depend on exposure, KEV status, automatability and technical impact.28
A 14-day remediation tier for KEV vulnerabilities on internet-facing systems is “at least as tight as” the federal deadline Under BOD 26-04, a KEV-listed vulnerability on a publicly exposed asset has 3 days in three of four cases and 14 days only when exploitation is neither automatable nor gives total control.29 A 14-day tier for all of them is looser than the directive.
M-26-14 sets 12 months of active storage plus 18 months of cold storage, in EL0–EL3 tiers Those were M-21-31’s figures and tiers. M-26-14 sets 6 months searchable and 1 year retrievable, and a five-level maturity model.30
AU-12(1), AU-6(4) and SI-4(16) close at the FedRAMP Moderate gate In NIST SP 800-53B, AU-12(1) is High only and AU-6(4) and SI-4(16) are in no baseline. In FedRAMP’s 2026 Rev5 reference, AU-12(1) and AU-6(4) are Class D only; SI-4(16) is Classes C and D.3132
FedRAMP 20x KSI automation queries an agency’s Sentinel tables and fails a workspace with no enabled rules FedRAMP’s indicators state outcomes, such as a SIEM “used and persistently reviewed,” and bind cloud service providers seeking certification. They specify no query and no agency pipeline.33
The SOC is an RMF role with its own risk authority SP 800-37 defines no SOC role; only the authorizing official accepts risk. M-26-14 names the top-level SOC as the place logs must be available, not as a decision maker.3435
A data lake or archive tier satisfies the 6-month “searchable” requirement for detection sources M-26-14 defines searchable as usable for detections without preparation. Microsoft says logs ingested only into the Sentinel data lake tier don’t generate alerts.3637 The program keeps detection sources in the analytics tier (Chapter 12).

Sources

Every URL below was opened on October 21, 2026. Chapters cite product sources specific to their subject in their own footnotes; those are not repeated here unless a requirement depends on them.

Primary sources: OMB, CISA and NARA

Primary sources: NIST

Primary sources: FedRAMP and Microsoft

Federal Compliance volumes (control-level depth)

TipContinue the book

← Previous: Chapter 12 — Evidence, Metrics and Continuous Monitoring · Book index · Next: Appendix B — Identity and Application Detections →

  1. National Institute of Standards and Technology, SP 800-53B control baselines, OSCAL Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎

  2. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AU, CA, CM, IR, RA, SC and SI (“FedRAMP Rev5 Baselines” per control; CA-05 shows no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  3. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, release 5.2.0 (CSRC planning note of August 27, 2025), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; control identifiers, titles and statements checked against the OSCAL catalog (version 5.2.0, last modified May 11, 2026), https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (both accessed Oct 21, 2026).↩︎

  4. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AU, CA, CM, IR, RA, SC and SI (“FedRAMP Rev5 Baselines” per control; CA-05 shows no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  5. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  6. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  7. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  8. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  9. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  10. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  11. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  12. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background, Required Actions and Appendix A, Table 1: Remediation Timelines, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  13. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background, Required Actions and Appendix A, Table 1: Remediation Timelines, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  14. Cybersecurity and Infrastructure Security Agency, “Known Exploited Vulnerabilities Catalog,” https://www.cisa.gov/known-exploited-vulnerabilities-catalog (accessed Oct 21, 2026).↩︎

  15. Cybersecurity and Infrastructure Security Agency, BOD 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022, Required Actions, https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks (accessed Oct 21, 2026).↩︎

  16. Cybersecurity and Infrastructure Security Agency, BOD 25-01 Implementation Guidance: Implementing Secure Practices for Cloud Services, reporting options, https://www.cisa.gov/news-events/directives/bod-25-01-implementation-guidance-implementing-secure-practices-cloud-services (accessed Oct 21, 2026).↩︎

  17. Cybersecurity and Infrastructure Security Agency, TIC 3.0 Core Guidance Volume 1: Program Guidebook, Version 1.2, September 2026, §4, §9, §10, §11 and §13, https://www.cisa.gov/sites/default/files/2026-09/TIC_3.0_Program_Guidebook_September_2026_47.pdf (accessed Oct 21, 2026).↩︎

  18. Cybersecurity and Infrastructure Security Agency, “Federal Incident Notification Guidelines,” effective April 1, 2017, https://www.cisa.gov/federal-incident-notification-guidelines (accessed Oct 21, 2026).↩︎

  19. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/; and “Important Dates for the Consolidated Rules for 2026,” https://www.fedramp.gov/2026/timeline/ (both accessed Oct 21, 2026).↩︎

  20. FedRAMP, “Collaborative Continuous Monitoring,” FedRAMP Consolidated Rules for 2026, CCM-AGM-ROR and the Ongoing Certification Report rule, https://www.fedramp.gov/2026/reference/collaborative-continuous-monitoring/ (accessed Oct 21, 2026).↩︎

  21. FedRAMP, “Vulnerability Detection and Response,” FedRAMP Consolidated Rules for 2026, VDR-TFR-PVR, https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/ (accessed Oct 21, 2026).↩︎

  22. National Archives and Records Administration, General Records Schedule 3.2, Information Systems Security Records, Transmittal No. 33, January 2023, items 030, 031, 035 and 036, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf (accessed Oct 21, 2026).↩︎

  23. National Archives and Records Administration, “GRS Status Updates,” GRS Transmittal 38 (GRS 3.2 items 035–036, Drafting, as of October 2026), https://www.archives.gov/records-mgmt/grs/grs-status-updates (accessed Oct 21, 2026).↩︎

  24. National Institute of Standards and Technology, SP 800-37 Rev. 2, December 2018, §3.7 (Monitor step) and Appendix D (Roles and Responsibilities), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  25. National Institute of Standards and Technology, SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf (accessed Oct 21, 2026).↩︎

  26. National Institute of Standards and Technology, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, April 2025, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf (accessed Oct 21, 2026).↩︎

  27. National Institute of Standards and Technology, SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations, January 2022, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf (accessed Oct 21, 2026).↩︎

  28. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background, Required Actions and Appendix A, Table 1: Remediation Timelines, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  29. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background, Required Actions and Appendix A, Table 1: Remediation Timelines, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  30. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  31. National Institute of Standards and Technology, SP 800-53B control baselines, OSCAL Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎

  32. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AU, CA, CM, IR, RA, SC and SI (“FedRAMP Rev5 Baselines” per control; CA-05 shows no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  33. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/; and “Important Dates for the Consolidated Rules for 2026,” https://www.fedramp.gov/2026/timeline/ (both accessed Oct 21, 2026).↩︎

  34. National Institute of Standards and Technology, SP 800-37 Rev. 2, December 2018, §3.7 (Monitor step) and Appendix D (Roles and Responsibilities), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  35. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  36. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, “Prioritization,” “Agency Logging Plan,” “Measuring Maturity,” “Log Access Requirements,” “Agency Actions,” and Appendices B and C, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  37. Microsoft Learn, “Manage data tiers and retention in Microsoft Sentinel,” section “Compare the analytics and data lake tiers,” https://learn.microsoft.com/azure/sentinel/manage-data-overview; and “Microsoft Sentinel data lake direct ingestion guidance,” https://learn.microsoft.com/azure/sentinel/datalake/sentinel-lake-log-ingestion-guidance (both accessed Oct 21, 2026).↩︎

Back to top