Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 13 · Appendix

Appendix A — Requirements Mapping: Controls, Mandates and Books

A compliance-enabling map, not a compliance claim: the NIST SP 800-53 Rev. 5 controls Book 13 relies on (configuration management, assessment and authorization, continuous monitoring, non-repudiation and provenance, plus the remediation and access controls behind the ticket-to-machine lanes), with their NIST and FedRAMP baselines and the FedRAMP 2026 indicators that cite them; then the RMF tasks, SP 800-137, OMB Circular A-130, OMB M-24-15, the FedRAMP Consolidated Rules for 2026 and the CISA directives, each mapped to the Book 13 chapter that carries it and to the other workbook books; then the requirements that are cited but don’t say what is claimed.

Every control in this appendix assumes a record that stays true between assessments; none of them supplies one.

NoteIn this appendix

The NIST SP 800-53 Rev. 5 controls that Book 13’s governance model relies on, with their titles, what each asks, their baselines in NIST SP 800-53B and in FedRAMP’s 2026 Rev5 classes, the FedRAMP 2026 Key Security Indicators that cite them, the Book 13 chapter that carries each and the other workbook books that close part of it. Then the risk management tasks and federal mandates behind the book’s argument: NIST SP 800-37 Rev. 2, SP 800-137, OMB Circular A-130, OMB M-24-15, the FedRAMP Consolidated Rules for 2026, and CISA BOD 25-01 and BOD 26-04. Then the requirements that the source material cites but that don’t say what is claimed, and the source list.

ImportantCompliance-enabling, not a compliance claim

This appendix helps an agency reuse the workbook’s governance design and evidence in its own continuous monitoring strategy, system security plans and authorization packages. It doesn’t claim that following the workbook satisfies any requirement or control. Control selection, implementation statements and assessment belong to the agency and its assessors, and the authorizing official alone accepts residual risk. Requirement wording is summarized; the cited documents govern. Every source in this appendix was checked on October 21, 2026.

How to read the tables

  • NIST SP 800-53B gives the NIST baselines that include the control (L, M, H, or none), read from NIST’s OSCAL Low, Moderate and High baseline profiles.1 FedRAMP 2026 gives the FedRAMP Rev5 classes whose baselines include it (B, C, D, or none), read from the “FedRAMP Rev5 Baselines” line on each control in FedRAMP’s 2026 control reference.2 The two columns are verified separately and don’t always agree. FedRAMP adds controls to NIST’s baselines, and the difference matters for this book: CM-3(2) and SI-2(2) are in NIST’s Moderate baseline, but CM-5(1) and CM-6(1) are NIST High only and CM-3(1) is NIST High only, while FedRAMP puts CM-5(1) and CM-6(1) in Classes C and D and CM-3(1) in Class D only. “Required at Moderate” therefore means nothing until it says which: an agency system categorized Moderate uses the NIST baseline its categorization selects, and a FedRAMP Class C service uses FedRAMP’s.
  • Indicators lists the FedRAMP 2026 Key Security Indicators whose “Related SP 800-53 Controls” include the control, as published on October 21, 2026. FedRAMP revised many of these mappings on October 13, 2026, so check the page before relying on a row. The indicators bind cloud service providers seeking certification, not agencies.3
  • Carried in names the Book 13 chapters that design or evidence the control.- Other books names the workbook books that build part of it.
  • Control identifiers and titles are from SP 800-53 Rev. 5, release 5.2.0, checked against NIST’s control catalog export on CSRC and the OSCAL catalog.4

NIST SP 800-53 Rev. 5 controls

Configuration Management (CM)

The CM family is the control-level form of the book’s first three requirements: one authoritative baseline, every change to it controlled, and the estate compared against it.

Control Title What it asks, in short NIST SP 800-53B FedRAMP 2026 Indicators Carried in Other books
CM-2 Baseline Configuration Develop, document and maintain under configuration control a current baseline; review and update it at a defined frequency, when required and when components are installed or upgraded L M H B C D KSI-CMT-RMV, CNA-DFP, CNA-IBP, MLA-EVC, SVC-ACM Ch 02, 03, 05 Book 05, Book 12, Chapter 07
CM-2(2) Automation Support for Accuracy and Currency Keep the baseline current, complete, accurate and available with defined automated mechanisms M H C D KSI-PIY-GIV, SVC-ACM, SVC-VRI Ch 02, 05 —
CM-3 Configuration Change Control Decide which changes are configuration-controlled; review and approve or disapprove them with security and privacy impact analysis; document decisions; implement approved changes; retain records; monitor; coordinate through a defined change control element M H C D KSI-CMT-LMC, CMT-RMV, CMT-RVP, CMT-VTD Ch 02, 04, 05, 09, 10 Book 00, Chapter 07 for decision rights
CM-3(1) Automated Documentation, Notification, and Prohibition of Changes Use defined automated mechanisms to document proposed changes, notify approvers, highlight changes not approved in time, prohibit changes until approved, document completed changes and notify defined people when approved changes are complete H D KSI-CMT-LMC Ch 10 —
CM-3(2) Testing, Validation, and Documentation of Changes Test, validate and document changes before finalizing them M H C D KSI-CMT-LMC, CMT-RVP, CMT-VTD Ch 04, 05, 09, 10 Book 01, Chapter 11 for the dry run
CM-3(3) Automated Change Implementation Implement changes to the baseline and deploy the updated baseline across the installed base with defined automated mechanisms none none none Ch 10 Book 05
CM-3(4) Security and Privacy Representatives Make defined security and privacy representatives members of the change control element M H C D KSI-CMT-RVP, PIY-RSD Ch 09 —
CM-3(5) Automated Security Response Implement defined security responses automatically when baselines are changed without authorization none none none Ch 02, 06 —
CM-4 Impact Analyses Analyze changes for security and privacy impact before implementing them L M H B C D none Ch 05 —
CM-4(2) Verification of Controls After a change, verify that the affected controls are implemented correctly, operating as intended and producing the desired outcome M H C D KSI-CMT-LMC, CMT-VTD Appendix B —
CM-5 Access Restrictions for Change Define, document, approve and enforce physical and logical access restrictions for changes L M H B C D KSI-CMT-RMV, CMT-RVP, IAM-JIT Ch 04 Book 04
CM-5(1) Automated Access Enforcement and Audit Records Enforce change access restrictions with automated mechanisms and generate audit records of the enforcement automatically H C D KSI-IAM-ELP, IAM-JIT, IAM-SUS, MLA-LET Ch 04 Book 04, Chapter 08
CM-5(4) Dual Authorization Enforce dual authorization for changes to defined components and system-level information none none none Ch 04 —
CM-6 Configuration Settings Establish restrictive settings from common secure configurations, implement them, approve and document deviations, monitor and control changes L M H B C D KSI-CMT-LMC, CMT-RMV, MLA-EVC, SVC-ACM Ch 02, 05, 10 Book 11 for SCuBA, Book 12, Chapter 07
CM-6(1) Automated Management, Application, and Verification Manage, apply and verify settings for defined components with defined automated mechanisms H C D KSI-MLA-EVC Ch 02, 05, 10 Book 05
CM-6(2) Respond to Unauthorized Changes Take defined actions in response to unauthorized changes to defined configuration settings H D KSI-CMT-VTD, CNA-EIS, IAM-SUS Ch 02, 06 —
CM-8 System Component Inventory An inventory that reflects the system, includes every component, has no duplicates and carries accountability information, reviewed at a defined frequency L M H B C D KSI-PIY-GIV Ch 02, 03 Book 08, Book 12, Chapter 02

Assessment, Authorization, and Monitoring (CA), Program Management (PM) and Risk Assessment (RA)

These are the controls the book’s second half argues about: assessment that measures a moment, continuous monitoring that doesn’t, and authorization decisions fed by the second rather than the first.

Control Title What it asks, in short NIST SP 800-53B FedRAMP 2026 Indicators Carried in Other books
CA-2 Control Assessments Select assessors; plan the assessment and have the authorizing official approve the plan; assess whether controls are implemented correctly, operating as intended and producing the desired outcome; report results L M H B C D KSI-PIY-RIS Ch 01, 07 Book 11, Chapter 10
CA-5 Plan of Action and Milestones Document planned remediation of weaknesses; update the plan from assessments, audits and continuous monitoring L M H none listed none Ch 09, 12 Book 10, Chapter 11
CA-6 Authorization Assign senior officials as authorizing officials for the system and for common controls; authorize before operation; update authorizations at a defined frequency L M H B C D none Ch 11 Book 00, Chapter 07, Book 10, Chapter 11
CA-6(1) Joint Authorization — Intra-organization A joint authorization by multiple authorizing officials from the same organization none none none Ch 11 —
CA-6(2) Joint Authorization — Inter-organization A joint authorization by multiple authorizing officials, at least one from another organization none none none Ch 11 Book 03
CA-7 Continuous Monitoring A system-level strategy with metrics, monitoring and assessment frequencies, ongoing assessment and monitoring, correlation, response actions and status reporting L M H B C D KSI-MLA-EVC Ch 01, 02, 05, 06, 12 Book 12, Chapter 12
CA-7(1) Independent Assessment Use independent assessors to monitor the controls on an ongoing basis M H C D none Ch 05 Book 12, Chapter 10
CA-7(4) Risk Monitoring Make effectiveness, compliance and change monitoring part of the strategy L M H B C D KSI-CMT-LMC, SCR-MIT, SVC-EIS Ch 06 Book 11, Chapter 10
CA-7(6) Automation Support for Monitoring Keep monitoring results accurate, current and available with defined automated mechanisms none none none Ch 02 —
PM-10 Authorization Process Manage the security and privacy state of systems through authorization processes; designate the roles; integrate authorization into an organization-wide risk management program none (program management) none none Ch 09 Book 01, Chapter 09
PM-4 Plan of Action and Milestones Process A process that keeps program and system POA&Ms developed, maintained, documenting remedial actions and reported as required, and reviews them for consistency none (program management) none none Ch 12 —
PM-31 Continuous Monitoring Strategy The organization-wide strategy, with metrics, frequencies, ongoing monitoring, correlation, response and reporting none (program management) none none Ch 12 Book 12, Chapter 12
RA-7 Risk Response Respond to findings from assessments, monitoring and audits in line with the organization’s risk tolerance L M H B C D none Ch 09, 10 Book 00, Chapter 07

Provenance and integrity of the record: AU, SA, SR and SI

Chapter 04’s provenance and Chapter 07’s evidence chain rest on these controls. None of them names a particular signing or hashing method; the method is the program’s design.

Control Title What it asks, in short NIST SP 800-53B FedRAMP 2026 Indicators Carried in Other books
AU-9 Protection of Audit Information Protect audit information and tools from unauthorized access, modification and deletion; alert defined roles when that is detected L M H B C D KSI-MLA-OSM Ch 07 Book 12, Chapter 12
AU-9(3) Cryptographic Protection Protect the integrity of audit information and tools with cryptographic mechanisms H D KSI-SVC-VRI Ch 07 Book 12, Chapter 12
AU-10 Non-repudiation Provide irrefutable evidence that an individual, or a process acting for one, performed defined actions H D KSI-IAM-JIT, IAM-SNU, MLA-LET Ch 04, 07 Book 07
SA-10 Developer Configuration Management Require the developer to perform configuration management, control the integrity of changes, implement only approved changes, document them and their impacts, and track flaws M H C D KSI-SCR-MIT Ch 04 —
SA-9 External System Services Require providers of external services to meet organizational requirements and employ defined controls; define oversight roles; monitor compliance L M H B C D KSI-SCR-MIT, SCR-MON Ch 08 Book 10
SR-4 Provenance Document, monitor and maintain valid provenance of defined systems, components and associated data none none none Ch 07 —
SI-4 System Monitoring Monitor for attacks and unauthorized activity, analyze detected events, and provide monitoring information to defined roles L M H B C D KSI-IAM-SUS, MLA-RVL, SVC-EIS Ch 06, 08 Book 12, Chapter 05
SI-7 Software, Firmware, and Information Integrity Use integrity verification tools to detect unauthorized changes to defined software, firmware and information, and act when they are found M H C D KSI-CNA-EIS, SVC-VRI Ch 07 —

SR-4 appears in no NIST or FedRAMP baseline, and neither do CA-7(6), CM-3(3), CM-3(5), CM-5(4), CA-6(1), CA-6(2), SI-2(5) and AU-14 in the other tables. The chapters cite them because they name exactly what the book designs, not because an assessor will select them; an agency that wants them in its plan has to tailor them in.

Controls behind the ticket-to-machine lanes

Chapter 10 and Appendix B route remediation and access work through a machine wherever one can reach the surface, and route certificates through protocol-enforced automation. These are the controls those lanes produce evidence for. Their substance belongs to other books.

Control Title What it asks, in short NIST SP 800-53B FedRAMP 2026 Indicators Carried in Other books
RA-5 Vulnerability Monitoring and Scanning Scan at a defined frequency and when new vulnerabilities are reported; analyze; remediate within defined response times L M H B C D KSI-SCR-MON Ch 10, Appendix B Book 12, Chapter 06
SI-2 Flaw Remediation Identify, report and correct flaws; test updates; install security updates within a defined period; fold remediation into configuration management L M H B C D KSI-CMT-VTD Ch 10 Book 12, Chapter 07
SI-2(2) Automated Flaw Remediation Status Determine with automated mechanisms whether components have applicable security updates installed M H C D KSI-SVC-EIS Ch 10 Book 05, Chapter 10
SI-2(5) Automatic Software and Firmware Updates Install defined security-relevant updates automatically to defined components none none none Ch 10 Book 05
AC-2 Account Management Define account types, conditions and approvals; create, modify, disable and remove accounts according to policy; monitor use; review accounts for compliance L M H B C D KSI-IAM-APM, IAM-JIT, IAM-SNU, IAM-SUS Ch 05, 11, Appendix B Book 03, Book 04, Chapter 09
AC-3 Access Enforcement Enforce approved authorizations for access L M H B C D KSI-IAM-APM, IAM-ELP, IAM-JIT Appendix B Book 04
AC-5 Separation of Duties Identify and document the duties to separate; define access authorizations to support the separation M H C D KSI-IAM-JIT, PIY-RIS, PIY-RSD Ch 09, 10 Book 04, Chapter 06
AC-6 Least Privilege Allow only the access users and processes need for their assigned tasks M H C D KSI-IAM-ELP, IAM-JIT Ch 08, 10, Appendix B Book 04, Chapter 02
AU-14 Session Audit Provide the capability for defined users or roles to record, view, hear or log session content, used in consultation with legal counsel none none none Ch 10, Appendix B Book 04
IA-5(2) Public Key-based Authentication Validate certificates to an accepted trust anchor, enforce authorized access to private keys, map the authenticated identity, and maintain cached revocation data M H C D KSI-IAM-APM, IAM-ELP, IAM-SNU, SVC-ASM Appendix B Book 07
SC-12 Cryptographic Key Establishment and Management Establish and manage cryptographic keys according to defined requirements L M H B C D KSI-SVC-ASM Appendix B Book 07, Chapter 08
SC-17 Public Key Infrastructure Certificates Issue certificates under a defined certificate policy or obtain them from an approved provider; include only approved trust anchors in trust stores M H C D KSI-SVC-ASM Appendix B Book 07

Controls the surface slots report against

Chapter 11 describes the seven surface slots, the places where each platform’s evidence lands, each with a primary control pair. The pairs are the program’s design; the indicator mappings below are FedRAMP’s, and they correct several the source material assumed.

Plane (program design) Primary controls Indicators that cite them Source assumed
Identity IA-2, AC-2 KSI-IAM-APM, IAM-ELP, IAM-JIT, IAM-SNU, IAM-SUS KSI-IAM
Addressing CM-8, AC-4 CM-8: KSI-PIY-GIV. AC-4: KSI-IAM-ELP, IAM-JIT, IAM-SNU KSI-PIY and KSI-CNA
Network SC-8, CA-7 SC-8: KSI-CNA-MAT, CNA-ULN, SVC-SIN. CA-7: KSI-MLA-EVC KSI-CNA
Telemetry CA-7, SI-4 CA-7: KSI-MLA-EVC. SI-4: KSI-IAM-SUS, MLA-RVL, SVC-EIS KSI-MLA
Endpoint CM-8, IA-3 CM-8: KSI-PIY-GIV. IA-3: KSI-IAM-ELP, IAM-SNU KSI-PIY
Security CM-2, AC-4 CM-2: KSI-CMT-RMV, CNA-DFP, CNA-IBP, MLA-EVC, SVC-ACM. AC-4: as above KSI-CMT and KSI-SCR
Continuity CP-9, CP-10 CP-9: KSI-RPL-ABO. CP-10: KSI-RPL-ABO, RPL-ARP, RPL-RRO, RPL-TRC KSI-RPL and KSI-CED

All seven pairs are in FedRAMP’s Class C baseline. AC-4, IA-3 and SC-8 are Moderate and High in NIST SP 800-53B; the others are in all three NIST baselines.56

Risk management tasks and federal mandates

Requirement What it asks Carried in Other books Evidence
NIST SP 800-37 Rev. 2, tasks P-7 and S-5 Develop and implement an organization-wide strategy, and then a system-level strategy, for monitoring control effectiveness7 Ch 12 Book 12, Chapter 12 The continuous monitoring strategy at both levels
SP 800-37, tasks A-5 and A-6 Conduct initial remediation and reassess remediated controls; prepare the plan of action and milestones from the assessment findings8 Ch 06, 10 Book 10, Chapter 11 Re-test records; POA&M items with milestones
SP 800-37, tasks R-2 to R-5 The authorizing official determines risk, chooses a response, decides whether the risk is acceptable and reports the decision and significant deficiencies; decisions include authorization to operate, authorization to use and denial, with terms, conditions and a termination date the official can change at any time9 Ch 09, 11 Book 00, Chapter 07 Authorization decision documents and their terms
SP 800-37, tasks M-1 to M-6 Monitor the system and environment for changes; conduct ongoing assessments; analyze and respond to monitoring output; update the authorization package; report posture to the authorizing official; conduct ongoing authorization from continuous monitoring results10 Ch 02, 06, 10, 12 Book 12, Chapter 12 Drift findings, posture reports, ongoing authorization decisions
SP 800-37, reciprocity and Appendix F Reciprocity is an agreement to accept one another’s assessments; a customer organization’s authorizing official issues an authorization to use, with the same responsibility as one issuing an authorization to operate, only after a valid authorization to operate exists; joint and type authorizations are other approaches11 Ch 11 Book 03 for shared HR services Each consuming agency’s authorization to use, citing the provider’s authorization
NIST SP 800-137 Continuous monitoring is “maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions”; the program is defined, established, implemented, analyzed and reported, responded to, and reviewed and updated; organization-wide monitoring can’t be done efficiently by manual or automated processes alone12 Ch 01, 12 Book 12, Chapter 12 The strategy and its review record
OMB Circular A-130, Appendix I, §4.d Designate senior officials to authorize systems; complete an initial authorization before operation; transition to ongoing authorization when eligible and approved; reauthorize on a time- or event-driven basis; maintain an information security continuous monitoring strategy13 Ch 09, 11, 12 Book 01, Chapter 09 Authorization and reauthorization records
OMB M-24-15 (July 25, 2024), presumption of adequacy Agencies must presume the assessment in a FedRAMP authorization package adequate for an authorization at or below its impact level, while the authorization is maintained through continuous monitoring; the presumption can be overcome for a demonstrable need or a wholly or substantially deficient package, documented and reported to the FedRAMP office14 Ch 11 Book 10, Chapter 03 The agency’s authorization citing the FedRAMP package
M-24-15, automation and continuous monitoring Machine-readable artifacts; OSCAL until NIST designates a successor; agencies must be able to produce, accept and submit machine-readable materials; OMB encourages FedRAMP to build continuous monitoring that primarily monitors the provider’s change process itself rather than individual changes15 Ch 11, Appendix B Book 12, Chapter 12 OSCAL output from the governance platform
FedRAMP Consolidated Rules for 2026, timeline Optional adoption from July 4, 2026; mandatory for all stakeholders January 1, 2027; no new Rev5 certification applications after June 11, 202716 — Book 10, Chapter 03 —
FedRAMP 2026, Key Security Indicators 46 indicators in ten themes (Cybersecurity Education, Change Management, Cloud Native Architecture, Identity and Access Management, Incident Response, Monitoring, Logging, and Auditing, Policy and Inventory, Recovery Planning, Supply Chain Risk, Service Configuration); outcome statements for providers, each mapped to related controls17 Ch 11 Book 12, Chapter 12 The provider’s certification data
FedRAMP 2026, Agency Use rules Agencies must keep agency-wide policy aligned with M-24-15; complete an ATO for systems using certified services; notify FedRAMP after authorizing; ensure governance, risk, compliance and inventory tools can produce and ingest OSCAL and JSON; not require more than FedRAMP requires without a head-of-agency determination; notify FedRAMP of concerns likely to rescind an ATO18 Ch 07, 11 Book 10, Chapter 11 The agency’s policy, ATO letters and notifications
FedRAMP 2026, Collaborative Continuous Monitoring Providers supply an Ongoing Certification Report every 3 months; agencies must review each report against the risk tolerance in their ATO19 Ch 05, 11 Book 12, Chapter 12 Record of each review against the ATO
FedRAMP 2026, Significant Change Notification Providers evaluate every potential significant change and classify it as routine recurring, transformative or adaptive; routine recurring changes, the day-to-day flaw, incident and maintenance work, are exempt from notification; auditable evaluation records are kept20 Appendix B — The provider’s change evaluation records
FedRAMP 2026, Vulnerability Detection and Response Provider remediation timeframes graded by certification class, potential agency impact rating, likely exploitability and internet reachability; KEVs remediated by catalog due dates under BOD 26-0421 — Book 12, Chapter 06 — (provider obligation)
CISA BOD 25-01 (December 17, 2024) Report in-scope cloud tenants (by February 21, 2025, then annually); deploy SCuBA assessment tools and report continuously or quarterly (by April 25, 2025); implement mandatory SCuBA policies (by June 20, 2025) and future updates on CISA’s timelines; meet the baselines for new tenants before granting an ATO; authorizing officials may accept risk for deviations, which agencies identify and explain when reporting22 — Book 11, Chapters 04 and 08 Tool results feed; deviation record with risk acceptance
CISA BOD 26-04 (June 10, 2026) Revokes BOD 19-02 and BOD 22-01. Phase I, immediately: update vulnerability management policy, assign roles, monitor the KEV catalog and automate KEV reporting through the CDM Dashboard or report every two weeks. Phase II, within 60 days: update processes for CVE and KEV data. Phase III, within 180 days: remediate within the Table 1 timelines and tag internet-reachable assets23 Ch 10 Book 12, Chapter 06 Policy and roles; remediation-within-timeline record

Directives bind agencies through the Federal Information Security Modernization Act: a binding operational directive is a compulsory direction, and agencies are required to comply with it.24 OMB’s FedRAMP memorandum works differently. It sets a presumption agencies must apply, and it leaves the authorization decision with the agency: FedRAMP’s own rules require agencies to complete the ATO process for systems that use certified services.2526

What non-compliance exposes

None of the documents cited in this appendix sets a monetary penalty for an agency. The consequences they name are of three kinds, and all three are written into the record the book’s governance model produces.

Authority What makes it binding What a failure produces
CISA BOD 25-01 and BOD 26-04 Compulsory direction under 44 U.S.C. § 3554(a)(1)(B)(ii)27 Reported deviations and missed timelines, visible to CISA through the reporting each directive requires
The authorization A risk acceptance with terms, conditions and a termination date the authorizing official can change at any time; a denial is also a decision28 A shortened, conditioned or denied authorization
OMB Circular A-130 Initial authorization before operation, reauthorization on a time- or event-driven basis, a continuous monitoring strategy29 Reauthorization triggered by events, not just by the calendar
FedRAMP 2026 Agency Use rules Agencies must notify FedRAMP when certification data raises concerns likely to result in rescinding their ATO30 A notification to FedRAMP, and the ATO decision that follows it

The record of non-closure is the exposure that matters most in practice. An assessment tool that runs faithfully against an estate nobody remediates produces an accurate, lengthening list of open findings, and every auditor who asks can read it.

Requirements that are cited but don’t say what is claimed

The source material behind this book was drafted while FedRAMP’s rules, OMB’s FedRAMP policy and CISA’s vulnerability directive all changed. These claims are the ones most worth checking before they reach a plan.

Claimed requirement What the record shows
CM-3(2), CM-5(1), CM-6(1) and SI-2(2) are the Rev. 5 Moderate baseline enhancements that mandate automation In NIST SP 800-53B, CM-3(2) and SI-2(2) are Moderate and High, but CM-5(1) and CM-6(1) are High only, as is CM-3(1). In FedRAMP’s 2026 Rev5 reference all four are in Classes C and D.3132 The claim holds for a FedRAMP Class C service, not for an agency system categorized Moderate.
FedRAMP’s vulnerability rules set remediation timeframes of 4 to 192 days The timeframes depend on certification class. At Class D they run from 12 hours to 192 days, at Class C from 2 days to 192 days, and at Classes A and B from 4 days to 192 days. They are “SHOULD” statements for providers, not agency obligations.33
SI-2 feeds KSI-SVC and KSI-MLA; RA-5, CA-2 and CA-5 feed KSI-MLA; IA-5(2) and SC-17 feed KSI-IAM On FedRAMP’s page, SI-2 is cited by KSI-CMT-VTD and SI-2(2) by KSI-SVC-EIS. RA-5 is cited by KSI-SCR-MON, CA-2 by KSI-PIY-RIS, and CA-5 by no indicator. SC-17 is cited by KSI-SVC-ASM, and IA-5(2) by KSI-SVC-ASM and three IAM indicators.34
Eight reciprocity indicators, KSI-RECIP-001 to 008, are FedRAMP 20x Key Security Indicators FedRAMP publishes 46 indicators in ten themes and none is a reciprocity indicator.35 The reciprocity checks are the program’s own health checks and should be labeled that way (Chapter 11).
One controlling ATO covers every consuming agency, and each agency’s reciprocity record is not a new authorization Under SP 800-37, a consuming organization’s authorizing official issues an authorization to use, carrying the same responsibility as an authorization to operate.36 M-24-15 has agencies presume the FedRAMP package adequate “for their use in issuing an authorization to operate,” and FedRAMP’s rules require agencies to complete the ATO process.3738 A signed reciprocity record is good evidence for that decision. It doesn’t replace it.
BOD 25-01 has five obligations, and the fifth, “remediate deviations,” is the one the directive is for The directive has six required actions: tenant inventory, tool deployment with continuous or quarterly reporting, implementing the mandatory policies, implementing later policy updates on CISA’s timelines, meeting the baselines for new tenants before an ATO, and explaining deviations when reporting (Book 11, Chapter 04). Remediating deviations is the purpose the directive states in its background, achieved through the mandatory policies, and authorizing officials may accept risk for deviations.39 The source’s practical point stands: the administrative actions, inventory, tool deployment and reporting, and explaining deviations, can be met without closing a single finding.
Under BOD 26-04, agency policy updates were due August 7, 2026 and full compliance December 7, 2026 The policy review is Phase I and took effect on issue, June 10, 2026. Phase II falls 60 days after issue and Phase III, the remediation timelines and asset tagging, 180 days after issue, which is December 7, 2026.40
Agencies “must” review each provider’s Ongoing Certification Report The Collaborative Continuous Monitoring rule CCM-AGM-ROR says MUST; the Agency Use summary rule AGU-USE-ROR says SHOULD for the same review.4142 Treat the review as required and plan for it; the workbook follows the stricter rule.
KSI-CMT-RMV forbids modifying a resource in place The indicator says changes are executed through redeployment of version-controlled resources “wherever reasonable.”43 It is a strong preference with room for a documented exception, which is how Appendix B treats it.

Sources

Every URL below was opened on October 21, 2026.

Primary sources: NIST

Primary sources: OMB and CISA

Primary sources: FedRAMP Consolidated Rules for 2026

Federal Compliance volumes (control-level depth)

TipContinue the book

← Previous: Chapter 14 — Applications, Secrets and Configuration Drift · Book index · Next: Appendix B — Ticket-to-Machine Reference →

  1. National Institute of Standards and Technology, SP 800-53B control baselines, OSCAL Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎

  2. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AC, AU, CA, CM, CP, IA, PM, RA, SA, SC, SI and SR (“FedRAMP Rev5 Baselines” per control; AU-14, CA-05, CA-06(01), CA-06(02), CA-07(06), CM-03(03), CM-03(05), CM-05(04), PM-04, PM-10, PM-31, SI-02(05) and SR-04 show no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  3. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator statements and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎

  4. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, release 5.2.0 (CSRC planning note of August 27, 2025), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final; identifiers and titles checked against the CSRC Cybersecurity and Privacy Reference Tool export for SP_800_53_5_2_0, https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home, and statements against the OSCAL catalog (version 5.2.0, last modified May 11, 2026), https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (all accessed Oct 21, 2026).↩︎

  5. National Institute of Standards and Technology, SP 800-53B control baselines, OSCAL Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎

  6. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AC, AU, CA, CM, CP, IA, PM, RA, SA, SC, SI and SR (“FedRAMP Rev5 Baselines” per control; AU-14, CA-05, CA-06(01), CA-06(02), CA-07(06), CM-03(03), CM-03(05), CM-05(04), PM-04, PM-10, PM-31, SI-02(05) and SR-04 show no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  7. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  8. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  9. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  10. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  11. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  12. National Institute of Standards and Technology, SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011, Executive Summary and Chapter 3, https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf (accessed Oct 21, 2026).↩︎

  13. Office of Management and Budget, Circular A-130, Managing Information as a Strategic Resource, July 2016, Appendix I, §4.d, “Authorization to Operate and Continuous Monitoring,” and definitions of authorization to operate and ongoing authorization, https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf (accessed Oct 21, 2026).↩︎

  14. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (The Presumption of Adequacy), §V (Automation and Efficiency) and §VI (Continuous Monitoring), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf (accessed Oct 21, 2026).↩︎

  15. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (The Presumption of Adequacy), §V (Automation and Efficiency) and §VI (Continuous Monitoring), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf (accessed Oct 21, 2026).↩︎

  16. FedRAMP, “Important Dates for the Consolidated Rules for 2026,” https://www.fedramp.gov/2026/timeline/ (accessed Oct 21, 2026).↩︎

  17. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator statements and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎

  18. FedRAMP, “Agency Use of FedRAMP Certified Cloud Services,” FedRAMP Consolidated Rules for 2026, rules AGU-AGC-AIP, AGU-AGC-NAA, AGU-AGC-GRC, AGU-AGC-NAR, AGU-USE-ABU, AGU-USE-NFC and AGU-USE-ROR, https://www.fedramp.gov/2026/reference/agency-use/ (accessed Oct 21, 2026).↩︎

  19. FedRAMP, “Collaborative Continuous Monitoring,” FedRAMP Consolidated Rules for 2026, CCM-AGM-ROR and CCM-OCR-AVL, https://www.fedramp.gov/2026/reference/collaborative-continuous-monitoring/ (accessed Oct 21, 2026).↩︎

  20. FedRAMP, “Significant Change Notification,” FedRAMP Consolidated Rules for 2026, SCN-CSO-EVA, SCN-CSO-MAR and SCN-RTR-NNR, https://www.fedramp.gov/2026/reference/significant-change-notification/ (accessed Oct 21, 2026).↩︎

  21. FedRAMP, “Vulnerability Detection and Response,” FedRAMP Consolidated Rules for 2026, VDR-TFR-PVR and VDR-TFR-KEV, https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/ (accessed Oct 21, 2026).↩︎

  22. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, introduction, Background and Required Actions, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 21, 2026).↩︎

  23. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background and Required Actions, Phases I–III, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  24. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, introduction, Background and Required Actions, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 21, 2026).↩︎

  25. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (The Presumption of Adequacy), §V (Automation and Efficiency) and §VI (Continuous Monitoring), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf (accessed Oct 21, 2026).↩︎

  26. FedRAMP, “Agency Use of FedRAMP Certified Cloud Services,” FedRAMP Consolidated Rules for 2026, rules AGU-AGC-AIP, AGU-AGC-NAA, AGU-AGC-GRC, AGU-AGC-NAR, AGU-USE-ABU, AGU-USE-NFC and AGU-USE-ROR, https://www.fedramp.gov/2026/reference/agency-use/ (accessed Oct 21, 2026).↩︎

  27. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, introduction, Background and Required Actions, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 21, 2026).↩︎

  28. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  29. Office of Management and Budget, Circular A-130, Managing Information as a Strategic Resource, July 2016, Appendix I, §4.d, “Authorization to Operate and Continuous Monitoring,” and definitions of authorization to operate and ongoing authorization, https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf (accessed Oct 21, 2026).↩︎

  30. FedRAMP, “Agency Use of FedRAMP Certified Cloud Services,” FedRAMP Consolidated Rules for 2026, rules AGU-AGC-AIP, AGU-AGC-NAA, AGU-AGC-GRC, AGU-AGC-NAR, AGU-USE-ABU, AGU-USE-NFC and AGU-USE-ROR, https://www.fedramp.gov/2026/reference/agency-use/ (accessed Oct 21, 2026).↩︎

  31. National Institute of Standards and Technology, SP 800-53B control baselines, OSCAL Low, Moderate and High baseline profiles, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎

  32. FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, family pages for AC, AU, CA, CM, CP, IA, PM, RA, SA, SC, SI and SR (“FedRAMP Rev5 Baselines” per control; AU-14, CA-05, CA-06(01), CA-06(02), CA-07(06), CM-03(03), CM-03(05), CM-05(04), PM-04, PM-10, PM-31, SI-02(05) and SR-04 show no class listing), https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎

  33. FedRAMP, “Vulnerability Detection and Response,” FedRAMP Consolidated Rules for 2026, VDR-TFR-PVR and VDR-TFR-KEV, https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/ (accessed Oct 21, 2026).↩︎

  34. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator statements and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎

  35. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator statements and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎

  36. National Institute of Standards and Technology, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations, December 2018, §1.1 and Appendix B (reciprocity), §3.1 (tasks P-7), §3.3 (S-5), §3.5 (A-5, A-6), §3.6 (R-1 to R-5), §3.7 (M-1 to M-7), and Appendix F (authorization decisions, authorization to use, joint and type authorizations), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed Oct 21, 2026).↩︎

  37. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (The Presumption of Adequacy), §V (Automation and Efficiency) and §VI (Continuous Monitoring), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf (accessed Oct 21, 2026).↩︎

  38. FedRAMP, “Agency Use of FedRAMP Certified Cloud Services,” FedRAMP Consolidated Rules for 2026, rules AGU-AGC-AIP, AGU-AGC-NAA, AGU-AGC-GRC, AGU-AGC-NAR, AGU-USE-ABU, AGU-USE-NFC and AGU-USE-ROR, https://www.fedramp.gov/2026/reference/agency-use/ (accessed Oct 21, 2026).↩︎

  39. Cybersecurity and Infrastructure Security Agency, BOD 25-01, Implementing Secure Practices for Cloud Services, December 17, 2024, introduction, Background and Required Actions, https://www.cisa.gov/news-events/directives/bod-25-01-implementing-secure-practices-cloud-services (accessed Oct 21, 2026).↩︎

  40. Cybersecurity and Infrastructure Security Agency, BOD 26-04, Prioritizing Security Updates Based on Risk, June 10, 2026, Background and Required Actions, Phases I–III, https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk (accessed Oct 21, 2026).↩︎

  41. FedRAMP, “Collaborative Continuous Monitoring,” FedRAMP Consolidated Rules for 2026, CCM-AGM-ROR and CCM-OCR-AVL, https://www.fedramp.gov/2026/reference/collaborative-continuous-monitoring/ (accessed Oct 21, 2026).↩︎

  42. FedRAMP, “Agency Use of FedRAMP Certified Cloud Services,” FedRAMP Consolidated Rules for 2026, rules AGU-AGC-AIP, AGU-AGC-NAA, AGU-AGC-GRC, AGU-AGC-NAR, AGU-USE-ABU, AGU-USE-NFC and AGU-USE-ROR, https://www.fedramp.gov/2026/reference/agency-use/ (accessed Oct 21, 2026).↩︎

  43. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator statements and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎

Back to top