This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 14 · Appendix

Appendix A — Control Crosswalk

The NIST SP 800-53 Rev. 5 controls the Federal Modernization Program addresses, family by family: each control’s identifier and title, its NIST SP 800-53B baselines and its FedRAMP 2026 class membership as separate facts, the workbook book and chapter that carries it, and whether the program’s design closes it, partly closes it or leaves it open.

A crosswalk row says where a control is built and whether its proof exists, not that an assessor has accepted either.

In this appendix

The reverse index for Chapter 03: for every NIST SP 800-53 Rev. 5 control the program addresses, its title, the NIST SP 800-53B baselines that select it, the FedRAMP 2026 classes whose Rev5 baselines include it, the workbook chapter that builds or operates it, and its status in the program’s design. Then what the crosswalk shows when the columns are read together, where it corrects its source, and the sources it was checked against.

A coverage index, not a compliance claim

A row here points to the chapter that treats a control as its subject. It doesn’t claim the control is satisfied, inherited or shared on any system; that depends on the system’s boundary and on the assessor’s determination, and the authorizing official alone accepts residual risk. The status column is the program’s design, not an assessment result. Control identifiers, titles, baselines and class memberships were checked on October 21, 2026.

How to read the crosswalk

Control and title. Identifiers and titles are from SP 800-53 Rev. 5, release 5.2.0, which NIST issued on August 27, 2025.¹ Every identifier and title was checked against the release 5.2.0 export of NIST’s Cybersecurity and Privacy Reference Tool on CSRC and against NIST’s OSCAL catalog for the same release.² Enhancements carry the enhancement’s own title; the parent control is the row above or the base identifier.
NIST SP 800-53B. The NIST baselines that select the control: L, M and H for the Low, Moderate and High security baselines, and “Privacy” for the privacy baseline, which applies to systems whatever their impact level.³ Release 5.2.0 of SP 800-53B made no changes to the baselines.⁴ Membership was read from NIST’s OSCAL baseline profiles and cross-checked against the CSRC export; the two agree for every row.⁵ ⁶
FedRAMP 2026 class. The FedRAMP Rev5 certification classes whose baselines include the control (B, C or D), read from the “FedRAMP Rev5 Baselines” line on each control in FedRAMP’s Full Rev5 Control Reference.⁷ FedRAMP’s February 2026 notice set Class B to include the former Li-SaaS and Low baselines, Class C the Moderate baseline and Class D the High baseline.⁸ “None” means the reference shows no class for that control. Keep this column apart from the NIST one: they often disagree, and the difference matters (What the crosswalk shows).
Workbook chapter. The chapter in Books 00 to 13 where the program builds, configures or operates the control, written as book and chapter (B12 Ch07 is Book 12, Chapter 07). A dash means no book from 00 to 13 carries it; the family’s Book 14 chapter, named above each table, describes what the agency has to establish.
Status (design). The program’s own design position, in three values:
- Closed: a workbook chapter builds the mechanism, and the program’s design records a machine-checked proof for it in the authoritative record. A control closes only when the mechanism exists and its proof is recorded (Chapter 04).
- Partly closed: one half is in place. Usually a workbook chapter builds the mechanism, but the program doesn’t yet record a proof for the control; the claim rests on the chapter’s prose and the evidence it describes.
- Open: the program describes the control, in Book 14 or in the Federal Compliance volumes, but no workbook book from 00 to 13 builds its mechanism and no proof is recorded. Most open rows are policies, plans and program-level functions the agency has to establish itself.

The program’s design moves a row from partly closed to closed by recording its proof, not by writing more about it. Treat every status as dated: a closed row reopens when its evidence stops arriving (Book 13, Chapter 07).

What the crosswalk shows

Read the columns together and four patterns stand out.

NIST baseline and FedRAMP class are different facts. FedRAMP’s class baselines add to NIST’s, so a control can be in a FedRAMP class without being in the matching NIST baseline:⁹ ¹⁰

Control	NIST SP 800-53B	FedRAMP 2026 class	What it means
SC-8, SC-8(1), SC-28	M H	B C D	FedRAMP asks a Class B service for transmission and at-rest protection that NIST’s Low baseline doesn’t select
SI-2(3), SI-4(16)	none	C D	Remediation timeframes and correlated monitoring are FedRAMP additions at Class C; an agency system categorized Moderate selects neither unless the agency tailors them in
AU-6(4)	none	D	Central review and analysis is a FedRAMP High addition
AU-12(1), SC-12(1)	H	D	Both are High-only in both schemes; neither is a Moderate requirement
AU-10	H	D	Non-repudiation is High-only in both; the program builds it anyway, as provenance for the record (Book 13, Chapter 04)
CA-5	L M H	none	NIST selects the plan of action and milestones at every level; FedRAMP’s reference lists no class for it

The last row reports what the reference shows; it isn’t a reason to drop a POA&M. For an agency system, the NIST baseline its categorization selects is the starting point, and FedRAMP’s class tells the agency what was assessed in a provider’s service.¹¹

Some controls the program addresses are in no baseline. AT-2(1), AT-3(3), CA-7(3), IA-3(1), IA-9 and SI-4(7) are in neither NIST’s nor FedRAMP’s baselines.¹² ¹³ The program addresses them because they name exactly what it builds. An agency that wants them in its plan has to tailor them in, and shouldn’t cite them as baseline requirements.

Program management and privacy controls sit outside the class baselines. None of the PM or PT controls here carries a FedRAMP class, and the PM and PT family pages in FedRAMP’s reference show no class line at all.¹⁴ On the NIST side, the PT controls and PM-7, PM-9, PM-11 and PM-14 are in the privacy baseline only, and the other PM controls are in no baseline.¹⁵ These are the agency’s own obligations: no cloud provider’s certification can supply them.

The open rows cluster in the governance families. Contingency planning, program management, PII processing and transparency, supply chain risk management and awareness and training are almost entirely open, because no infrastructure book builds a contingency plan, a supplier agreement or a training record. That’s why this book carries them: Chapter 05 to Chapter 09 describe what the agency has to establish and what evidence each control should leave. The technical families are mostly closed or partly closed, and the partly closed rows are the program’s own queue: each needs its proof recorded, not more design.

Control tables by family

Access Control (AC)

Built in the identity and access books. Joiner, mover and leaver events drive account management from the HR record (Book 03); privilege, separation of duties and session controls are Conditional Access and Privileged Identity Management design (Book 04); remote access and information flow are network design (Book 09). Book 14’s view: Chapter 03.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
AC-2	Account Management	L M H	B C D	B03 Ch08, B04 Ch09, B04 Ch10	Closed
AC-2(1)	Automated System Account Management	M H	C D	B03 Ch05, B03 Ch11	Closed
AC-2(3)	Disable Accounts	M H	C D	B03 Ch08	Closed
AC-2(4)	Automated Audit Actions	M H	C D	B04 Ch10	Closed
AC-2(13)	Disable Accounts for High-risk Individuals	M H	C D	B12 Ch11	Partly closed
AC-3	Access Enforcement	L M H	B C D	B04 Ch03, B04 Ch10	Closed
AC-4	Information Flow Enforcement	M H	C D	B09 Ch03, B12 Ch09	Closed
AC-5	Separation of Duties	M H	C D	B04 Ch02, B04 Ch09	Closed
AC-6	Least Privilege	M H	C D	B04 Ch02, B04 Ch10	Closed
AC-6(1)	Authorize Access to Security Functions	M H	C D	B04 Ch04	Partly closed
AC-6(2)	Non-privileged Access for Nonsecurity Functions	M H	C D	B04 Ch04	Partly closed
AC-6(5)	Privileged Accounts	M H	C D	B04 Ch04, B04 Ch08	Partly closed
AC-6(9)	Log Use of Privileged Functions	M H	C D	B04 Ch08	Partly closed
AC-6(10)	Prohibit Non-privileged Users from Executing Privileged Functions	M H	C D	B04 Ch04, B04 Ch08	Partly closed
AC-7	Unsuccessful Logon Attempts	L M H	B C D	B04 Ch07	Partly closed
AC-11	Device Lock	M H	C D	B05 Ch10	Partly closed
AC-12	Session Termination	M H	C D	B04 Ch07, B12 Ch11	Partly closed
AC-17	Remote Access	L M H	B C D	B09 Ch03	Closed
AC-19	Access Control for Mobile Devices	L M H	B C D	B05 Ch04	Closed
AC-20	Use of External Systems	L M H	B C D	B09 Ch07	Closed

Awareness and Training (AT)

No infrastructure book builds a training program. Chapter 09 covers the AT controls and the evidence they should leave; Book 16, People: Training & Education, carries training in depth.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
AT-2	Literacy Training and Awareness	L M H, Privacy	B C D	—	Open
AT-2(1)	Practical Exercises	none	none	—	Open
AT-2(2)	Insider Threat	L M H	B C D	—	Open
AT-2(3)	Social Engineering and Mining	M H	C D	—	Open
AT-3	Role-based Training	L M H, Privacy	B C D	—	Open
AT-3(3)	Practical Exercises	none	none	—	Open
AT-3(5)	Processing Personally Identifiable Information	Privacy only	none	—	Open
AT-4	Training Records	L M H, Privacy	B C D	—	Open

Audit and Accountability (AU)

The evidence contract and the security operations pipeline carry the logging controls (Book 12, Chapter 02); provenance and the protection of the record are governance design (Book 13). Book 14’s view: Chapter 11.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
AU-2	Event Logging	L M H, Privacy	B C D	B12 Ch03, B12 Ch04	Closed
AU-3	Content of Audit Records	L M H	B C D	B12 Ch02	Closed
AU-6	Audit Record Review, Analysis, and Reporting	L M H	B C D	B12 Ch05	Closed
AU-6(1)	Automated Process Integration	M H	C D	B12 Ch02, B12 Ch05	Closed
AU-6(4)	Central Review and Analysis	none	D	B12 Ch05	Partly closed
AU-7	Audit Record Reduction and Report Generation	M H	C D	B12 Ch05	Partly closed
AU-8	Time Stamps	L M H	B C D	B12 Ch02	Partly closed
AU-9	Protection of Audit Information	L M H	B C D	B13 Ch07, B12 Ch10	Partly closed
AU-10	Non-repudiation	H	D	B13 Ch04, B13 Ch07	Partly closed
AU-11	Audit Record Retention	L M H, Privacy	B C D	B04 Ch08, B12 Ch12	Partly closed
AU-12	Audit Record Generation	L M H	B C D	B12 Ch01, B12 Ch12	Closed
AU-12(1)	System-wide and Time-correlated Audit Trail	H	D	B12 Ch02	Closed

Assessment, Authorization, and Monitoring (CA)

Continuous monitoring is built in Book 12 and governed in Book 13; the authorization decision itself is the authorizing official’s. Book 14’s view: Chapter 11.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
CA-2	Control Assessments	L M H, Privacy	B C D	B13 Ch07, B11 Ch10	Closed
CA-3	Information Exchange	L M H	B C D	B10 Ch11	Closed
CA-5	Plan of Action and Milestones	L M H, Privacy	none	B12 Ch12, B13 Ch09	Closed
CA-6	Authorization	L M H, Privacy	B C D	B13 Ch11	Partly closed
CA-7	Continuous Monitoring	L M H, Privacy	B C D	B12 Ch12, B13 Ch02	Closed
CA-7(1)	Independent Assessment	M H	C D	B13 Ch05	Partly closed
CA-7(3)	Trend Analyses	none	none	B12 Ch12	Partly closed

Configuration Management (CM)

One authoritative baseline, every change to it controlled, and the estate compared against it: Book 13, Chapters 03 and 04 carry the design, and Book 12, Chapter 07 the baselines and patching. The component inventory is the join key for every other family (Book 10, Chapter 06). Book 14’s view: Chapter 04.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
CM-2	Baseline Configuration	L M H	B C D	B12 Ch07, B13 Ch03	Closed
CM-3	Configuration Change Control	M H	C D	B13 Ch04, B10 Ch07	Closed
CM-5	Access Restrictions for Change	L M H	B C D	B13 Ch04, B10 Ch07	Closed
CM-6	Configuration Settings	L M H	B C D	B12 Ch07, B12 Ch08	Closed
CM-7	Least Functionality	L M H	B C D	B12 Ch08	Closed
CM-7(1)	Periodic Review	M H	C D	B12 Ch08	Partly closed
CM-8	System Component Inventory	L M H	B C D	B10 Ch06, B12 Ch07	Closed

Contingency Planning (CP)

Apart from the telecommunications controls, which the network book designs, the contingency family is open in the program’s design. Chapter 06 describes the plan, the testing and the alternate sites the agency has to establish.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
CP-2	Contingency Plan	L M H	B C D	—	Open
CP-2(1)	Coordinate with Related Plans	M H	C D	—	Open
CP-2(8)	Identify Critical Assets	M H	C D	—	Open
CP-3	Contingency Training	L M H	B C D	—	Open
CP-4	Contingency Plan Testing	L M H	B C D	—	Open
CP-4(1)	Coordinate with Related Plans	M H	C D	—	Open
CP-6	Alternate Storage Site	M H	C D	—	Open
CP-6(1)	Separation from Primary Site	M H	C D	—	Open
CP-7	Alternate Processing Site	M H	C D	—	Open
CP-7(1)	Separation from Primary Site	M H	C D	—	Open
CP-7(3)	Priority of Service	M H	C D	—	Open
CP-8	Telecommunications Services	M H	C D	B09 Ch02, B09 Ch03	Partly closed
CP-8(1)	Priority of Service Provisions	M H	C D	B09 Ch03	Partly closed
CP-9	System Backup	L M H	B C D	—	Open
CP-10	System Recovery and Reconstitution	L M H	B C D	—	Open

Identification and Authentication (IA)

Built in the identity, access, device, certificate and data platform books. Book 14’s view: Chapter 03.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
IA-2	Identification and Authentication (Organizational Users)	L M H	B C D	B02 Ch10, B04 Ch10	Closed
IA-2(1)	Multi-factor Authentication to Privileged Accounts	L M H	B C D	B04 Ch07	Partly closed
IA-2(2)	Multi-factor Authentication to Non-privileged Accounts	L M H	B C D	B04 Ch07	Partly closed
IA-3	Device Identification and Authentication	M H	C D	B05 Ch04, B09 Ch07	Closed
IA-3(1)	Cryptographic Bidirectional Authentication	none	none	B09 Ch07	Partly closed
IA-4	Identifier Management	L M H	B C D	B03 Ch04, B03 Ch08	Closed
IA-5	Authenticator Management	L M H	B C D	B02 Ch10	Closed
IA-5(1)	Password-based Authentication	L M H	B C D	B02 Ch10	Partly closed
IA-5(2)	Public Key-based Authentication	M H	C D	B07 Ch08	Closed
IA-9	Service Identification and Authentication	none	none	B06 Ch09, B06 Ch10	Partly closed
IA-11	Re-authentication	L M H	B C D	B04 Ch07	Partly closed

Incident Response (IR)

Incident handling, reporting and the response plan are security operations design (Book 12, Chapter 11). Incident response training is covered in Chapter 09.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
IR-2	Incident Response Training	L M H, Privacy	B C D	—	Open
IR-4	Incident Handling	L M H, Privacy	B C D	B12 Ch11	Partly closed
IR-6	Incident Reporting	L M H, Privacy	B C D	B12 Ch11	Partly closed
IR-8	Incident Response Plan	L M H, Privacy	B C D	B12 Ch11	Partly closed

Media Protection (MP)

Treated as data protection and classification in Book 12, Chapter 09. Physical media handling stays with the agency.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
MP-2	Media Access	L M H	B C D	B12 Ch09	Partly closed
MP-3	Media Marking	M H	C D	B12 Ch09	Partly closed
MP-4	Media Storage	M H	C D	B12 Ch09	Partly closed
MP-5	Media Transport	M H	C D	B12 Ch09	Partly closed

Planning (PL)

The program’s security and privacy architecture is set by its principles (Book 00, Chapter 04) and its platform foundation (Book 01, Chapter 03). The system-level architecture in each security plan is the agency’s. Book 14’s view: Chapter 03.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
PL-8	Security and Privacy Architectures	M H, Privacy	B C D	B00 Ch04, B01 Ch03	Partly closed

Program Management (PM)

Program management controls are organization-wide, not system-level. Chapter 05 covers them, and Chapter 07 covers PM-30 with the supply chain family. PM-5 is the list of systems, which no workbook book builds; Book 06, Chapter 04 inventories databases and is input to CM-8 and PM-5(1), not the system inventory (Chapter 05).

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
PM-1	Information Security Program Plan	none	none	—	Open
PM-2	Information Security Program Leadership Role	none	none	—	Open
PM-5	System Inventory	none	none	—	Open
PM-7	Enterprise Architecture	Privacy only	none	—	Open
PM-9	Risk Management Strategy	Privacy only	none	—	Open
PM-11	Mission and Business Process Definition	Privacy only	none	—	Open
PM-14	Testing, Training, and Monitoring	Privacy only	none	—	Open
PM-15	Security and Privacy Groups and Associations	none	none	—	Open
PM-30	Supply Chain Risk Management Strategy	none	none	—	Open

Personnel Security (PS)

Termination and transfer are leaver and mover events driven by the HR record (Book 03, Chapter 08).

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
PS-4	Personnel Termination	L M H	B C D	B03 Ch08	Closed
PS-5	Personnel Transfer	L M H	B C D	B03 Ch08	Closed

Personally Identifiable Information Processing and Transparency (PT)

The PT family is open in the program’s design: no infrastructure book establishes the authority to process, the purposes, consent or notice. Chapter 08 describes what the agency’s privacy program has to put in place; Book 03, Appendix B applies the same questions to the HR-to-identity data flow.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
PT-1	Policy and Procedures	Privacy only	none	—	Open
PT-2	Authority to Process Personally Identifiable Information	Privacy only	none	—	Open
PT-3	Personally Identifiable Information Processing Purposes	Privacy only	none	—	Open
PT-4	Consent	Privacy only	none	—	Open
PT-5	Privacy Notice	Privacy only	none	—	Open
PT-6	System of Records Notice	Privacy only	none	—	Open
PT-7	Specific Categories of Personally Identifiable Information	Privacy only	none	—	Open
PT-8	Computer Matching Requirements	Privacy only	none	—	Open

Risk Assessment (RA)

Vulnerability monitoring is built in Book 12, Chapter 06. RA-3 is carried at program level by the risk register in Book 00, Appendix A; a system-level risk assessment is the agency’s, and Book 14’s view is Chapter 11.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
RA-3	Risk Assessment	L M H, Privacy	B C D	B00 App A	Partly closed
RA-5	Vulnerability Monitoring and Scanning	L M H	B C D	B12 Ch06	Closed
RA-5(2)	Update Vulnerabilities to Be Scanned	L M H	B C D	B12 Ch06	Partly closed
RA-5(5)	Privileged Access	M H	C D	B12 Ch06	Partly closed

System and Services Acquisition (SA)

External services are governed through the boundary and the adapter model (Book 10, Book 13, Chapter 08). Supplier-side risk is covered in Chapter 07.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
SA-8	Security and Privacy Engineering Principles	L M H	B C D	B01 Ch10, B01 Ch12	Partly closed
SA-9	External System Services	L M H, Privacy	B C D	B10 Ch11, B13 Ch08	Closed
SA-9(2)	Identification of Functions, Ports, Protocols, and Services	M H	C D	B09 Ch12	Closed
SA-11	Developer Testing and Evaluation	M H, Privacy	C D	B12 Ch08	Closed
SA-15	Development Process, Standards, and Tools	M H	C D	—	Open

System and Communications Protection (SC)

The network, naming, certificate and data protection books carry the family (Book 08, Book 07, Book 09, Book 12). SC-5 is carried only as a resiliency condition in the network book’s exemption instruments.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
SC-5	Denial-of-service Protection	L M H	B C D	B09 App A	Partly closed
SC-7	Boundary Protection	L M H	B C D	B09 Ch02, B12 Ch08	Closed
SC-7(3)	Access Points	M H	C D	B09 Ch07	Partly closed
SC-7(5)	Deny by Default — Allow by Exception	M H	C D	B09 Ch05, B09 Ch07	Partly closed
SC-7(7)	Split Tunneling for Remote Devices	M H	C D	B09 Ch12	Partly closed
SC-7(8)	Route Traffic to Authenticated Proxy Servers	M H	C D	B09 Ch03	Closed
SC-8	Transmission Confidentiality and Integrity	M H	B C D	B09 Ch02, B09 Ch03	Closed
SC-8(1)	Cryptographic Protection	M H	B C D	B09 Ch03	Closed
SC-12	Cryptographic Key Establishment and Management	L M H	B C D	B07 Ch08, B12 Ch09	Partly closed
SC-12(1)	Availability	H	D	B12 Ch09	Partly closed
SC-13	Cryptographic Protection	L M H	B C D	B12 Ch09	Partly closed
SC-17	Public Key Infrastructure Certificates	M H	C D	B07 Ch05, B07 Ch08	Closed
SC-20	Secure Name/Address Resolution Service (Authoritative Source)	L M H	B C D	B08 Ch03, B08 Ch06	Closed
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	L M H	B C D	B08 Ch03, B08 Ch06	Closed
SC-22	Architecture and Provisioning for Name/Address Resolution Service	L M H	B C D	B08 Ch03, B08 Ch08	Closed
SC-28	Protection of Information at Rest	M H	B C D	B12 Ch09	Partly closed

System and Information Integrity (SI)

Flaw remediation, malicious code protection and monitoring are security operations design (Book 12); information retention for identity records is in Book 03, Chapter 11.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
SI-2	Flaw Remediation	L M H	B C D	B12 Ch07, B05 Ch10	Closed
SI-2(2)	Automated Flaw Remediation Status	M H	C D	B12 Ch07, B13 Ch10	Closed
SI-2(3)	Time to Remediate Flaws and Benchmarks for Corrective Actions	none	C D	B12 Ch06	Closed
SI-3	Malicious Code Protection	L M H	B C D	B12 Ch08, B09 Ch02	Closed
SI-4	System Monitoring	L M H	B C D	B12 Ch11	Closed
SI-4(2)	Automated Tools and Mechanisms for Real-time Analysis	M H	C D	B12 Ch05	Partly closed
SI-4(4)	Inbound and Outbound Communications Traffic	M H	C D	B12 Ch05	Partly closed
SI-4(7)	Automated Response to Suspicious Events	none	none	B12 Ch11	Partly closed
SI-4(16)	Correlate Monitoring Information	none	C D	B12 Ch02	Closed
SI-5	Security Alerts, Advisories, and Directives	L M H	B C D	B12 Ch06	Partly closed
SI-12	Information Management and Retention	L M H, Privacy	B C D	B03 Ch11	Closed

Supply Chain Risk Management (SR)

The supply chain family is open in the program’s design: no infrastructure book builds supplier assessment, the plan, the acquisition terms, notification agreements or component authenticity, and they are the agency’s to establish. Chapter 07 covers them.

Control	Title	NIST SP 800-53B	FedRAMP 2026 class	Workbook chapter	Status (design)
SR-1	Policy and Procedures	L M H	B C D	—	Open
SR-2	Supply Chain Risk Management Plan	L M H	B C D	—	Open
SR-3	Supply Chain Controls and Processes	L M H	B C D	—	Open
SR-5	Acquisition Strategies, Tools, and Methods	L M H	B C D	—	Open
SR-6	Supplier Assessments and Reviews	M H	C D	—	Open
SR-8	Notification Agreements	L M H	B C D	—	Open
SR-10	Inspection of Systems or Components	L M H	B C D	—	Open
SR-11	Component Authenticity	L M H	B C D	—	Open

Where this appendix corrects its source

The control-by-control mapping behind this appendix was drafted in July 2026, against FedRAMP’s 20x pilot vocabulary and a book-and-volume layout that the workbook has since replaced.

Source said	What the record shows
Each control maps to a “FedRAMP 20x KSI” such as KSI-IAM, KSI-MLA or KSI-022	FedRAMP’s 2026 Key Security Indicators are 46 outcome statements in ten themes, each with its own identifier (for example KSI-CED-RAT for reviewing training) and its own list of related controls; no indicator is numbered KSI-022, and a theme prefix such as KSI-IAM names a group, not an indicator.¹⁶ The indicators bind cloud service providers seeking certification, not agencies. This appendix drops the column; Book 13, Appendix A maps the governance controls to the current indicators.
A control is “addressed” when a volume or book of the compliance series treats it	The index now names the workbook chapter that builds the control, and says separately whether the program’s design records its proof. Many rows the source listed as addressed have no build chapter; they are open here.
Control titles as written in each volume	Every title was rechecked against release 5.2.0. The source’s titles were right in substance; capitalization now follows NIST’s, for example “Multi-factor,” “Re-authentication” and “Denial-of-service Protection.”¹⁷
Baseline position not stated	Both NIST baselines and FedRAMP classes are given for every row, as separate columns.

Sources

Every source below was opened on October 21, 2026.

NIST, SP 800-53 Rev. 5, release 5.2.0. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST, Cybersecurity and Privacy Reference Tool, SP 800-53 release 5.2.0 export. https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home
NIST, SP 800-53B, release 5.2.0. https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final
NIST, OSCAL catalog and Low, Moderate, High and Privacy baseline profiles for SP 800-53 Rev. 5. https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json
FedRAMP, Full Rev5 Control Reference. https://www.fedramp.gov/2026/reference/controls/
FedRAMP, Notice NTC-0004. https://www.fedramp.gov/notices/0004/
FedRAMP, Key Security Indicators. https://www.fedramp.gov/2026/reference/key-security-indicators/
FedRAMP, Using a FedRAMP Certified Cloud Service. https://www.fedramp.gov/2026/agencies/use/

Certificates in this book and the CLM platform

Book 07 gives each class of certificate one issuer and one renewal engine, and makes CyberArk Certificate Manager, Self-Hosted the system of record for every certificate that Intune and the PIV system don’t manage (Chapter 04, Chapter 05). The certificates this book’s systems depend on map to it as follows; Book 07, Appendix C describes the platform itself.

Certificate	Book 07 class	Issued by	Renewed by	What the CLM platform does
Server, appliance and public TLS (SC-8, SC-12, SC-17)	Internal server TLS on servers, appliances and Linux hosts; public-facing TLS	Retained AD CS; public CA	CyberArk Certificate Manager	Inventory, owners, renewal and installation are the evidence
CA certificates and CRLs (SC-17)	CA certificates and CRLs, root and issuing	The hierarchy	Key ceremony and CRL schedule	Revocation monitoring
PIV (IA-2, IA-5(2))	PIV	Federal PKI	PIV card system	Nothing
Device certificates (IA-5(2))	Device and user auth (Intune)	Cloud PKI	Intune	Nothing

Server, appliance and public TLS (SC-8, SC-12, SC-17) go to CyberArk Certificate Manager (renews and installs); CA certificates and CRLs (SC-17) go to the key ceremony and CRL schedule (renews; the platform only watches); PIV (IA-2, IA-5(2)) go to PIV card system (renews piv credentials); Device certificates (IA-5(2)) go to Intune (renews device certificates). — This book’s certificates and the engine that renews each.

For SC-13, no CMVP certificate names the CLM platform itself; the evidence is FIPS-mode Windows plus the HSM’s own validation, and the ACME servers can’t run in FIPS mode (Book 07, Appendix C).¹⁸

Continue the book

← Previous: Chapter 12 — The Series as a Map · Book index · Next: Appendix B — Product Inventory Questionnaire →

National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), planning note of August 27, 2025 announcing release 5.2.0, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, Cybersecurity and Privacy Reference Tool, SP_800_53_5_2_0 JSON export (control and enhancement titles, and security and privacy baseline relationships), https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home; titles cross-checked against the OSCAL catalog, version 5.2.0, last modified May 11, 2026, https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (both accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, SP 800-53B, Control Baselines for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), abstract and planning note of August 27, 2025 (release 5.2.0, “no changes to the baselines”), https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, SP 800-53B, Control Baselines for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), abstract and planning note of August 27, 2025 (release 5.2.0, “no changes to the baselines”), https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, Cybersecurity and Privacy Reference Tool, SP_800_53_5_2_0 JSON export (control and enhancement titles, and security and privacy baseline relationships), https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home; titles cross-checked against the OSCAL catalog, version 5.2.0, last modified May 11, 2026, https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (both accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, OSCAL baseline profiles NIST_SP-800-53_rev5_LOW-baseline_profile.json, _MODERATE-, _HIGH- and _PRIVACY-baseline_profile.json, https://github.com/usnistgov/oscal-content/tree/main/nist.gov/SP800-53/rev5/json (accessed Oct 21, 2026).↩︎
FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, built from the NIST SP 800-53 Rev. 5.2.0 OSCAL catalog; family pages for AC, AT, AU, CA, CM, CP, IA, IR, MP, PL, PM, PS, PT, RA, SA, SC, SI and SR, “FedRAMP Rev5 Baselines” line on each control, https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎
FedRAMP, Notice NTC-0004, Initial Outcome from RFC-0020 FedRAMP Authorization Designations, February 25, 2026, https://www.fedramp.gov/notices/0004/ (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, SP 800-53B, Control Baselines for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), abstract and planning note of August 27, 2025 (release 5.2.0, “no changes to the baselines”), https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final (accessed Oct 21, 2026).↩︎
FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, built from the NIST SP 800-53 Rev. 5.2.0 OSCAL catalog; family pages for AC, AT, AU, CA, CM, CP, IA, IR, MP, PL, PM, PS, PT, RA, SA, SC, SI and SR, “FedRAMP Rev5 Baselines” line on each control, https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎
FedRAMP, “Using a FedRAMP Certified Cloud Service,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/agencies/use/ (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, SP 800-53B, Control Baselines for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), abstract and planning note of August 27, 2025 (release 5.2.0, “no changes to the baselines”), https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final (accessed Oct 21, 2026).↩︎
FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, built from the NIST SP 800-53 Rev. 5.2.0 OSCAL catalog; family pages for AC, AT, AU, CA, CM, CP, IA, IR, MP, PL, PM, PS, PT, RA, SA, SC, SI and SR, “FedRAMP Rev5 Baselines” line on each control, https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎
FedRAMP, “Full Rev5 Control Reference,” FedRAMP Consolidated Rules for 2026, built from the NIST SP 800-53 Rev. 5.2.0 OSCAL catalog; family pages for AC, AT, AU, CA, CM, CP, IA, IR, MP, PL, PM, PS, PT, RA, SA, SC, SI and SR, “FedRAMP Rev5 Baselines” line on each control, https://www.fedramp.gov/2026/reference/controls/ (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, SP 800-53B, Control Baselines for Information Systems and Organizations, September 2020 (includes updates as of December 10, 2020), abstract and planning note of August 27, 2025 (release 5.2.0, “no changes to the baselines”), https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final (accessed Oct 21, 2026).↩︎
FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026, indicator identifiers, themes and “Related SP 800-53 Controls,” including the control mapping updates of October 13, 2026, https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Oct 21, 2026).↩︎
National Institute of Standards and Technology, Cybersecurity and Privacy Reference Tool, SP_800_53_5_2_0 JSON export (control and enhancement titles, and security and privacy baseline relationships), https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_2_0/home; titles cross-checked against the OSCAL catalog, version 5.2.0, last modified May 11, 2026, https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (both accessed Oct 21, 2026).↩︎
CyberArk, 26.1, “ACME” (RFC 8555 with http-01 and dns-01; tested with certbot, win-acme and acme.sh), https://docs.venafi.com/Docs/current/TopNav/Content/ACME/cco-ACME-about.php, and “Deploying on Windows Server” (“you cannot have FIPS enabled on any server that is used for ACMEv2”), https://docs.venafi.com/Docs/current/TopNav/Content/Install/r-deploy-windows-server.php (accessed Oct 23, 2026).↩︎