Federal Modernization Workbook · Book 14
Book 14 — Federal Compliance & Authorization
Proof, Not a Promise
Why every control needs proof, not a promise: the federal clock, the Moderate baseline and the crosswalk, closure with proof, the program-management, contingency, supply-chain, privacy and training controls, who owns compliance, and the authorization package
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the Federal Compliance series’ orientation volume (its executive summary and brief, control crosswalk and product inventory questionnaire), the governance and assurance volume, the series overviews and volume summaries, the evidence contract specification, the federal compliance whitepaper, the test-plan catalog and the supply-chain project charter and plan. The series’ other volumes stay in the repository for control-level depth, and Chapter 12 maps each one to the book that carries it. Every external claim was checked against a primary source from October 21, 2026, as each note records. The replaced pages are kept in the repository’s archive/b14-compliance/ folder, and their old addresses forward to the chapters that replaced them.
b14-compliance-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 11 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Executive briefing (about 30 minutes live, 15 narrated): for authorizing officials, the CISO, CIO and ISSOs: proof over promises, the federal clock, closure with proof, who owns compliance and the authorization package, with each decision’s owner and timing, on the Presentations page.
A control that is described in a plan but can’t be shown working is a promise. An authorization built on promises decays the day after the assessment. Book 14 is about the proof. It starts with who owes which proof: the cloud provider proves its service under FedRAMP’s 2026 rules, the agency proves its own system and its own controls, and the authorizing official alone decides whether the residual risk is acceptable. It sets out the federal clock that now drives the work, from BOD 26-04’s remediation timelines to M-26-15’s post-quantum plan. It keeps two facts apart that are often blurred: what NIST’s Moderate baseline contains and what FedRAMP’s classes contain. Then it works through the control families the other books don’t carry in depth: program management, contingency planning, supply chain risk management, privacy and PII processing, and training and awareness. The rule throughout is that a control closes only when the mechanism that closes it exists and its proof is recorded. The book ends with the authorization package itself, continuous monitoring and ongoing authorization, and a map of the whole Federal Compliance series to the books that carry it.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why does every control need proof, not a promise, and what does the federal clock require now? | 01, 02 |
| What | The baseline and the crosswalk, closure with proof, and the program-management, contingency, supply-chain, privacy and training controls | 03, 04, 05, 06, 07, 08, 09 |
| Who | Who owns compliance, from the ISSO to the authorizing official | 10 |
| How | Build the authorization package and run continuous monitoring, and use the series as a map | 11, 12 |
Appendices: A — Control crosswalk · B — Product inventory questionnaire · C — Security assessment plan template · D — Security assessment report template · E — Security impact analysis template · F — Categorization walk-through · G — Prepare-step templates · H — Recovering Active Directory during the hybrid period
Reading paths
- Executives (20 minutes): Chapters 01, 02 and 10, or the 15-minute presentation.
- ISSOs and compliance teams: Chapters 03, 04 and 11, with Appendices A and B. Control assessors and system owners: Chapter 11 with Appendices C, D and E.
- Authorizing officials: Chapters 01, 02, 10 and 11.
- Privacy offices: Chapter 08. Supply chain and acquisition: Chapter 07. Continuity planners: Chapter 06, with Appendix H for Active Directory forest recovery.
- Anyone choosing what to read next: Chapter 12.
Where this book sits in the workbook
This is Book 14 of the Federal Modernization Workbook. The evidence contract it relies on is in Book 12, Chapter 02; evidence over attestation, the drift model and reciprocity are in Book 13; and the FedRAMP 2026 rules and the authorization boundary in Book 10. Training in depth is Book 16.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Proof, Not a Promise | Why every control in a federal authorization needs proof rather than a promise: which federal requirements bind the agency and which bind its cloud providers, what “Moderate” means under FIPS 199, FIPS 200 and SP 800-53B, why continuous evidence is the standard the law already sets, and why assessment tools measure a design but can’t supply one. |
| Chapter 02 — The Federal Clock | The federal dates that drive an agency’s compliance and authorization work, each re-checked against its primary source on October 21, 2026: FedRAMP’s 2026 rules, CISA’s binding operational and emergency directives, the OMB memoranda on logging, software assurance and post-quantum cryptography, and the standards and vendor dates that change what an agency can prove, with the source dates that had moved corrected. |
| Chapter 03 — The Control Baseline and the Crosswalk | Which controls apply and where the workbook treats them: the NIST SP 800-53B Moderate baseline and FedRAMP class membership as two separate facts, how the series control crosswalk was built, its coverage by volume and by book, the FedRAMP 2026 indicator view and why the indicators bind providers, and how an agency uses the crosswalk together with the product inventory questionnaire. |
| Chapter 04 — Closure: A Control Closes Only With Its Proof | The program’s rules for when a control counts as closed: the mechanism that supports it has to exist, and its proof has to be recorded; a closure without its proof doesn’t count; a vendor roadmap is not a commitment; every operation travels the authorized path; and necessity claims are about mechanisms, not products. With the controls these rules help an agency show and the corrections made to the source claims. |
| Chapter 05 — Program Management Controls | What the Program Management (PM) family in NIST SP 800-53 Rev. 5 asks of an agency, why it sits outside every security baseline and every FedRAMP class, and the artifact and evidence behind each of the thirteen controls the program depends on: the security program plan, the senior official, the POA&M process, the system inventory, measures of performance, enterprise architecture, the risk management strategy, the authorization process, mission and business process definition, testing, training and monitoring, security contacts, the supply chain risk management strategy and the continuous monitoring strategy. |
| Chapter 06 — Contingency Planning and Business Continuity | What the Contingency Planning (CP) family in NIST SP 800-53 Rev. 5 asks for and at which baselines; the NIST SP 800-34 Rev. 1 planning process, the business impact analysis and the contingency plan section by section; alternate storage, backups, alternate processing and alternate telecommunications as they work in Microsoft 365, Azure, Intune, SD-WAN and a cloud contact center; how the plan is tested and staff trained; and the evidence each control closes on. |
| Chapter 07 — Supply Chain Risk Management | What the SR family and PM-30 ask for, how NIST SP 800-161 Rev. 1 frames supply chain risk, where federal policy stands after OMB M-26-05 rescinded the attestation mandate, the SBOM, vulnerability disclosure and VEX evidence pipeline in SPDX, CycloneDX, CSAF and OpenVEX, FedRAMP’s supply chain and vulnerability rules, supplier disclosure, and build provenance. |
| Chapter 08 — Privacy: PII Processing and Transparency | The PT control family from PT-1 to PT-8 and the privacy baseline, the Privacy Act, OMB Circulars A-130 and A-108, privacy impact assessments under section 208 of the E-Government Act, authority and purpose, notice and consent, specific categories of PII, computer matching, and the data-flow map that keeps every privacy artifact honest. |
| Chapter 09 — Training and Awareness Controls | The awareness and training controls (AT-1 to AT-4, with insider threat, social engineering and role-based training), incident response and contingency training (IR-2, CP-3), the federal training requirements behind them, and how training records become evidence an assessor can re-derive. |
| Chapter 10 — Who Owns Compliance | The federal roles that own a system’s compliance and authorization (the ISSO and ISSM, system owner, control assessor, authorizing official and designated representative, senior agency official for privacy, supply chain risk lead, contingency planning coordinator, CISO and CIO), where each comes from in FISMA, OMB Circular A-130 and NIST SP 800-37, and a responsibility matrix consistent with the program’s other Who chapters. |
| Chapter 11 — The Authorization Package and Continuous Monitoring | What an agency authorization package contains under NIST SP 800-37 Rev. 2, the OSCAL model for each artifact, the assessment plan and the program’s test plans, assessment results, the plan of action and milestones lifecycle under CA-5, continuous monitoring under CA-7 and SP 800-137, ongoing authorization, and what FedRAMP’s 2026 continuous-monitoring rules ask of providers and of the agencies that use them. |
| Chapter 12 — The Series as a Map: Which Volume and Book Closes Each Control | A reader’s map of the Federal Compliance series: for each volume, what it covers, which workbook book now carries it, and which control families it claims closure for; what the agency’s first assessment can be expected to find before the program; and the residual compliance risk an agency should expect even with the whole program in place. |
| Appendix A — Control Crosswalk | The NIST SP 800-53 Rev. 5 controls the Federal Modernization Program addresses, family by family: each control’s identifier and title, its NIST SP 800-53B baselines and its FedRAMP 2026 class membership as separate facts, the workbook book and chapter that carries it, and whether the program’s design closes it, partly closes it or leaves it open. |
| Appendix B — Product Inventory Questionnaire | A fill-in template for scoping the Federal Modernization Program: the products and services the agency already runs, what each one is, how it is certified or accredited, where it is deployed and which workbook book it feeds, with a scope rule for cloud dependencies and a flag list that becomes the procurement and boundary agenda. |
| Appendix C — Security Assessment Plan Template | A fill-in template for the security and privacy assessment plan the Risk Management Framework asks for in Task A-2: scope, methods, depth and coverage, independence, schedule, rules of engagement and approval, with a Copilot prompt that drafts it from the security plan and a statement of what the workbook kits do and don’t supply. |
| Appendix D — Security Assessment Report Template | A fill-in template for the security and privacy assessment report the Risk Management Framework asks for in Task A-4: the elements SP 800-53A expects, a findings table, an executive summary and the hand-off to the plan of action and milestones, with a Copilot prompt that drafts the report from the assessor’s records and a statement of what the workbook kits do and don’t supply. |
| Appendix E — Security Impact Analysis Template | A fill-in template for the security and privacy impact analysis that control CM-4 requires before a change is implemented, with the significant-change decision path that connects it to Risk Management Framework Task M-1 and to event-driven authorization, a Copilot prompt that drafts the analysis from a change request, and a statement of what the workbook kits do and don’t supply. |
| Appendix F — Security Categorization Walk-Through | A worked example of RMF tasks P-12, C-1, C-2 and C-3 for one illustrative identity platform: choosing information types from NIST SP 800-60, reading their provisional impact levels, adjusting them with the special factors, taking the FIPS 199 high-water mark and recording the authorizing official’s approval, with a fill-in template, a Copilot prompt and a list of what stays the agency’s decision. |
| Appendix G — Prepare-Step Templates | Fill-in templates, each with a Copilot prompt, for three Prepare tasks in NIST SP 800-37 Rev. 2: the risk management strategy and risk tolerance statement (Task P-2), the system-level risk assessment (Task P-14), and impact-level prioritization of systems that share an impact level (Task P-6), with a scoring worksheet whose factors are labeled design guidance and a list of what stays the agency’s decision. |
| Appendix H — Recovering Active Directory During the Hybrid Period | A forest recovery runbook for the years Active Directory still runs beside Microsoft Entra ID: when to use it, the backups it depends on, recovery of the first writable domain controller in each domain (restore, SYSVOL, DNS, global catalog, RID pool, operations master roles, metadata cleanup, computer account, krbtgt and trust resets), reconnection, redeployment, cleanup and verification, with the exact commands from Microsoft’s Active Directory Forest Recovery Guide, what the hybrid period adds for Microsoft Entra Connect, and the contingency planning controls and FedRAMP indicators it supports. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Approve Book 19’s index and the Source Register; settle the sweep’s judgment calls (#365); Book 14: fix confirmed crosswalk errors (AT-2(3), PT-6, PT-8 rows, SR citations, Book 07 classes, pointers, matrix) (#382); Book 14: SAP, SAR and CM-4 impact analysis templates with Copilot prompts (Appendices C-E) (#395); Book 14 Appendix C: categorization walk-through (P-12, C-1..C-3) (#394); Book 14 Appendix C: Prepare-step templates (P-2, P-14, P-6) with Copilot prompts (#392); Book 14: re-render two figures, add PM-18/PM-19, fix Appendix D kit row, Appendix F/G links, P-6 reference (#415); and 10 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Book 14, Ch 03: the privacy baseline holds all eight PT controls, PT-1 to PT-8 (#320) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (15 merged changes since the book began) |