Federal Compliance — Series Control Crosswalk
Appendix: Master NIST SP 800-53 Rev 5 Control -> Volume/Book Index Across the Eleven-Volume Series
0.1 Draft Proposal - Subject to Review
This document is a draft proposal developed by the CSI Team (Cloud Services Infrastructure). It is a navigational index, not an authorization artifact, control-inheritance claim, or assessment result, and has not been reviewed or approved by the Agency CIO Office, the Office of Information Security (OIS), or organizational leadership.
Date Code: 2026-07-19 20:10 ET
1 Purpose
This appendix is the series-wide control crosswalk for the Federal Compliance program. It answers one question directly: for a given NIST SP 800-53 Rev 5 control, where in the eleven-volume series is it addressed? Use it as a reverse index when responding to an assessor, building a System Security Plan control-origination table, or checking that a control family is covered before an authorization review.
Across the 149 distinct controls indexed here, the series addresses coverage spanning Volumes I through IX — the transport, data-platform, security-operations, governance, training, and implementation layers, plus the three coordination and day-2 volumes: Volume VII (ServiceNow control-compliance automation), Volume VIII (multi-cloud DDI landing-zone automation), and Volume IX (ServiceNow day-2 operations). Those three do not, in the main, close new control numbers — they coordinate, evidence, and operate controls the architecture volumes already close, routing drift to owners and reconciling every asset to the CM-8 join key (the genuinely new control numbers they add are CM-5 (separation-of-duties over DDI change) plus AC-2(3), AC-2(4), and SA-9(2) from Vol IX Book 05).
1.1 Maintenance status — a machine-derived slice now exists; this master table remains the hand-maintained superset
The per-book “Authorities Closed Here” tables are generated from federal-compliance-compliance-spine.yml by render_authorities_table.py, and a CI drift gate (--check, .github/workflows/federal-compliance-authorities-drift.yml) blocks any partial that diverges from the spine. A spine-derived crosswalk is now generated too — render_crosswalk.py renders Compliance_Spine_Crosswalk.md from the same closures and is behind the same drift gate, so the machine-derived slice can never silently fall out of sync with the spine. That slice currently covers the 106 closures across 21 of 72 books the spine carries (53 distinct controls). This series-wide master table below is still the hand-maintained superset — it indexes all 149 controls, including the books the spine has not yet back-filled — so treat it as an author-maintained index, and read the generated slice for the machine-verified subset. As the spine is back-filled book by book, the generated slice grows toward this master automatically.
2 How This Crosswalk Was Built
The mapping is extracted from each book’s own primary control treatment — the “NIST 800-53 Rev 5 Control Closure” / “Authorities Closed Here” tables and the sections where a control is the substantive subject. Controls that a book only mentions in passing, cites in a framework-alignment cross-reference, or names in a vendor appendix are deliberately excluded, so a row here means the series treats that control as a first-class subject in the named book.
- Titles are the official NIST SP 800-53 Rev 5 short control titles, which occasionally differ from a book’s prose wording.
- Volume VI (Implementation) rows record where a control is operationalized as deployable code; the architecture book that closes the same control appears on the same row, so both the “what” and the “how” are visible at a glance.
- Volume V (Training & Certification) contributes only the controls whose own subject is the training program itself (AT-2 / AT-3), not the many controls it teaches.
- Volumes VII–IX (ServiceNow coordination, multi-cloud DDI, and day-2 operations) record where a control is coordinated, evidenced, or operated — drift raised as a tracked ServiceNow task, a change gated by an approved record, an asset reconciled to the CM-8 join key. With one exception (CM-5, new in Vol VIII), these volumes re-close control numbers the architecture volumes already own, at a different plane (workflow/enforcement) — so a row here for one of these volumes means “this is where the control is made operational and evidenced,” not a second independent closure claim. Actuation stays platform-native throughout.
- Relationship to the compliance spine:
federal-compliance-compliance-spine.ymlis the single source of truth for the machine-checked closures, and the per-book authorities tables are rendered from it and CI-gated against drift. The spine is being progressively back-filled book by book (~21 of 72 books carry closure rows today). A machine-derived slice of this crosswalk is now rendered from the spine byrender_crosswalk.pyintoCompliance_Spine_Crosswalk.md, behind the same drift gate as the per-book tables — so the spine-provable subset is auto-generated and cannot drift. This master crosswalk remains hand-maintained for the controls in books the spine has not yet back-filled, so it, not the generated slice, is presently the most complete series-wide control view, at the cost of being author-maintained for that remainder. The end state is for the generated slice to reach every book and this table to become fully spine-rendered. - Claim → evidence → test. For the closure-bearing books, the spine now renders a generated, CI-gated claim → evidence → test traceability matrix: each of the 106 closure claims maps to its evidence slot, its implementing kit (where one exists), and the named falsifying test that would disprove it. It states the coverage honestly — the spine’s generated closures cover 21 of 72 books, and only 13 of 106 claims yet carry a named test — so a reader can see exactly which claims are verified, which are merely asserted, and which controls are hand-authored outside the spine.
“Addressed here” is a coverage pointer, not a control-inheritance claim. Whether a control is fully inherited, partially satisfied, or shared depends on the boundary and the assessor’s determination — read the named book (and its evidence slot) for the substantive treatment.
3 Master Control Crosswalk
Each NIST SP 800-53 Rev 5 control below is followed by the volume(s) and book(s) where the series addresses it. A control addressed in more than one book lists each — typically the architecture book that closes it, the Volume VI book that implements it as deployable code, and (for the coordination controls) the Volume VII/VIII/IX book that operates and evidences it through ServiceNow or the multi-cloud DDI plane. Control enhancements are listed as their own rows where a book cites the enhancement specifically.
| Control | Title | Family | Where addressed | FedRAMP 20x KSI |
|---|---|---|---|---|
| AC-2 | Account Management | AC | Vol I Bk 04, Vol II Bk 01, Vol VI Bk 02, Vol VI Bk 03, Vol VII Bk 02, Vol IX Bk 01 | KSI-IAM |
| AC-2(1) | Account Management — Automated System Account Management | AC | Vol I Bk 04 | — |
| AC-2(3) | Account Management — Disable Accounts | AC | Vol IX Bk 05 | KSI-IAM |
| AC-2(4) | Account Management — Automated Audit Actions | AC | Vol IX Bk 05 | KSI-MLA |
| AC-2(13) | Account Management — Disable Accounts for High-Risk Individuals | AC | Vol VI Bk 04 | — |
| AC-3 | Access Enforcement | AC | Vol I Bk 02, Vol II Bk 01 | — |
| AC-4 | Information Flow Enforcement | AC | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol I Bk 07, Vol III Bk 05, Vol VI Bk 01, Vol VI Bk 03, Vol VI Bk 05 | KSI-CNA |
| AC-5 | Separation of Duties | AC | Vol III Bk 01, Vol VI Bk 02 | — |
| AC-6 | Least Privilege | AC | Vol III Bk 01, Vol VI Bk 02, Vol IX Bk 01, Vol IX Bk 03 | KSI-IAM |
| AC-6(1) | Least Privilege — Authorize Access to Security Functions | AC | Vol III Bk 01 | — |
| AC-6(2) | Least Privilege — Non-Privileged Access for Nonsecurity Functions | AC | Vol III Bk 01 | — |
| AC-6(5) | Least Privilege — Privileged Accounts | AC | Vol III Bk 01 | — |
| AC-6(9) | Least Privilege — Log Use of Privileged Functions | AC | Vol III Bk 01, Vol VI Bk 03 | — |
| AC-6(10) | Least Privilege — Prohibit Non-Privileged Users from Executing Privileged Functions | AC | Vol III Bk 01 | — |
| AC-7 | Unsuccessful Logon Attempts | AC | Vol VI Bk 03 | — |
| AC-11 | Device Lock | AC | Vol III Bk 01 | — |
| AC-12 | Session Termination | AC | Vol III Bk 01, Vol VI Bk 03, Vol VI Bk 04 | — |
| AC-17 | Remote Access | AC | Vol I Bk 02, Vol I Bk 07, Vol II Bk 01 | KSI-CNA |
| AC-19 | Access Control for Mobile Devices | AC | Vol I Bk 02, Vol I Bk 07 | KSI-IAM |
| AC-20 | Use of External Systems | AC | Vol I Bk 02, Vol IX Bk 05 | KSI-IAM |
| AT-2 | Literacy Training and Awareness | AT | Vol IV Bk 05, Vol V Bk 01, Vol V Bk 02, Vol V Bk 03 | KSI-022 |
| AT-2(1) | Literacy Training and Awareness — Practical Exercises | AT | Vol IV Bk 05 | — |
| AT-2(2) | Literacy Training and Awareness — Insider Threat | AT | Vol IV Bk 05 | — |
| AT-3 | Role-based Training | AT | Vol IV Bk 05, Vol V Bk 01, Vol V Bk 02, Vol V Bk 03 | KSI-022 |
| AT-3(3) | Role-based Training — Practical Exercises | AT | Vol IV Bk 05 | — |
| AT-3(5) | Role-based Training — Processing Personally Identifiable Information | AT | Vol IV Bk 05 | — |
| AT-4 | Training Records | AT | Vol IV Bk 05 | KSI-022 |
| AU-2 | Event Logging | AU | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol II Bk 01, Vol VIII Bk 07, Vol IX Bk 04 | KSI-MLA |
| AU-3 | Content of Audit Records | AU | Vol III Bk 07 | KSI-MLA |
| AU-6 | Audit Record Review, Analysis, and Reporting | AU | Vol III Bk 06, Vol VI Bk 03, Vol VI Bk 07 | — |
| AU-6(1) | Automated Process Integration | AU | Vol III Bk 06, Vol III Bk 07 | KSI-MLA |
| AU-6(4) | Central Review and Analysis | AU | Vol III Bk 06 | — |
| AU-7 | Audit Record Reduction and Report Generation | AU | Vol III Bk 06 | — |
| AU-8 | Time Stamps | AU | Vol III Bk 06 | — |
| AU-9 | Protection of Audit Information | AU | Vol II Bk 03 | — |
| AU-10 | Non-repudiation | AU | Vol III Bk 05, Vol VI Bk 05 | — |
| AU-11 | Audit Record Retention | AU | Vol III Bk 06 | — |
| AU-12 | Audit Record Generation | AU | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol II Bk 01, Vol III Bk 07, Vol VI Bk 07 | KSI-MLA |
| AU-12(1) | System-wide and Time-correlated Audit Trail | AU | Vol III Bk 07 | KSI-MLA |
| CA-2 | Control Assessments | CA | Vol IV Bk 06, Vol VI Bk 08, Vol VII Bk 04 | KSI-MLA |
| CA-3 | Information Exchange | CA | Vol II Bk 03, Vol IX Bk 05 | KSI-PIY |
| CA-5 | Plan of Action and Milestones | CA | Vol IV Bk 06, Vol VI Bk 07, Vol VII Bk 04 | KSI-MLA |
| CA-6 | Authorization | CA | Vol IV Bk 06 | — |
| CA-7 | Continuous Monitoring | CA | Vol I Bk 05, Vol I Bk 06, Vol II Bk 01, Vol III Bk 07, Vol IV Bk 06, Vol VI Bk 07, Vol VI Bk 08, Vol VII Bk 02, Vol VII Bk 04 | KSI-MLA |
| CA-7(1) | Continuous Monitoring — Independent Assessment | CA | Vol IV Bk 06 | — |
| CA-7(3) | Continuous Monitoring — Trend Analyses | CA | Vol IV Bk 06 | — |
| CM-2 | Baseline Configuration | CM | Vol I Bk 01, Vol II Bk 01, Vol III Bk 03, Vol VI Bk 00, Vol VI Bk 06, Vol IX Bk 02 | KSI-CMT |
| CM-3 | Configuration Change Control | CM | Vol VI Bk 00, Vol VI Bk 06, Vol VII Bk 01, Vol VIII Bk 07, Vol IX Bk 02, Vol IX Bk 04 | KSI-CMT |
| CM-5 | Access Restrictions for Change | CM | Vol VIII Bk 07 | KSI-IAM |
| CM-6 | Configuration Settings | CM | Vol I Bk 02, Vol III Bk 03, Vol III Bk 04, Vol VI Bk 06, Vol VII Bk 02, Vol VII Bk 03, Vol IX Bk 04 | KSI-CMT, KSI-SVC |
| CM-7 | Least Functionality | CM | Vol I Bk 02, Vol III Bk 02, Vol III Bk 04, Vol VI Bk 06 | KSI-SVC |
| CM-7(1) | Least Functionality — Periodic Review | CM | Vol III Bk 02 | — |
| CM-8 | System Component Inventory | CM | Vol I Bk 01, Vol I Bk 02, Vol II Bk 01, Vol III Bk 03, Vol VI Bk 01, Vol VII Bk 01, Vol VIII Bk 06, Vol IX Bk 02 | KSI-CMT, KSI-PIY |
| CP-2 | Contingency Plan | CP | Vol IV Bk 01 | — |
| CP-2(1) | Coordinate with Related Plans | CP | Vol IV Bk 01 | — |
| CP-2(8) | Identify Critical Assets | CP | Vol IV Bk 01 | — |
| CP-3 | Contingency Training | CP | Vol IV Bk 01, Vol IV Bk 05 | KSI-022 |
| CP-4 | Contingency Plan Testing | CP | Vol IV Bk 01 | — |
| CP-4(1) | Coordinate with Related Plans | CP | Vol IV Bk 01 | — |
| CP-6 | Alternate Storage Site | CP | Vol IV Bk 01 | — |
| CP-6(1) | Separation from Primary Site | CP | Vol IV Bk 01 | — |
| CP-7 | Alternate Processing Site | CP | Vol IV Bk 01 | — |
| CP-7(1) | Separation from Primary Site | CP | Vol IV Bk 01 | — |
| CP-7(3) | Priority of Service | CP | Vol IV Bk 01 | — |
| CP-8 | Telecommunications Services | CP | Vol IV Bk 01 | — |
| CP-8(1) | Priority of Service Provisions | CP | Vol IV Bk 01 | — |
| CP-9 | System Backup | CP | Vol II Bk 03, Vol IV Bk 01 | — |
| CP-10 | System Recovery and Reconstitution | CP | Vol II Bk 03, Vol IV Bk 01 | — |
| IA-2 | Identification and Authentication (Organizational Users) | IA | Vol II Bk 01, Vol II Bk 02, Vol VI Bk 02, Vol VI Bk 03 | — |
| IA-2(1) | Identification and Authentication (Organizational Users) — Multi-Factor Authentication to Privileged Accounts | IA | Vol I Bk 03 | — |
| IA-2(2) | Identification and Authentication (Organizational Users) — Multi-Factor Authentication to Non-Privileged Accounts | IA | Vol I Bk 03 | — |
| IA-3 | Device Identification and Authentication | IA | Vol I Bk 02, Vol I Bk 07, Vol II Bk 01, Vol VI Bk 02 | KSI-IAM |
| IA-3(1) | Device Identification and Authentication — Cryptographic Bidirectional Authentication | IA | Vol I Bk 02 | — |
| IA-4 | Identifier Management | IA | Vol I Bk 04 | — |
| IA-5 | Authenticator Management | IA | Vol II Bk 01, Vol VI Bk 02, Vol IX Bk 01 | KSI-IAM |
| IA-5(1) | Authenticator Management — Password-Based Authentication | IA | Vol II Bk 01 | — |
| IA-5(2) | Authenticator Management — Public Key-Based Authentication | IA | Vol I Bk 01, Vol I Bk 03, Vol IX Bk 03 | KSI-IAM |
| IA-9 | Service Identification and Authentication | IA | Vol I Bk 01 | — |
| IA-11 | Re-Authentication | IA | Vol III Bk 01, Vol VI Bk 02 | — |
| IR-2 | Incident Response Training | IR | Vol IV Bk 05 | KSI-022 |
| IR-4 | Incident Handling | IR | Vol I Bk 01, Vol III Bk 06, Vol VI Bk 04 | — |
| IR-6 | Incident Reporting | IR | Vol III Bk 06, Vol VI Bk 04 | — |
| IR-8 | Incident Response Plan | IR | Vol III Bk 06 | — |
| MP-2 | Media Access | MP | Vol III Bk 05, Vol VI Bk 05 | — |
| MP-3 | Media Marking | MP | Vol III Bk 05, Vol VI Bk 05 | — |
| MP-4 | Media Storage | MP | Vol III Bk 05, Vol VI Bk 05 | — |
| MP-5 | Media Transport | MP | Vol III Bk 05, Vol VI Bk 05 | — |
| PL-8 | Security and Privacy Architectures | PL | Vol I Bk 01 | — |
| PM-1 | Information Security Program Plan | PM | Vol IV Bk 03 | — |
| PM-2 | Information Security Program Leadership Role | PM | Vol IV Bk 03 | — |
| PM-5 | System Inventory | PM | Vol IV Bk 03 | — |
| PM-7 | Enterprise Architecture | PM | Vol IV Bk 03 | — |
| PM-9 | Risk Management Strategy | PM | Vol IV Bk 03 | — |
| PM-11 | Mission and Business Process Definition | PM | Vol IV Bk 03 | — |
| PM-14 | Testing, Training, and Monitoring | PM | Vol IV Bk 03 | — |
| PM-15 | Security and Privacy Groups and Associations | PM | Vol IV Bk 03 | — |
| PM-30 | Supply Chain Risk Management Strategy | PM | Vol IV Bk 03 | — |
| PS-4 | Personnel Termination | PS | Vol I Bk 04 | — |
| PS-5 | Personnel Transfer | PS | Vol I Bk 04 | — |
| PT-1 | Policy and Procedures | PT | Vol IV Bk 04 | — |
| PT-2 | Authority to Process Personally Identifiable Information | PT | Vol IV Bk 04 | — |
| PT-3 | Personally Identifiable Information Processing Purposes | PT | Vol IV Bk 04 | — |
| PT-4 | Consent | PT | Vol IV Bk 04 | — |
| PT-5 | Privacy Notice | PT | Vol IV Bk 04 | — |
| PT-7 | Specific Categories of Personally Identifiable Information | PT | Vol IV Bk 04 | — |
| RA-3 | Risk Assessment | RA | Vol IV Bk 06 | — |
| RA-5 | Vulnerability Monitoring and Scanning | RA | Vol III Bk 02, Vol III Bk 04, Vol VII Bk 03 | KSI-MLA |
| RA-5(2) | Vulnerability Monitoring and Scanning — Update Vulnerabilities to Be Scanned | RA | Vol III Bk 02 | — |
| RA-5(5) | Vulnerability Monitoring and Scanning — Privileged Access | RA | Vol III Bk 02 | — |
| SA-8 | Security and Privacy Engineering Principles | SA | Vol II Bk 03 | — |
| SA-9 | External System Services | SA | Vol I Bk 01, Vol I Bk 06, Vol IX Bk 05 † | KSI-SCR |
| SA-9(2) | External System Services — Identification of Functions, Ports, Protocols, and Services | SA | Vol IX Bk 05 | KSI-SCR |
| SA-11 | Developer Testing and Evaluation | SA | Vol III Bk 04 | KSI-SVC |
| SA-15 | Development Process, Standards, and Tools | SA | Vol IV Bk 06 | — |
| SC-5 | Denial-of-Service Protection | SC | Vol II Bk 03 | — |
| SC-7 | Boundary Protection | SC | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol I Bk 07, Vol III Bk 04, Vol VI Bk 01 | KSI-CNA |
| SC-7(3) | Boundary Protection — Access Points | SC | Vol I Bk 02 | — |
| SC-7(5) | Boundary Protection — Deny by Default — Allow by Exception | SC | Vol I Bk 02 | — |
| SC-7(7) | Boundary Protection — Split Tunneling for Remote Devices | SC | Vol I Bk 06 | — |
| SC-7(8) | Boundary Protection — Route Traffic to Authenticated Proxy Servers | SC | Vol I Bk 07 | KSI-CNA |
| SC-8 | Transmission Confidentiality and Integrity | SC | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol I Bk 07, Vol II Bk 01, Vol II Bk 03 | KSI-CNA |
| SC-8(1) | Transmission Confidentiality and Integrity — Cryptographic Protection | SC | Vol I Bk 07 | KSI-CNA |
| SC-12 | Cryptographic Key Establishment and Management | SC | Vol I Bk 03, Vol III Bk 05, Vol VI Bk 05 | — |
| SC-12(1) | Availability | SC | Vol III Bk 05 | — |
| SC-13 | Cryptographic Protection | SC | Vol III Bk 05 | — |
| SC-17 | Public Key Infrastructure Certificates | SC | Vol I Bk 03, Vol III Bk 05, Vol VI Bk 02, Vol IX Bk 03 | KSI-IAM |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | SC | Vol I Bk 01, Vol VI Bk 01, Vol VIII Bk 06 | KSI-CNA |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | SC | Vol I Bk 01, Vol VI Bk 01 | — |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | SC | Vol I Bk 01, Vol VI Bk 01, Vol VIII Bk 06 | KSI-CNA |
| SC-28 | Protection of Information at Rest | SC | Vol II Bk 03, Vol III Bk 05, Vol VI Bk 05 | — |
| SI-2 | Flaw Remediation | SI | Vol III Bk 02, Vol III Bk 03, Vol VI Bk 06, Vol VII Bk 03 | KSI-MLA, KSI-SVC |
| SI-2(2) | Flaw Remediation — Automated Flaw Remediation Status | SI | Vol III Bk 02, Vol III Bk 03 | KSI-MLA, KSI-SVC |
| SI-2(3) | Flaw Remediation — Time to Remediate Flaws and Benchmarks for Corrective Actions | SI | Vol III Bk 03 | KSI-SVC |
| SI-3 | Malicious Code Protection | SI | Vol I Bk 01, Vol I Bk 05, Vol I Bk 06, Vol III Bk 04 | KSI-MLA |
| SI-4 | System Monitoring | SI | Vol I Bk 05, Vol I Bk 06, Vol I Bk 07, Vol II Bk 01, Vol III Bk 06, Vol VI Bk 03, Vol VI Bk 08 | KSI-MLA |
| SI-4(2) | Automated Tools and Mechanisms for Real-time Analysis | SI | Vol III Bk 06 | — |
| SI-4(4) | Inbound and Outbound Communications Traffic | SI | Vol III Bk 06 | — |
| SI-4(7) | Automated Response to Suspicious Events | SI | Vol III Bk 06 | — |
| SI-4(16) | Correlate Monitoring Information | SI | Vol III Bk 07 | KSI-MLA |
| SI-5 | Security Alerts, Advisories, and Directives | SI | Vol III Bk 02 | — |
| SI-12 | Information Management and Retention | SI | Vol I Bk 04, Vol II Bk 03 | — |
| SR-1 | Policy and Procedures | SR | Vol IV Bk 02 | — |
| SR-2 | Supply Chain Risk Management Plan | SR | Vol IV Bk 02 | — |
| SR-3 | Supply Chain Controls and Processes | SR | Vol IV Bk 02 | — |
| SR-5 | Acquisition Strategies, Tools, and Methods | SR | Vol IV Bk 02 | — |
| SR-6 | Supplier Assessments and Reviews | SR | Vol IV Bk 02 | — |
| SR-8 | Notification Agreements | SR | Vol IV Bk 02 | — |
| SR-10 | Inspection of Systems or Components | SR | Vol IV Bk 02 | — |
| SR-11 | Component Authenticity | SR | Vol IV Bk 02 | — |
† Coordination-only closure: the row’s primary closure is carried by the architecture volume(s) listed alongside it; Vol IX Bk 05 coordinates the control (ServiceNow supplier-review workflow for SA-9) rather than closing it in its own right.
4 Control Coverage by Volume
Distinct controls addressed within each volume (a control addressed in several volumes is counted in each).
| Volume | Distinct controls addressed |
|---|---|
| Vol I | 41 |
| Vol II | 22 |
| Vol III | 54 |
| Vol IV | 54 |
| Vol V | 2 |
| Vol VI | 38 |
| Vol VII | 12 |
| Vol VIII | 6 |
| Vol IX | 10 |
| Series total (distinct) | 149 |
Volumes VII–IX raise the per-volume counts above but add only four new distinct controls to the series total (CM-5 plus AC-2(3), AC-2(4), SA-9(2)): their closures overwhelmingly coordinate and operate controls the architecture volumes already close (CM-2/3/6/8, CA-2/5/7, AC-2/6, IA-5, IA-5(2), SC-17/20/22, SI-2, RA-5, AU-2), reconciled to the CM-8 join key. The series total moved from 146 to 149 as the Vol VII SaaS-integration enhancements (AC-2(3), AC-2(4), SA-9(2)) were folded in.
5 FedRAMP 20x KSI View
Where a book maps a control to a FedRAMP 20x Key Security Indicator, those associations are aggregated here. Absence of a KSI in this view means no book stated a per-control KSI mapping — not that the control is unmapped in FedRAMP 20x.
| FedRAMP 20x KSI | Controls mapped |
|---|---|
| KSI-022 | AT-2, AT-3, AT-4, CP-3, IR-2 |
| KSI-CMT | CM-2, CM-3, CM-6 |
| KSI-CNA | AC-4, AC-17, SC-7, SC-7(8), SC-8, SC-8(1), SC-20, SC-22 |
| KSI-IAM | AC-2, AC-6, AC-19, AC-20, CM-5, IA-3, IA-5, IA-5(2), SC-17 |
| KSI-MLA | AU-2, AU-3, AU-6(1), AU-12, AU-12(1), CA-2, CA-5, CA-7, RA-5, SI-2, SI-2(2), SI-3, SI-4, SI-4(16) |
| KSI-PIY | CA-3, CM-8 |
| KSI-SCR | SA-9, SA-9(2) |
| KSI-SVC | CM-6, CM-7, SA-11, SI-2, SI-2(2), SI-2(3) |
The Volume VII/VIII/IX closures widen several themes: KSI-CMT gains CM-3 (change-controlled configuration), KSI-CNA gains the multi-cloud DDI naming controls (SC-20, SC-22), KSI-IAM gains the identity/least-privilege and credential-lifecycle controls the ServiceNow catalog governs (AC-2, AC-6, IA-5, IA-5(2), SC-17, and the new CM-5 SoD gate), KSI-MLA gains the attestation and telephony/DDI audit controls (CA-2, CA-5, AU-2), and KSI-PIY (asset inventory / provenance) draws on the CM-8 join-key reconciliation and the CA-3 information-exchange mapping that run through Volumes VII, VIII, and IX.
6 Notes and Caveats
- A control addressed in multiple books is intentional: the series separates architecture (closure) from implementation (Volume VI) and, in a few families, layers edge, host, and cloud-plane treatments across different books.
- Enhancement rows (e.g. AC-6(9)) appear separately only where a book cites the enhancement specifically; otherwise coverage is recorded at the base control.
- This index reflects the series as of the Date Code above. Regenerate it after any book’s control tables change by re-running the extraction and merge, then re-rendering this appendix.
7 Appendix — Controls Addressed but Not Yet Closed in the Spine
Of the 149 controls this master table indexes, the compliance spine carries a machine-checked closure for 53. The 96 below are addressed somewhere in the series but have no spine closure yet — no generated authorities row, no evidence slot, no KSI binding, and nothing for the drift gate to check. They are the back-fill queue.
What this table is not. It is the difference between this book’s hand-maintained index and the spine — not a gap analysis against the FedRAMP Moderate baseline. A control absent from both is invisible here: the series does not carry an authoritative Moderate control list, so “addressed nowhere” cannot be enumerated from repo data. Read this as “claimed in prose, not yet proven by the spine” — the larger question of baseline completeness is the SSP’s, and is open (see the Vol 0 Book 00 residual-risk section).
| Family | Not yet closed |
|---|---|
| AC | 9 |
| AT | 7 |
| AU | 6 |
| CA | 3 |
| CM | 1 |
| CP | 15 |
| IA | 6 |
| IR | 4 |
| MP | 4 |
| PL | 1 |
| PM | 9 |
| PT | 6 |
| RA | 3 |
| SA | 2 |
| SC | 8 |
| SI | 4 |
| SR | 8 |
| Total | 96 |
| Control | Title | Family | Addressed in (this book’s index) |
|---|---|---|---|
| AC-2(13) | Account Management — Disable Accounts for High-Risk Individuals | AC | Vol VI Bk 04 |
| AC-6(1) | Least Privilege — Authorize Access to Security Functions | AC | Vol III Bk 01 |
| AC-6(2) | Least Privilege — Non-Privileged Access for Nonsecurity Functions | AC | Vol III Bk 01 |
| AC-6(5) | Least Privilege — Privileged Accounts | AC | Vol III Bk 01 |
| AC-6(9) | Least Privilege — Log Use of Privileged Functions | AC | Vol III Bk 01, Vol VI Bk 03 |
| AC-6(10) | Least Privilege — Prohibit Non-Privileged Users from Executing Privileged Functions | AC | Vol III Bk 01 |
| AC-7 | Unsuccessful Logon Attempts | AC | Vol VI Bk 03 |
| AC-11 | Device Lock | AC | Vol III Bk 01 |
| AC-12 | Session Termination | AC | Vol III Bk 01, Vol VI Bk 03, Vol VI Bk 04 |
| AT-2 | Literacy Training and Awareness | AT | Vol IV Bk 05, Vol V Bk 01, Vol V Bk 02, Vol V Bk 03 |
| AT-2(1) | Literacy Training and Awareness — Practical Exercises | AT | Vol IV Bk 05 |
| AT-2(2) | Literacy Training and Awareness — Insider Threat | AT | Vol IV Bk 05 |
| AT-3 | Role-based Training | AT | Vol IV Bk 05, Vol V Bk 01, Vol V Bk 02, Vol V Bk 03 |
| AT-3(3) | Role-based Training — Practical Exercises | AT | Vol IV Bk 05 |
| AT-3(5) | Role-based Training — Processing Personally Identifiable Information | AT | Vol IV Bk 05 |
| AT-4 | Training Records | AT | Vol IV Bk 05 |
| AU-6(4) | Central Review and Analysis | AU | Vol III Bk 06 |
| AU-7 | Audit Record Reduction and Report Generation | AU | Vol III Bk 06 |
| AU-8 | Time Stamps | AU | Vol III Bk 06 |
| AU-9 | Protection of Audit Information | AU | Vol II Bk 03 |
| AU-10 | Non-repudiation | AU | Vol III Bk 05, Vol VI Bk 05 |
| AU-11 | Audit Record Retention | AU | Vol III Bk 06 |
| CA-6 | Authorization | CA | Vol IV Bk 06 |
| CA-7(1) | Continuous Monitoring — Independent Assessment | CA | Vol IV Bk 06 |
| CA-7(3) | Continuous Monitoring — Trend Analyses | CA | Vol IV Bk 06 |
| CM-7(1) | Least Functionality — Periodic Review | CM | Vol III Bk 02 |
| CP-2 | Contingency Plan | CP | Vol IV Bk 01 |
| CP-2(1) | Coordinate with Related Plans | CP | Vol IV Bk 01 |
| CP-2(8) | Identify Critical Assets | CP | Vol IV Bk 01 |
| CP-3 | Contingency Training | CP | Vol IV Bk 01, Vol IV Bk 05 |
| CP-4 | Contingency Plan Testing | CP | Vol IV Bk 01 |
| CP-4(1) | Coordinate with Related Plans | CP | Vol IV Bk 01 |
| CP-6 | Alternate Storage Site | CP | Vol IV Bk 01 |
| CP-6(1) | Separation from Primary Site | CP | Vol IV Bk 01 |
| CP-7 | Alternate Processing Site | CP | Vol IV Bk 01 |
| CP-7(1) | Separation from Primary Site | CP | Vol IV Bk 01 |
| CP-7(3) | Priority of Service | CP | Vol IV Bk 01 |
| CP-8 | Telecommunications Services | CP | Vol IV Bk 01 |
| CP-8(1) | Priority of Service Provisions | CP | Vol IV Bk 01 |
| CP-9 | System Backup | CP | Vol II Bk 03, Vol IV Bk 01 |
| CP-10 | System Recovery and Reconstitution | CP | Vol II Bk 03, Vol IV Bk 01 |
| IA-2(1) | Identification and Authentication (Organizational Users) — Multi-Factor Authentication to Privileged Accounts | IA | Vol I Bk 03 |
| IA-2(2) | Identification and Authentication (Organizational Users) — Multi-Factor Authentication to Non-Privileged Accounts | IA | Vol I Bk 03 |
| IA-3(1) | Device Identification and Authentication — Cryptographic Bidirectional Authentication | IA | Vol I Bk 02 |
| IA-5(1) | Authenticator Management — Password-Based Authentication | IA | Vol II Bk 01 |
| IA-9 | Service Identification and Authentication | IA | Vol I Bk 01 |
| IA-11 | Re-Authentication | IA | Vol III Bk 01, Vol VI Bk 02 |
| IR-2 | Incident Response Training | IR | Vol IV Bk 05 |
| IR-4 | Incident Handling | IR | Vol I Bk 01, Vol III Bk 06, Vol VI Bk 04 |
| IR-6 | Incident Reporting | IR | Vol III Bk 06, Vol VI Bk 04 |
| IR-8 | Incident Response Plan | IR | Vol III Bk 06 |
| MP-2 | Media Access | MP | Vol III Bk 05, Vol VI Bk 05 |
| MP-3 | Media Marking | MP | Vol III Bk 05, Vol VI Bk 05 |
| MP-4 | Media Storage | MP | Vol III Bk 05, Vol VI Bk 05 |
| MP-5 | Media Transport | MP | Vol III Bk 05, Vol VI Bk 05 |
| PL-8 | Security and Privacy Architectures | PL | Vol I Bk 01 |
| PM-1 | Information Security Program Plan | PM | Vol IV Bk 03 |
| PM-2 | Information Security Program Leadership Role | PM | Vol IV Bk 03 |
| PM-5 | System Inventory | PM | Vol IV Bk 03 |
| PM-7 | Enterprise Architecture | PM | Vol IV Bk 03 |
| PM-9 | Risk Management Strategy | PM | Vol IV Bk 03 |
| PM-11 | Mission and Business Process Definition | PM | Vol IV Bk 03 |
| PM-14 | Testing, Training, and Monitoring | PM | Vol IV Bk 03 |
| PM-15 | Security and Privacy Groups and Associations | PM | Vol IV Bk 03 |
| PM-30 | Supply Chain Risk Management Strategy | PM | Vol IV Bk 03 |
| PT-1 | Policy and Procedures | PT | Vol IV Bk 04 |
| PT-2 | Authority to Process Personally Identifiable Information | PT | Vol IV Bk 04 |
| PT-3 | Personally Identifiable Information Processing Purposes | PT | Vol IV Bk 04 |
| PT-4 | Consent | PT | Vol IV Bk 04 |
| PT-5 | Privacy Notice | PT | Vol IV Bk 04 |
| PT-7 | Specific Categories of Personally Identifiable Information | PT | Vol IV Bk 04 |
| RA-3 | Risk Assessment | RA | Vol IV Bk 06 |
| RA-5(2) | Vulnerability Monitoring and Scanning — Update Vulnerabilities to Be Scanned | RA | Vol III Bk 02 |
| RA-5(5) | Vulnerability Monitoring and Scanning — Privileged Access | RA | Vol III Bk 02 |
| SA-8 | Security and Privacy Engineering Principles | SA | Vol II Bk 03 |
| SA-15 | Development Process, Standards, and Tools | SA | Vol IV Bk 06 |
| SC-5 | Denial-of-Service Protection | SC | Vol II Bk 03 |
| SC-7(3) | Boundary Protection — Access Points | SC | Vol I Bk 02 |
| SC-7(5) | Boundary Protection — Deny by Default — Allow by Exception | SC | Vol I Bk 02 |
| SC-7(7) | Boundary Protection — Split Tunneling for Remote Devices | SC | Vol I Bk 06 |
| SC-12 | Cryptographic Key Establishment and Management | SC | Vol I Bk 03, Vol III Bk 05, Vol VI Bk 05 |
| SC-12(1) | Availability | SC | Vol III Bk 05 |
| SC-13 | Cryptographic Protection | SC | Vol III Bk 05 |
| SC-28 | Protection of Information at Rest | SC | Vol II Bk 03, Vol III Bk 05, Vol VI Bk 05 |
| SI-4(2) | Automated Tools and Mechanisms for Real-time Analysis | SI | Vol III Bk 06 |
| SI-4(4) | Inbound and Outbound Communications Traffic | SI | Vol III Bk 06 |
| SI-4(7) | Automated Response to Suspicious Events | SI | Vol III Bk 06 |
| SI-5 | Security Alerts, Advisories, and Directives | SI | Vol III Bk 02 |
| SR-1 | Policy and Procedures | SR | Vol IV Bk 02 |
| SR-2 | Supply Chain Risk Management Plan | SR | Vol IV Bk 02 |
| SR-3 | Supply Chain Controls and Processes | SR | Vol IV Bk 02 |
| SR-5 | Acquisition Strategies, Tools, and Methods | SR | Vol IV Bk 02 |
| SR-6 | Supplier Assessments and Reviews | SR | Vol IV Bk 02 |
| SR-8 | Notification Agreements | SR | Vol IV Bk 02 |
| SR-10 | Inspection of Systems or Components | SR | Vol IV Bk 02 |
| SR-11 | Component Authenticity | SR | Vol IV Bk 02 |