{
  "_comment": "Requirement rows for Book 19, Chapter 10's runbook. Controls are NIST SP 800-53 Rev. 5 at the Moderate baseline; KSI IDs are the FedRAMP 20x indicators the workbook already maps to those controls (Book 13, Appendix A; Book 04, Chapter 10; Book 02, Chapter 10), cited for alignment with what the cloud providers report, not as agency reporting. A row is evidenced by the latest evidence record for its step at its stage. evidence.py prints the chapter's tables from this file.",
  "schema": "adm-requirements/1",
  "rows": [
    {"id": "R-PF-1", "stage": "both", "step": "preflight", "requirement": "CM-3(2) Testing, Validation, and Documentation of Changes", "does": "Checks the settings, kits, identities and cloud before any change, dry and live", "controls": ["CM-3(2)"], "ksis": ["KSI-CMT-VTD", "KSI-CMT-LMC"], "evidence": "preflight.json (dry and live); the preflight evidence record"},
    {"id": "R-PF-2", "stage": "both", "step": "preflight", "requirement": "IA-5 for non-user accounts; AC-6 Least Privilege", "does": "Refuses secrets in the settings file; three certificate identities with only what each step needs", "controls": ["IA-5", "AC-6"], "ksis": ["KSI-IAM-SNU", "KSI-IAM-ELP"], "evidence": "preflight.json rows PF-02 and PF-05; the identities' permission grants in the change record"},
    {"id": "R-BL-1", "stage": "both", "step": "baseline", "requirement": "CM-2 Baseline Configuration; CA-7 Continuous Monitoring", "does": "Records the tenant's state before the change with the read-only validation kit", "controls": ["CM-2", "CA-7"], "ksis": ["KSI-CMT-RMV", "KSI-MLA-EVC", "KSI-SVC-ACM"], "evidence": "vk-before run folder and its manifest"},
    {"id": "R-BL-2", "stage": "both", "step": "baseline", "requirement": "CISA BOD 25-01 required SCuBA policies; AC-3 Access Enforcement", "does": "Exports Conditional Access before the change, so the after export shows the required policies untouched", "controls": ["AC-3"], "ksis": ["KSI-IAM-ELP"], "evidence": "ca-before export", "mandates": ["BOD 25-01"]},
    {"id": "R-HR-1", "stage": "both", "step": "hr", "requirement": "AC-2 Account Management", "does": "Creates and updates accounts only from HR records, five first, through the middleware's checks", "controls": ["AC-2"], "ksis": ["KSI-IAM-AAM"], "evidence": "hr-dryrun and batch provenance.json, apply-results.json, the provisioning log extract"},
    {"id": "R-HR-2", "stage": "both", "step": "hr", "requirement": "CM-3(2); CM-8 System Component Inventory", "does": "Dry run before sending; every record matched on the person key or quarantined", "controls": ["CM-3(2)", "CM-8"], "ksis": ["KSI-CMT-VTD", "KSI-PIY-GIV"], "evidence": "smoke-hr-dryrun/smoke-report.json (SM-07, SM-08)"},
    {"id": "R-DG-1", "stage": "both", "step": "rules", "requirement": "AC-2; AC-3; CM-3(2)", "does": "Groups created paused, every rule tested against named users before processing starts", "controls": ["AC-2", "AC-3", "CM-3(2)"], "ksis": ["KSI-IAM-AAM", "KSI-IAM-ELP", "KSI-CMT-VTD"], "evidence": "dr-check-results.json, dr-evaluate-differences.txt (empty)"},
    {"id": "R-LCW-1", "stage": "both", "step": "lcw", "requirement": "AC-2 Account Management (leaver first)", "does": "The leaver workflow is created disabled, checked, and run on demand for one user", "controls": ["AC-2"], "ksis": ["KSI-IAM-AAM"], "evidence": "lcw-workflow.json, lcw-run.json"},
    {"id": "R-GPO-1", "stage": "both", "step": "gpo", "requirement": "CM-6 Configuration Settings; CM-3 Configuration Change Control", "does": "Intune policies from reviewed JSON, dry run first; GPO links disabled, never deleted", "controls": ["CM-6", "CM-3"], "ksis": ["KSI-CMT-LMC", "KSI-CMT-RMV", "KSI-SVC-ACM"], "evidence": "gpc-apply/sync-record.json; GPO link states before and after"},
    {"id": "R-GPO-2", "stage": "both", "step": "gpo", "requirement": "OMB M-22-09 device inventory and device signal", "does": "Device settings move to Intune, which holds the managed device inventory", "controls": ["CM-8"], "ksis": ["KSI-PIY-GIV"], "evidence": "the Intune assignment and the test device's settings", "mandates": ["M-22-09"]},
    {"id": "R-MC-1", "stage": "both", "step": "mc", "requirement": "CM-2; CM-2(2) Automation Support; CM-6", "does": "Audit assignment before apply and monitor, from the release registry", "controls": ["CM-2", "CM-2(2)", "CM-6"], "ksis": ["KSI-CMT-RMV", "KSI-SVC-ACM", "KSI-MLA-EVC"], "evidence": "both provenance.json files; mc-audit-state.json"},
    {"id": "R-MC-2", "stage": "both", "step": "mc", "requirement": "SI-7 Software, Firmware, and Information Integrity", "does": "The published package's hash is the built package's hash", "controls": ["SI-7"], "ksis": ["KSI-SVC-VRI"], "evidence": "provenance.json package SHA-256 and the guest assignment's contentHash"},
    {"id": "R-ARC-1", "stage": "both", "step": "arc", "requirement": "CM-8; AC-6; CM-3(2)", "does": "Servers onboard by wave with both owners' tags, check mode first, the control node holding only the onboarding role", "controls": ["CM-8", "AC-6", "CM-3(2)"], "ksis": ["KSI-PIY-GIV", "KSI-IAM-ELP", "KSI-CMT-VTD"], "evidence": "the wave plan, the check-mode and connect output, the role assignment"},
    {"id": "R-DR-1", "stage": "both", "step": "drift", "requirement": "CA-7; AU-2 Event Logging; IA-5 for non-user accounts", "does": "A scheduled read-only comparison, signed in with a federated credential and no secret", "controls": ["CA-7", "AU-2", "IA-5"], "ksis": ["KSI-MLA-EVC", "KSI-MLA-LET", "KSI-IAM-SNU"], "evidence": "workflow_lint output; the first evidence package"},
    {"id": "R-DR-2", "stage": "production", "step": "drift", "requirement": "AU-9 Protection of Audit Information", "does": "Evidence written once to a container with a locked retention policy", "controls": ["AU-9"], "ksis": ["KSI-MLA-OSM"], "evidence": "the locked retention policy (az storage container immutability-policy show)"},
    {"id": "R-SM-1", "stage": "both", "step": "smoke", "requirement": "CM-4(2) Verification of Controls; CA-7", "does": "After the change, the gates' checks are read again and the answer is go or no-go", "controls": ["CM-4(2)", "CA-7"], "ksis": ["KSI-CMT-LMC", "KSI-CMT-VTD", "KSI-MLA-EVC"], "evidence": "smoke/smoke-report.json and vk-after"},
    {"id": "R-EV-1", "stage": "both", "step": "package", "requirement": "AU-9; SI-7", "does": "One evidence package with a SHA-256 per file, verified", "controls": ["AU-9", "SI-7"], "ksis": ["KSI-MLA-OSM", "KSI-SVC-VRI"], "evidence": "the package, its SHA256SUMS and the verify output"},
    {"id": "R-RB-1", "stage": "both", "step": "rollback", "requirement": "CM-3 Configuration Change Control", "does": "Every change recorded with its rollback; the rollback written newest first and, in the test stage, run", "controls": ["CM-3"], "ksis": ["KSI-CMT-LMC", "KSI-CMT-RVP"], "evidence": "deploy-record.json, the rollback scripts, the rollback transcripts"},
    {"id": "R-PR-1", "stage": "production", "step": "promotion", "requirement": "CM-3 and CM-3(4); AC-5 Separation of Duties; FedRAMP agency use of the cloud service", "does": "Promotion only on a live passing test stage, its evidence check, and two approvers; the tenant runs on the provider's FedRAMP authorization", "controls": ["CM-3", "CM-3(4)", "AC-5"], "ksis": ["KSI-CMT-RVP", "KSI-PIY-RIS"], "evidence": "preflight.json PF-10; the test evidence-check.json; the approvals", "mandates": ["FedRAMP agency use"]},
    {"id": "R-WV-1", "stage": "production", "step": "waves", "requirement": "CM-3; AC-2; CM-6", "does": "Each wave by attribute query, leaver first, smoke-tested before the next", "controls": ["CM-3", "AC-2", "CM-6"], "ksis": ["KSI-CMT-LMC", "KSI-IAM-AAM", "KSI-SVC-ACM"], "evidence": "smoke-wave-*/smoke-report.json per wave"},
    {"id": "R-MO-1", "stage": "production", "step": "monitor", "requirement": "CA-7; SI-4 System Monitoring", "does": "Seven days of chained, verified drift packages per wave", "controls": ["CA-7", "SI-4"], "ksis": ["KSI-MLA-EVC", "KSI-MLA-RVL"], "evidence": "the daily packages and their verify output"}
  ]
}
