Frameworks / FedRAMP Moderate / SI-5 FedRAMP Moderate
SI - System and Information Integrity
FedRAMP Moderate SI-5: Security Alerts, Advisories, and Directives Receive alerts/advisories/directives from FedRAMP-defined external organizations (US-CERT, CISA); generate internal; disseminate.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 48 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
5.24 Information security incident management planning and preparation 5.5 Contact with authorities 5.6 Contact with special interest groups 5.7 Threat intelligence 8.16 Monitoring activities 5.24 Information security incident management planning and preparation 5.5 Contact with authorities 5.6 Contact with special interest groups 5.7 Threat intelligence 8.16 Monitoring activities NIST-CSF-DE.AE-06 Information on adverse events is provided to authorized staff and tools NIST-CSF-DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis NIST-CSF-ID.RA-02 Cyber threat intelligence is received from information sharing forums and sources NIST-CSF-RS.CO-03 Information is shared with designated internal and external stakeholders 10.7.1 10.7.1 Service providers detect critical control failures (superseded) 12.10.5 12.10.5 Plan covers alerts from security monitoring systems 6.3.1 6.3.1 Vulnerability identification and risk ranking SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents C5-OIS-05 Contact with Relevant Government Agencies and Interest Groups C5-PSS-03 Online Register of Known Vulnerabilities CIS-13.1 Centralize Security Event Alerting CIS-7.1 Establish and Maintain a Vulnerability Management Process CCM-GRC-08 Special Interest Groups CCM-TVM-01 Threat and Vulnerability Management Policy and Procedures Art.21.3 Take account of supplier-specific vulnerabilities and of Union coordinated supply chain risk assessments Art.23.2 Tell affected service recipients about significant cyber threats and the remedies open to them 3.11.1e Threat-Aware Risk Assessment 3.14.6e Use Threat Indicator Information for Detection ANSSI-HYG-35 Anticipate the End of Maintenance of Software and Systems CPS234-P17 Active Maintenance of Capability Against Change SEC01-BP04 Stay up to date with security threats and recommendations ASBv3-IR-2 Preparation - setup incident notification 161R1-SI-5 Security Alerts, Advisories, and Directives 03.14.03 Security Alerts, Advisories, and Directives NIST800-SI-5 SI-5 Security Alerts, Advisories, and Directives SI-5 SI-5 Security Alerts, Advisories, and Directives SI-5 SI-5 Security Alerts, Advisories, and Directives SI-5 SI-5 Security Alerts, Advisories, and Directives CE-SU.3 Critical and High Updates within 14 Days Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in SI - System and Information Integrity You are reading one control. How much of FedRAMP Moderate have you already done? FedRAMP Moderate SI-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of FedRAMP Moderate your existing evidence covers. Hold ISO 27002:2022 and 182 of 323 FedRAMP Moderate controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 348 were rejected on the ISO 27002:2022 pair alone.
Query this from an agent The graph holds this control, the 48 it maps to, and the evidence behind each claim, over MCP and REST.