FedRAMP Rev 5 K.1: FRR1 to FRR4: documenting cryptographic module use

What does K.1 require?

Providers state in their SI-2 responses whether their default position is update streams (latest patches regardless of validation status) or validated module streams, determined by a risk evaluation of the module's use, exploitation likelihood and impact and mitigations (FRR1); document in SSP Appendix Q the cryptographic use cases, module names and versions for modules inherited from a FedRAMP authorized service, noting inheritance, whether the leveraged service is configured per customer responsibilities such as FIPS mode, and the inherited system's FedRAMP identifier in place of the CMVP identifier (FRR2); document the same for non-inherited modules, with any unvalidated module recorded at offering, component and cryptographic function level with its potential federal impact (FRR3); and provide a mechanism to use secure modules by default and document in the customer responsibility matrix any customer configuration needed to use a module securely, including inherited ones, considering mode-of-operation differences such as FIPS mode that an update may change (FRR4).