FedRAMP Rev 5
Cryptographic module selection and use (FedRAMP Board policy of January 2025, requirements FRR1 to FRR21) – FedRAMP Rev 5

FedRAMP Rev 5 K.5: FRR15 to FRR17: assessor duties

What does K.5 require?

Independent assessors perform a comprehensive examination under SP 800-53A where unvalidated modules not derived from a validated module's update stream meet a control requirement, ensuring the modules and mitigations operate as intended (FRR15); verify that all cryptographic use cases and modules are accurately documented in SSP Appendix Q and verify CMVP submission artifacts for update-stream modules (FRR16); and verify that cryptographic POA&Ms are created when required, updated regularly and not overdue (FRR17).

Maintained by Gerard BlokdykControl text last updated

Other controls in Cryptographic module selection and use (FedRAMP Board policy of January 2025, requirements FRR1 to FRR21) – FedRAMP Rev 5

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Rev 5 controls