FedRAMP Moderate

United States

18 domains

323 controls

FedRAMP Moderate baseline. Federal cloud service authorization built on NIST SP 800-53 Rev 5 with FedRAMP-specific parameters.

Verified

FedRAMP Moderate is a compliance framework from United States with 18 domains and 323 controls that map to 279 other frameworks. The largest domains are AC - Access Control (43 controls), SC - System and Communications Protection (29 controls), CM - Configuration Management (27 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (18)

AC - Access Control

43 controls

Controls in the AC - Access Control domain of FedRAMP Moderate — 43 controls
Code	Title	Description
AC-1	Policy and Procedures	Develop, document, disseminate and review the policy for access control, and its procedures, on the FedRAMP-defined cade...
AC-11	Device Lock	Prevent further access by initiating device lock after 15 minutes inactivity (FedRAMP) or upon user request.
AC-11(1)	Device Lock \| Pattern-hiding Displays (AC-11(1))	Device Lock \| Pattern-hiding Displays. Conceal, via the device lock, information previously visible on the display with...
AC-12	Session Termination	Automatically terminate user session after FedRAMP-defined conditions (idle timeout, trigger events).
AC-14	Permitted Actions Without Identification or Authentication	Identify and document actions allowed without identification or authentication.
AC-17	Remote Access	Establish usage restrictions, configuration requirements, and authorize remote access prior to allowing.
AC-17(1)	Monitoring and Control	Employ automated mechanisms to monitor and control remote access.
AC-17(2)	Protection of Confidentiality and Integrity Using Encryption	Implement cryptographic mechanisms to protect remote access sessions; FIPS-validated.
AC-17(3)	Managed Access Control Points	Route remote accesses through FedRAMP-defined number of managed network access control points.
AC-17(4)	Privileged Commands and Access	Authorize execution of privileged commands and access to security-relevant information via remote access only for define...
AC-18	Wireless Access	Establish configuration requirements, usage restrictions, authorize wireless access.
AC-18(1)	Authentication and Encryption	Protect wireless access using authentication and encryption (WPA2/3 Enterprise minimum).
AC-18(3)	Wireless Access \| Disable Wireless Networking (AC-18(3))	Wireless Access \| Disable Wireless Networking. Disable, when not intended for use, wireless networking capabilities embe...
AC-19	Access Control for Mobile Devices	Establish configuration requirements and usage restrictions for mobile devices.
AC-19(5)	Full Device or Container-Based Encryption	Employ full device or container-based encryption on mobile devices.
AC-2	Account Management	Manage accounts; review at least monthly for privileged, every six months for non-privileged (FedRAMP); notify within Fe...
AC-2(1)	Automated System Account Management	Support account management via automated mechanisms; required at HIGH baseline.
AC-2(12)	Account Monitoring for Atypical Usage	Monitor accounts for atypical use; report anomalies to defined personnel.
AC-2(13)	Disable Accounts for High-Risk Individuals	Disable accounts of users posing significant risk within FedRAMP-defined timeframe (1 hour).
AC-2(2)	Automated Temporary and Emergency Account Management	Automatically disable temporary and emergency accounts within FedRAMP-defined timeframe (no longer than 24 hours).
AC-2(3)	Disable Accounts	Disable accounts within FedRAMP-defined timeframe when no longer required, terminated, or inactive (35 days inactive).
AC-2(4)	Automated Audit Actions	Automatically audit account creation, modification, enabling, disabling, removal; notify defined personnel.
AC-2(5)	Inactivity Logout	Require users to log out when inactivity exceeds FedRAMP-defined period (15 minutes for non-mobile, 30 for mobile).
AC-2(7)	Privileged User Accounts	Establish and administer privileged accounts per role-based scheme; monitor role assignments; revoke when no longer need...
AC-2(9)	Restrictions on Use of Shared and Group Accounts	Only permit shared/group accounts when meeting FedRAMP-defined conditions; document and approve.
AC-20	Use of External Systems	Establish terms and conditions for use of external systems; prohibit unless authorized.
AC-20(1)	Limits on Authorized Use	Permit use of external systems only after verifying security/privacy controls or approved connection agreement.
AC-20(2)	Portable Storage Devices Restricted Use	Restrict use of organization-controlled portable storage on external systems.
AC-21	Information Sharing	Enable authorized users to determine whether access authorizations match sharing restrictions.
AC-22	Publicly Accessible Content	Designate users authorized to post; train them; review content quarterly for nonpublic information.
AC-3	Access Enforcement	Enforce approved authorizations for logical access in accordance with policy.
AC-4	Information Flow Enforcement	Enforce approved information flow control policies between connected systems and within the system.
AC-4(21)	Physical or Logical Separation of Information Flows	Separate information flows logically or physically using FedRAMP-defined mechanisms.
AC-5	Separation of Duties	Identify and document duties requiring separation; define access authorizations to support.
AC-6	Least Privilege	Employ least privilege; allow only authorized access necessary to accomplish assigned tasks.
AC-6(1)	Authorize Access to Security Functions	Authorize access for FedRAMP-defined personnel to security functions and security-relevant information.
AC-6(10)	Prohibit Non-Privileged Users from Executing Privileged Functions	Prevent non-privileged users from executing privileged functions.
AC-6(2)	Non-Privileged Access for Nonsecurity Functions	Require privileged users to use non-privileged accounts for nonsecurity functions.
AC-6(5)	Privileged Accounts	Restrict privileged accounts to FedRAMP-defined personnel or roles.
AC-6(7)	Review of User Privileges	Review privileges at least quarterly (FedRAMP) and reassign or remove as needed.
AC-6(9)	Log Use of Privileged Functions	Log execution of privileged functions.
AC-7	Unsuccessful Logon Attempts	Enforce limit of 3 consecutive invalid logon attempts within 15 minutes (FedRAMP); lock for 30 min or until released.
AC-8	System Use Notification	Display approved system use notification/banner before granting access; FedRAMP requires specific language.

AT - Awareness and Training

6 controls

Controls in the AT - Awareness and Training domain of FedRAMP Moderate — 6 controls
Code	Title	Description
AT-1	Policy and Procedures	Develop, document, disseminate and review the policy for awareness and training, and its procedures, on the FedRAMP-defi...
AT-2	Literacy Training and Awareness	Provide security awareness training within FedRAMP-defined timeframe of onboarding, on system change, and at least annua...
AT-2(2)	Insider Threat	Include insider threat recognition and reporting in awareness training.
AT-2(3)	Social Engineering and Mining	Include social engineering and social mining recognition in training.
AT-3	Role-Based Training	Provide role-based security training to personnel with significant security responsibilities before authorizing access a...
AT-4	Training Records	Document and monitor security training; retain records for FedRAMP-defined period (5 years).

AU - Audit and Accountability

16 controls

Controls in the AU - Audit and Accountability domain of FedRAMP Moderate — 16 controls
Code	Title	Description
AU-1	Policy and Procedures	Develop, document, disseminate and review the policy for audit and accountability, and its procedures, on the FedRAMP-de...
AU-11	Audit Record Retention	Retain audit records for at least one year (FedRAMP minimum) with 90 days immediately accessible online.
AU-12	Audit Record Generation	Provide audit record generation capability on all system components specified in AU-2.
AU-2	Event Logging	Identify event types selected for logging including FedRAMP minimum list; review and update at least annually.
AU-3	Content of Audit Records	Audit records must contain: type, when, where, source, outcome, identity associated.
AU-3(1)	Additional Audit Information	Generate audit records containing FedRAMP-defined additional information (session, host, full text of executed commands)...
AU-4	Audit Log Storage Capacity	Allocate audit log storage capacity to accommodate FedRAMP-defined retention period.
AU-5	Response to Audit Logging Process Failures	Alert defined personnel on audit failure within FedRAMP timeframe; take defined action (overwrite oldest, shutdown, stop...
AU-6	Audit Record Review, Analysis, and Reporting	Review and analyze audit records at least weekly (FedRAMP); report findings to defined personnel.
AU-6(1)	Automated Process Integration	Integrate audit review with automated mechanisms (SIEM).
AU-6(3)	Correlate Audit Record Repositories	Analyze and correlate audit records across different repositories.
AU-7	Audit Record Reduction and Report Generation	Provide capability for audit record reduction and on-demand report generation.
AU-7(1)	Automatic Processing	Process audit records for events of interest based on defined criteria.
AU-8	Time Stamps	Use internal system clocks; record timestamps with FedRAMP-defined granularity (1 second), UTC or known offset.
AU-9	Protection of Audit Information	Protect audit information and tools from unauthorized access, modification, deletion.
AU-9(4)	Access by Subset of Privileged Users	Authorize access to audit functionality only to subset of privileged users.

CA - Assessment, Authorization, and Monitoring

14 controls

Controls in the CA - Assessment, Authorization, and Monitoring domain of FedRAMP Moderate — 14 controls
Code	Title	Description
CA-1	Policy and Procedures	Develop, document, disseminate and review the policy for assessment, authorization and monitoring, and its procedures, o...
CA-2	Control Assessments	Assess controls annually (FedRAMP); third-party assessor (3PAO) required; produce SAR.
CA-2(1)	Independent Assessors	Employ independent assessors; FedRAMP-accredited 3PAO required.
CA-2(3)	Control Assessments \| Leveraging Results from External Organizations (CA-2(3))	Control Assessments \| Leveraging Results from External Organizations. Leverage the results of control assessments perfor...
CA-3	Information Exchange	Approve and manage exchange of information with external systems using ISA, MOU, contract; review annually.
CA-5	Plan of Action and Milestones	Develop POAM; update at least monthly (FedRAMP); track remediation timelines (HIGH 30 days, MOD 90).
CA-6	Authorization	Senior official authorizes system; reauthorize every three years or upon significant change.
CA-7	Continuous Monitoring	Establish continuous monitoring strategy with FedRAMP-defined metrics, monitoring frequencies, ongoing assessments.
CA-7(1)	Independent Assessment	Employ independent assessors for ongoing monitoring; FedRAMP 3PAO annual.
CA-7(4)	Continuous Monitoring \| Risk Monitoring (CA-7(4))	Continuous Monitoring \| Risk Monitoring. Ensure risk monitoring is an integral part of the continuous monitoring strateg...
CA-8	Penetration Testing	Conduct penetration testing annually on FedRAMP-defined systems and components.
CA-8(1)	Penetration Testing \| Independent Penetration Testing Agent or Team (CA-8(1))	Penetration Testing \| Independent Penetration Testing Agent or Team. Employ an independent penetration testing agent or...
CA-8(2)	Penetration Testing \| Red Team Exercises (CA-8(2))	Penetration Testing \| Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to...
CA-9	Internal System Connections	Authorize internal connections of components to system; document interface characteristics.

CM - Configuration Management

27 controls

Controls in the CM - Configuration Management domain of FedRAMP Moderate — 27 controls
Code	Title	Description
CM-1	Policy and Procedures	Develop, document, disseminate and review the policy for configuration management, and its procedures, on the FedRAMP-de...
CM-10	Software Usage Restrictions	Use software in accordance with contracts and copyright laws; track licenses; document peer-to-peer file sharing control...
CM-11	User-Installed Software	Establish policies governing installation of software by users; enforce; monitor compliance.
CM-12	Information Location (CM-12)	Information Location. a. Identify and document the location of [Assignment: organization-defined information] and the sp...
CM-12(1)	Information Location \| Automated Tools to Support Information Location (CM-12(1))	Information Location \| Automated Tools to Support Information Location. Use automated tools to identify [Assignment: org...
CM-2	Baseline Configuration	Develop and maintain baseline configurations; review and update annually (FedRAMP) and when required.
CM-2(2)	Automation Support for Accuracy and Currency	Maintain baseline currency via automated mechanisms.
CM-2(3)	Retention of Previous Configurations	Retain FedRAMP-defined number of previous baseline configurations (3) to support rollback.
CM-2(7)	Configure Systems and Components for High-Risk Areas	Issue systems/devices with FedRAMP-defined security safeguards to individuals traveling to high-risk locations.
CM-3	Configuration Change Control	Determine, document, and approve changes; track, review, audit; CAB or equivalent; analyze security impact.
CM-3(2)	Testing, Validation, and Documentation of Changes	Test, validate, and document changes before implementing on operational system.
CM-3(4)	Security and Privacy Representatives	Require security and privacy representatives on change board for FedRAMP-defined configuration changes.
CM-4	Impact Analyses	Analyze changes to determine potential security/privacy impacts.
CM-4(2)	Impact Analyses \| Verification of Controls (CM-4(2))	Impact Analyses \| Verification of Controls. After system changes, verify that the impacted controls are implemented corr...
CM-5	Access Restrictions for Change	Define, document, approve, enforce physical and logical access restrictions for changes.
CM-5(1)	Access Restrictions for Change \| Automated Access Enforcement and Audit Records (CM-5(1))	Access Restrictions for Change \| Automated Access Enforcement and Audit Records. (a) Enforce access restrictions using [...
CM-5(5)	Access Restrictions for Change \| Privilege Limitation for Production and Operation (CM-5(5))	Access Restrictions for Change \| Privilege Limitation for Production and Operation. (a) Limit privileges to change syste...
CM-6	Configuration Settings	Establish/document configuration settings using checklists; CIS/USGCB/DISA STIG when available; HIGH baseline.
CM-6(1)	Automated Management, Application, and Verification	Manage, apply, and verify configuration settings via automated mechanisms; HIGH only.
CM-7	Least Functionality	Configure system to provide only essential capabilities; prohibit unnecessary functions, services, ports, protocols.
CM-7(1)	Periodic Review	Review system functions, ports, protocols, services at least monthly (FedRAMP); disable as unnecessary.
CM-7(2)	Prevent Program Execution	Prevent program execution according to FedRAMP-defined policies (rules of behavior).
CM-7(5)	Authorized Software Allow-by-Exception	Identify and maintain authorized software list; employ allowlist; review at least annually; HIGH requirement.
CM-8	System Component Inventory	Develop and document inventory of system components; review and update at least monthly (FedRAMP).
CM-8(1)	Updates During Installation and Removal	Update inventory as part of component installations, removals, updates.
CM-8(3)	Automated Unauthorized Component Detection	Employ automated mechanisms to detect unauthorized components at FedRAMP-defined frequency; HIGH only continuous.
CM-9	Configuration Management Plan	Develop, document, implement configuration management plan addressing roles, processes, items under CM, identification s...

CP - Contingency Planning

23 controls

Controls in the CP - Contingency Planning domain of FedRAMP Moderate — 23 controls
Code	Title	Description
CP-1	Policy and Procedures	Develop, document, disseminate and review the policy for contingency planning, and its procedures, on the FedRAMP-define...
CP-10	System Recovery and Reconstitution	Provide for recovery and reconstitution of system to known state within RTO.
CP-10(2)	System Recovery and Reconstitution \| Transaction Recovery (CP-10(2))	System Recovery and Reconstitution \| Transaction Recovery. Implement transaction recovery for systems that are transacti...
CP-2	Contingency Plan	Develop contingency plan; review and update annually (FedRAMP); coordinate with related plans.
CP-2(1)	Coordinate with Related Plans	Coordinate contingency plan with related plans (BCP, DRP, COOP, IRP).
CP-2(3)	Resume Mission and Business Functions	Plan for resumption of mission/business functions within FedRAMP-defined time period after contingency plan activation.
CP-2(8)	Contingency Plan \| Identify Critical Assets (CP-2(8))	Contingency Plan \| Identify Critical Assets. Identify critical system assets supporting [Selection: all; essential] miss...
CP-3	Contingency Training	Provide contingency training to users assigned roles; within FedRAMP timeframe of role assignment and at least annually.
CP-4	Contingency Plan Testing	Test contingency plan at least annually (FedRAMP) using FedRAMP-defined tests; review test results.
CP-4(1)	Coordinate with Related Plans	Coordinate contingency plan testing with related plan testing.
CP-6	Alternate Storage Site	Establish alternate storage site with agreements to permit storage and retrieval of system backup information.
CP-6(1)	Alternate Storage Site \| Separation from Primary Site (CP-6(1))	Alternate Storage Site \| Separation from Primary Site. Identify an alternate storage site that is sufficiently separated...
CP-6(3)	Alternate Storage Site \| Accessibility (CP-6(3))	Alternate Storage Site \| Accessibility. Identify potential accessibility problems to the alternate storage site in the e...
CP-7	Alternate Processing Site	Establish alternate processing site with agreements for resumption of operations within FedRAMP-defined RTO.
CP-7(1)	Alternate Processing Site \| Separation from Primary Site (CP-7(1))	Alternate Processing Site \| Separation from Primary Site. Identify an alternate processing site that is sufficiently sep...
CP-7(2)	Alternate Processing Site \| Accessibility (CP-7(2))	Alternate Processing Site \| Accessibility. Identify potential accessibility problems to alternate processing sites in th...
CP-7(3)	Alternate Processing Site \| Priority of Service (CP-7(3))	Alternate Processing Site \| Priority of Service. Develop alternate processing site agreements that contain priority-of-s...
CP-8	Telecommunications Services	Establish alternate telecommunications services with agreements to permit resumption of system operations.
CP-8(1)	Telecommunications Services \| Priority of Service Provisions (CP-8(1))	Telecommunications Services \| Priority of Service Provisions. (a) Develop primary and alternate telecommunications servi...
CP-8(2)	Telecommunications Services \| Single Points of Failure (CP-8(2))	Telecommunications Services \| Single Points of Failure. Obtain alternate telecommunications services to reduce the likel...
CP-9	System Backup	Conduct backups of user-level, system-level, and security-related documentation; FedRAMP-defined frequency (daily increm...
CP-9(1)	Testing for Reliability and Integrity	Test backup information annually to verify reliability and integrity.
CP-9(8)	System Backup \| Cryptographic Protection (CP-9(8))	System Backup \| Cryptographic Protection. Implement cryptographic mechanisms to prevent unauthorized disclosure and modi...

IA - Identification and Authentication

27 controls

Controls in the IA - Identification and Authentication domain of FedRAMP Moderate — 27 controls
Code	Title	Description
IA-1	Policy and Procedures	Develop, document, disseminate and review the policy for identification and authentication, and its procedures, on the F...
IA-11	Re-Authentication	Require re-authentication when FedRAMP-defined circumstances occur (role change, privilege change, time period elapsed).
IA-12	Identity Proofing (IA-12)	Identity Proofing. a. Identity proof users that require accounts for logical access to systems based on appropriate iden...
IA-12(2)	Identity Proofing \| Identity Evidence (IA-12(2))	Identity Proofing \| Identity Evidence. Require evidence of individual identification be presented to the registration au...
IA-12(3)	Identity Proofing \| Identity Evidence Validation and Verification (IA-12(3))	Identity Proofing \| Identity Evidence Validation and Verification. Require that the presented identity evidence be valid...
IA-12(5)	Identity Proofing \| Address Confirmation (IA-12(5))	Identity Proofing \| Address Confirmation. Require that a [Selection: registration code; notice of proofing] be delivered...
IA-2	Identification and Authentication (Organizational Users)	Uniquely identify and authenticate organizational users and associate identity with processes acting on behalf of users.
IA-2(1)	MFA to Privileged Accounts	Implement MFA for access to privileged accounts; phishing-resistant per FedRAMP.
IA-2(12)	Acceptance of PIV Credentials	Accept and electronically verify Personal Identity Verification credentials.
IA-2(2)	MFA to Non-Privileged Accounts	Implement MFA for non-privileged accounts; phishing-resistant per FedRAMP.
IA-2(5)	Identification and Authentication (Organizational Users) \| Individual Authentication with Group Authentication (IA-2(5))	Identification and Authentication (organizational Users) \| Individual Authentication with Group Authentication. When sha...
IA-2(6)	Identification and Authentication (Organizational Users) \| Access to Accounts: separate Device (IA-2(6))	Identification and Authentication (organizational Users) \| Access to Accounts , separate Device. Implement multi-factor...
IA-2(8)	Access to Accounts Replay Resistant	Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.
IA-3	Device Identification and Authentication	Uniquely identify and authenticate devices before establishing connection.
IA-4	Identifier Management	Manage identifiers; uniquely identify; prevent reuse for FedRAMP-defined period.
IA-4(4)	Identifier Management \| Identify User Status (IA-4(4))	Identifier Management \| Identify User Status. Manage individual identifiers by uniquely identifying each individual as [...
IA-5	Authenticator Management	Manage authenticators; verify identity prior to issuing; establish initial content; protect.
IA-5(1)	Password-Based Authentication	Enforce password complexity per NIST SP 800-63B; minimum 12 characters (FedRAMP); compare against breach lists.
IA-5(2)	Public Key-Based Authentication	Enforce authorized use of public key-based authentication; validate certificates; map identity to account.
IA-5(6)	Protection of Authenticators	Protect authenticators commensurate with security category of information they protect.
IA-5(7)	Authenticator Management \| No Embedded Unencrypted Static Authenticators (IA-5(7))	Authenticator Management \| No Embedded Unencrypted Static Authenticators. Ensure that unencrypted static authenticators...
IA-6	Authentication Feedback	Obscure authentication feedback during authentication process.
IA-7	Cryptographic Module Authentication	Implement authentication to cryptographic modules meeting FIPS 140 (FedRAMP requires FIPS-validated).
IA-8	Identification and Authentication (Non-Organizational Users)	Uniquely identify and authenticate non-organizational users (e.g., federal customers).
IA-8(1)	Identification and Authentication (Non-organizational Users) \| Acceptance of PIV Credentials from Other Agencies (IA-8(1))	Identification and Authentication (non-organizational Users) \| Acceptance of PIV Credentials from Other Agencies. Accept...
IA-8(2)	Identification and Authentication (Non-organizational Users) \| Acceptance of External Authenticators (IA-8(2))	Identification and Authentication (non-organizational Users) \| Acceptance of External Authenticators. (a) Accept only ex...
IA-8(4)	Identification and Authentication (Non-organizational Users) \| Use of Defined Profiles (IA-8(4))	Identification and Authentication (non-organizational Users) \| Use of Defined Profiles. Conform to the following profile...

IR - Incident Response

17 controls

Controls in the IR - Incident Response domain of FedRAMP Moderate — 17 controls
Code	Title	Description
IR-1	Policy and Procedures	Requires an incident response policy and supporting procedures to be developed, documented, disseminated, reviewed and u...
IR-2	Incident Response Training	Requires incident response training for system users consistent with their assigned roles, within a defined period of as...
IR-3	Incident Response Testing	Requires the incident response capability to be tested at a defined frequency using defined tests, to determine its effe...
IR-3(2)	Incident Response Testing \| Coordination with Related Plans (IR-3(2))	Incident Response Testing \| Coordination with Related Plans. Coordinate incident response testing with organizational el...
IR-4	Incident Handling	Implement IR capability for preparation, detection/analysis, containment, eradication, recovery.
IR-4(1)	Automated Incident Handling Processes	Support incident handling via automated mechanisms.
IR-5	Incident Monitoring	Track and document incidents.
IR-6	Incident Reporting	Require personnel to report incidents to organizational authorities within FedRAMP timeframe; report to FedRAMP PMO and...
IR-6(1)	Automated Reporting	Report incidents via automated mechanisms.
IR-6(3)	Incident Reporting \| Supply Chain Coordination (IR-6(3))	Incident Reporting \| Supply Chain Coordination. Provide incident information to the provider of the product or service a...
IR-7	Incident Response Assistance	Provide IR support resource (help desk, support group) for incident handling assistance.
IR-7(1)	Incident Response Assistance \| Automation Support for Availability of Information and Support (IR-7(1))	Incident Response Assistance \| Automation Support for Availability of Information and Support. Increase the availability...
IR-8	Incident Response Plan	Develop and implement IRP; review and update annually; distribute.
IR-9	Information Spillage Response (IR-9)	Information Spillage Response. Respond to information spills by: a. Assigning [Assignment: organization-defined personne...
IR-9(2)	Information Spillage Response \| Training (IR-9(2))	Information Spillage Response \| Training. Provide information spillage response training [Assignment: organization-defin...
IR-9(3)	Information Spillage Response \| Post-spill Operations (IR-9(3))	Information Spillage Response \| Post-spill Operations. Implement the following procedures to ensure that organizational...
IR-9(4)	Information Spillage Response \| Exposure to Unauthorized Personnel (IR-9(4))	Information Spillage Response \| Exposure to Unauthorized Personnel. Employ the following controls for personnel exposed...

MA - Maintenance

10 controls

Controls in the MA - Maintenance domain of FedRAMP Moderate — 10 controls
Code	Title	Description
MA-1	Policy and Procedures	Develop, document, disseminate and review the policy for maintenance, and its procedures, on the FedRAMP-defined cadence...
MA-2	Controlled Maintenance	Schedule, document, review records of maintenance, repair, replacement of components.
MA-3	Maintenance Tools (MA-3)	Maintenance Tools. a. Approve, control, and monitor the use of system maintenance tools; and b. Review previously approv...
MA-3(1)	Maintenance Tools \| Inspect Tools (MA-3(1))	Maintenance Tools \| Inspect Tools. Inspect the maintenance tools used by maintenance personnel for improper or unauthori...
MA-3(2)	Maintenance Tools \| Inspect Media (MA-3(2))	Maintenance Tools \| Inspect Media. Check media containing diagnostic and test programs for malicious code before the med...
MA-3(3)	Maintenance Tools \| Prevent Unauthorized Removal (MA-3(3))	Maintenance Tools \| Prevent Unauthorized Removal. Prevent the removal of maintenance equipment containing organizational...
MA-4	Nonlocal Maintenance	Approve and monitor nonlocal maintenance activities; use strong authentication.
MA-5	Maintenance Personnel	Establish process for authorizing maintenance personnel; maintain list of authorized personnel; supervise unauthorized.
MA-5(1)	Maintenance Personnel \| Individuals Without Appropriate Access (MA-5(1))	Maintenance Personnel \| Individuals Without Appropriate Access. The organization: (a) Implements procedures for the use...
MA-6	Timely Maintenance (MA-6)	Timely Maintenance. Obtain maintenance support and/or spare parts for [Assignment: organization-defined system component...

MP - Media Protection

7 controls

Controls in the MP - Media Protection domain of FedRAMP Moderate — 7 controls
Code	Title	Description
MP-1	Policy and Procedures	Develop, document, disseminate and review the policy for media protection, and its procedures, on the FedRAMP-defined ca...
MP-2	Media Access	Restrict access to FedRAMP-defined types of digital and non-digital media to authorized personnel.
MP-3	Media Marking	Mark system media indicating distribution limitations, handling caveats, security markings.
MP-4	Media Storage	Physically control and securely store FedRAMP-defined types of media within FedRAMP-defined controlled areas.
MP-5	Media Transport	Protect and control media during transport outside controlled areas; maintain accountability; document activities; restr...
MP-6	Media Sanitization	Sanitize media prior to disposal, release, or reuse using FedRAMP-defined methods (NIST SP 800-88).
MP-7	Media Use	Restrict or prohibit use of FedRAMP-defined types of media on FedRAMP-defined systems using safeguards.

PE - Physical and Environmental Protection

19 controls

Controls in the PE - Physical and Environmental Protection domain of FedRAMP Moderate — 19 controls
Code	Title	Description
PE-1	Policy and Procedures	Develop, document, disseminate and review the policy for physical and environmental protection, and its procedures, on t...
PE-10	Emergency Shutoff (PE-10)	Emergency Shutoff. a. Provide the capability of shutting off power to [Assignment: organization-defined system or indivi...
PE-11	Emergency Power (PE-11)	Emergency Power. Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of...
PE-12	Emergency Lighting	Employ and maintain automatic emergency lighting activating on power outage covering emergency exits.
PE-13	Fire Protection	Employ and maintain fire suppression and detection devices independent of energy source.
PE-13(1)	Fire Protection \| Detection Systems: Automatic Activation and Notification (PE-13(1))	Fire Protection \| Detection Systems. Automatic Activation and Notification. Employ fire detection systems that activate...
PE-13(2)	Fire Protection \| Suppression Systems: Automatic Activation and Notification (PE-13(2))	Fire Protection \| Suppression Systems. Automatic Activation and Notification. (a) Employ fire suppression systems that a...
PE-14	Environmental Controls	Maintain temperature and humidity within FedRAMP-defined acceptable levels; monitor at FedRAMP frequency.
PE-15	Water Damage Protection (PE-15)	Water Damage Protection. Protect the system from damage resulting from water leakage by providing master shutoff or isol...
PE-16	Delivery and Removal	Authorize and control system components entering/exiting facility; maintain records.
PE-17	Alternate Work Site	Determine alternate work sites; employ FedRAMP-defined controls at alternate sites; assess effectiveness.
PE-2	Physical Access Authorizations	Develop, approve, maintain list of individuals with authorized facility access; review at least quarterly (FedRAMP).
PE-3	Physical Access Control	Enforce physical access at entry/exit points; verify authorizations; control ingress/egress; maintain audit logs.
PE-4	Access Control for Transmission (PE-4)	Access Control for Transmission. Control physical access to [Assignment: organization-defined system distribution and tr...
PE-5	Access Control for Output Devices (PE-5)	Access Control for Output Devices. Control physical access to output from [Assignment: organization-defined output devic...
PE-6	Monitoring Physical Access	Monitor physical access to facility; review access logs at least weekly (FedRAMP); coordinate review with IR.
PE-6(1)	Monitoring Physical Access \| Intrusion Alarms and Surveillance Equipment (PE-6(1))	Monitoring Physical Access \| Intrusion Alarms and Surveillance Equipment. Monitor physical access to the facility where...
PE-8	Visitor Access Records	Maintain visitor access records for FedRAMP-defined period (1 year); review records monthly (FedRAMP).
PE-9	Power Equipment and Cabling (PE-9)	Power Equipment and Cabling. Protect power equipment and power cabling for the system from damage and destruction

PL - Planning

7 controls

Controls in the PL - Planning domain of FedRAMP Moderate — 7 controls
Code	Title	Description
PL-1	Policy and Procedures	Develop, document, disseminate and review the policy for planning, and its procedures, on the FedRAMP-defined cadence: p...
PL-10	Baseline Selection. Select a control baseline for the system	Baseline Selection. Select a control baseline for the system
PL-11	Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions	Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions
PL-2	System Security and Privacy Plans	Develop SSP that aligns with FedRAMP template; review and update annually.
PL-4	Rules of Behavior	Establish and provide rules describing user responsibilities; receive signed acknowledgement.
PL-4(1)	Rules of Behavior \| Social Media and External Site/Application Usage Restrictions (PL-4(1))	Rules of Behavior \| Social Media and External Site/application Usage Restrictions. Include in the rules of behavior, res...
PL-8	Security and Privacy Architectures	Develop, document, maintain security/privacy architectures; review annually.

PS - Personnel Security

10 controls

Controls in the PS - Personnel Security domain of FedRAMP Moderate — 10 controls
Code	Title	Description
PS-1	Policy and Procedures	Develop, document, disseminate and review the policy for personnel security, and its procedures, on the FedRAMP-defined...
PS-2	Position Risk Designation	Assign risk designation to positions; review and update at least every three years.
PS-3	Personnel Screening	Screen individuals prior to authorizing access; rescreen at FedRAMP frequency per position risk; US citizenship may appl...
PS-3(3)	Personnel Screening \| Information Requiring Special Protective Measures (PS-3(3))	Personnel Screening \| Information Requiring Special Protective Measures. Verify that individuals accessing a system proc...
PS-4	Personnel Termination	Disable access and revoke authenticators within FedRAMP-defined time (same day); conduct exit interview; retrieve proper...
PS-5	Personnel Transfer	Review/confirm ongoing operational need for access when personnel transfer; modify access; notify within FedRAMP timefra...
PS-6	Access Agreements	Develop access agreements; review and update annually; require signature before access.
PS-7	External Personnel Security	Establish personnel security requirements for external providers; require providers to notify within FedRAMP timeframe o...
PS-8	Personnel Sanctions	Employ formal sanctions for personnel failing to comply with security/privacy policies; notify defined personnel within...
PS-9	Position Descriptions (PS-9)	Position Descriptions. Incorporate security and privacy roles and responsibilities into organizational position descript...

RA - Risk Assessment

11 controls

Controls in the RA - Risk Assessment domain of FedRAMP Moderate — 11 controls
Code	Title	Description
RA-1	Policy and Procedures	Develop, document, disseminate and review the policy for risk assessment, and its procedures, on the FedRAMP-defined cad...
RA-2	Security Categorization	Categorize system per FIPS 199; document; review and update annually.
RA-3	Risk Assessment	Conduct risk assessment annually (FedRAMP); document; review and update.
RA-3(1)	Risk Assessment \| Supply Chain Risk Assessment (RA-3(1))	Risk Assessment \| Supply Chain Risk Assessment. (a) Assess supply chain risks associated with [Assignment: organization-...
RA-5	Vulnerability Monitoring and Scanning	Scan for vulnerabilities monthly (FedRAMP); OS/network weekly, web app monthly, database monthly; remediate within FedRA...
RA-5(11)	Vulnerability Monitoring and Scanning \| Public Disclosure Program (RA-5(11))	Vulnerability Monitoring and Scanning \| Public Disclosure Program. Establish a public reporting channel for receiving re...
RA-5(2)	Update Vulnerabilities to be Scanned	Update vulnerability list prior to scan, when new vulnerabilities identified, or at FedRAMP frequency.
RA-5(3)	Vulnerability Monitoring and Scanning \| Breadth and Depth of Coverage (RA-5(3))	Vulnerability Monitoring and Scanning \| Breadth and Depth of Coverage. Define the breadth and depth of vulnerability sca...
RA-5(5)	Privileged Access	Implement privileged access authorization to FedRAMP-defined components for vulnerability scanning.
RA-9	Criticality Analysis (RA-9)	Criticality Analysis. Identify critical system components and functions by performing a criticality analysis for [Assign...
fedramp-moderate::RA-7	Risk Response	Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so that i...

SA - System and Services Acquisition

21 controls

Controls in the SA - System and Services Acquisition domain of FedRAMP Moderate — 21 controls
Code	Title	Description
SA-1	Policy and Procedures	Requires a system and services acquisition policy and supporting procedures to be developed, documented, disseminated, r...
SA-10	Developer Configuration Management	Require developer to perform CM during development, implementation, operation; document/track changes; implement only ap...
SA-11	Developer Testing and Evaluation	Require developer to test at FedRAMP-defined depth and coverage; document; correct flaws.
SA-11(1)	Developer Testing and Evaluation \| Static Code Analysis (SA-11(1))	Developer Testing and Evaluation \| Static Code Analysis. Require the developer of the system, system component, or syste...
SA-11(2)	Developer Testing and Evaluation \| Threat Modeling and Vulnerability Analyses (SA-11(2))	Developer Testing and Evaluation \| Threat Modeling and Vulnerability Analyses. Require the developer of the system, syst...
SA-15	Development Process, Standards, and Tools (SA-15)	Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service t...
SA-15(3)	Development Process, Standards, and Tools \| Criticality Analysis (SA-15(3))	Development Process, Standards, and Tools \| Criticality Analysis. Require the developer of the system, system component,...
SA-2	Allocation of Resources	Determine the high-level information security and privacy requirements for the system or system service in mission and b...
SA-22	Unsupported System Components (SA-22)	Unsupported System Components. a. Replace system components when support for the components is no longer available from...
SA-3	System Development Life Cycle	Manage system using SDLC incorporating security/privacy considerations.
SA-4	Acquisition Process	Include security/privacy requirements in contracts; FedRAMP-defined assurance requirements.
SA-4(1)	Acquisition Process \| Functional Properties of Controls (SA-4(1))	Acquisition Process \| Functional Properties of Controls. Require the developer of the system, system component, or syste...
SA-4(10)	Use of Approved PIV Products	Employ only information technology products on FIPS 201-approved products list for PIV capability.
SA-4(2)	Acquisition Process \| Design and Implementation Information for Controls (SA-4(2))	Acquisition Process \| Design and Implementation Information for Controls. Require the developer of the system, system co...
SA-4(9)	Acquisition Process \| Functions, Ports, Protocols, and Services in Use (SA-4(9))	Acquisition Process \| Functions, Ports, Protocols, and Services in Use. Require the developer of the system, system comp...
SA-5	System Documentation	Obtain administrator and user documentation; protect; distribute to FedRAMP-defined personnel.
SA-8	Security and Privacy Engineering Principles	Apply FedRAMP-defined systems security and privacy engineering principles in development.
SA-9	External System Services	Require providers of external system services to comply with security/privacy requirements; document oversight roles.
SA-9(1)	External System Services \| Risk Assessments and Organizational Approvals (SA-9(1))	External System Services \| Risk Assessments and Organizational Approvals. (a) Conduct an organizational assessment of ri...
SA-9(2)	Identification of Functions, Ports, Protocols, and Services	Require providers to identify functions, ports, protocols, services required for external services.
SA-9(5)	External System Services \| Processing, Storage, and Service Location (SA-9(5))	External System Services \| Processing, Storage, and Service Location. Restrict the location of [Selection (one or more):...

SC - System and Communications Protection

29 controls

Controls in the SC - System and Communications Protection domain of FedRAMP Moderate — 29 controls
Code	Title	Description
SC-1	Policy and Procedures	Develop, document, disseminate and review the policy for system and communications protection, and its procedures, on th...
SC-10	Network Disconnect	Terminate network connection at end of session or after FedRAMP-defined inactivity period (no longer than 30 minutes).
SC-12	Cryptographic Key Establishment and Management	Establish and manage cryptographic keys per FedRAMP requirements (FIPS-validated, key escrow/recovery as appropriate).
SC-13	Cryptographic Protection	Implement FedRAMP-defined cryptographic uses and approved cryptography (FIPS 140 validated).
SC-15	Collaborative Computing Devices and Applications	Prohibit remote activation of collaborative computing devices (cameras, mics) without explicit user indication; provide...
SC-17	Public Key Infrastructure Certificates	Issue public key certificates under FedRAMP-defined policy or obtain from approved service providers.
SC-18	Mobile Code	Define acceptable and unacceptable mobile code; authorize use; monitor.
SC-2	Separation of System and User Functionality	Separate user functionality from system management functionality.
SC-20	Secure Name/Address Resolution Service (Authoritative)	Provide artifacts for additional data origin authentication and integrity verification (DNSSEC) for child zones; FedRAMP...
SC-21	Secure Name/Address Resolution Service (Recursive or Caching Resolver)	Request and perform data origin authentication and data integrity verification on name/address resolution responses; DNS...
SC-22	Architecture and Provisioning for Name/Address Resolution Service	Ensure DNS systems are fault-tolerant and implement role separation.
SC-23	Session Authenticity	Protect authenticity of communications sessions.
SC-28	Protection of Information at Rest	Protect confidentiality and integrity of FedRAMP-defined information at rest.
SC-28(1)	Cryptographic Protection	Implement cryptographic mechanisms to prevent unauthorized disclosure/modification of FedRAMP-defined information on Fed...
SC-39	Process Isolation	Maintain separate execution domain for each executing system process.
SC-4	Information in Shared System Resources	Prevent unauthorized and unintended information transfer via shared system resources.
SC-45	System Time Synchronization (SC-45)	System Time Synchronization. Synchronize system clocks within and between systems and system components
SC-45(1)	System Time Synchronization \| Synchronization with Authoritative Time Source (SC-45(1))	System Time Synchronization \| Synchronization with Authoritative Time Source. (a) Compare the internal system clocks [As...
SC-5	Denial-of-Service Protection	Protect against or limit effects of DoS attacks using FedRAMP-defined safeguards.
SC-7	Boundary Protection	Monitor/control communications at external boundary and key internal boundaries; implement subnetworks for publicly acce...
SC-7(12)	Boundary Protection \| Host-based Protection (SC-7(12))	Boundary Protection \| Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection...
SC-7(18)	Boundary Protection \| Fail Secure (SC-7(18))	Boundary Protection \| Fail Secure. Prevent systems from entering unsecure states in the event of an operational failure...
SC-7(3)	Access Points	Limit number of external network connections to system; TIC-aligned.
SC-7(4)	External Telecommunications Services	Implement managed interface for each external telecommunications service; establish traffic flow policy; protect confide...
SC-7(5)	Deny by Default Allow by Exception	Deny network communications by default; allow by exception.
SC-7(7)	Split Tunneling for Remote Devices	Prevent split tunneling for remote devices unless securely provisioned.
SC-7(8)	Route Traffic to Authenticated Proxy Servers	Route internal traffic to FedRAMP-defined external networks through authenticated proxies.
SC-8	Transmission Confidentiality and Integrity	Protect confidentiality and integrity of transmitted information using cryptographic mechanisms.
SC-8(1)	Cryptographic Protection	Implement FIPS-validated cryptographic mechanisms to prevent unauthorized disclosure and detect changes during transmiss...

SI - System and Information Integrity

24 controls

Controls in the SI - System and Information Integrity domain of FedRAMP Moderate — 24 controls
Code	Title	Description
SI-1	Policy and Procedures	Develop, document, disseminate and review the policy for system and information integrity, and its procedures, on the Fe...
SI-10	Information Input Validation	Check validity of FedRAMP-defined information inputs.
SI-11	Error Handling	Generate error messages providing necessary info without revealing sensitive info; reveal only to authorized.
SI-12	Information Management and Retention	Manage and retain information consistent with applicable laws, regulations, policies, standards.
SI-16	Memory Protection	Implement FedRAMP-defined safeguards to protect memory from unauthorized code execution (DEP, ASLR).
SI-2	Flaw Remediation	Identify, report, and correct system flaws; remediate within FedRAMP-defined timeframes (HIGH critical 15d, high 30d).
SI-2(2)	Automated Flaw Remediation Status	Determine status of flaw remediation via automated mechanisms at FedRAMP-defined frequency (at least monthly).
SI-2(3)	Flaw Remediation \| Time to Remediate Flaws and Benchmarks for Corrective Actions (SI-2(3))	Flaw Remediation \| Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw iden...
SI-3	Malicious Code Protection	Implement signature-based and non-signature-based malicious code protection; configure to scan endpoints and entry/exit...
SI-4	System Monitoring	Monitor system to detect attacks; identify unauthorized use; deploy monitoring devices at boundaries and key internal po...
SI-4(1)	System Monitoring \| System-wide Intrusion Detection System (SI-4(1))	System Monitoring \| System-wide Intrusion Detection System. Connect and configure individual intrusion detection tools i...
SI-4(16)	System Monitoring \| Correlate Monitoring Information (SI-4(16))	System Monitoring \| Correlate Monitoring Information. Correlate information from monitoring tools and mechanisms employe...
SI-4(18)	System Monitoring \| Analyze Traffic and Covert Exfiltration (SI-4(18))	System Monitoring \| Analyze Traffic and Covert Exfiltration. Analyze outbound communications traffic at external interfa...
SI-4(2)	Automated Tools and Mechanisms for Real-Time Analysis	Employ automated tools to support near-real-time analysis of events.
SI-4(23)	System Monitoring \| Host-based Devices (SI-4(23))	System Monitoring \| Host-based Devices. Implement the following host-based monitoring mechanisms at [Assignment: organiz...
SI-4(4)	Inbound and Outbound Communications Traffic	Determine criteria for unusual or unauthorized activity; monitor inbound/outbound communications.
SI-4(5)	System-Generated Alerts	Alert FedRAMP-defined personnel when indications of compromise/potential compromise occur.
SI-5	Security Alerts, Advisories, and Directives	Receive alerts/advisories/directives from FedRAMP-defined external organizations (US-CERT, CISA); generate internal; dis...
SI-6	Security and Privacy Function Verification (SI-6)	Security and Privacy Function Verification. a. Verify the correct operation of [Assignment: organization-defined securit...
SI-7	Software, Firmware, and Information Integrity	Employ integrity verification tools to detect unauthorized changes to software, firmware, information; HIGH only.
SI-7(1)	Integrity Checks	Perform integrity checks of software, firmware, information at FedRAMP-defined frequency or trigger events.
SI-7(7)	Integration of Detection and Response	Incorporate detection of FedRAMP-defined unauthorized changes into IR capability.
SI-8	Spam Protection	Employ spam protection at entry/exit points; update spam protection mechanisms when new releases available.
SI-8(2)	Spam Protection \| Automatic Updates (SI-8(2))	Spam Protection \| Automatic Updates. Automatically update spam protection mechanisms [Assignment: organization-defined f...

SR - Supply Chain Risk Management

12 controls

Controls in the SR - Supply Chain Risk Management domain of FedRAMP Moderate — 12 controls
Code	Title	Description
SR-1	Policy and Procedures (SR-1)	Develop, document, disseminate, and review supply chain risk management policy and procedures at defined frequency.
SR-10	Inspection of Systems or Components (SR-10)	Inspect systems or components at defined frequency or upon indications of tampering to detect compromise.
SR-11	Component Authenticity (SR-11)	Implement anti-counterfeit policy and procedures to detect and prevent counterfeit components.
SR-11(1)	Component Authenticity \| Anti-counterfeit Training (SR-11(1))	Component Authenticity \| Anti-counterfeit Training. Train [Assignment: organization-defined personnel or roles] to detec...
SR-11(2)	Component Authenticity \| Configuration Control for Component Service and Repair (SR-11(2))	Component Authenticity \| Configuration Control for Component Service and Repair. Maintain configuration control over the...
SR-12	Component Disposal (SR-12)	Dispose of data, documentation, tools, or system components using defined techniques and methods.
SR-2	Supply Chain Risk Management Plan (SR-2)	Develop a C-SCRM plan for managing supply chain risks for systems, components, and services; review and update at define...
SR-2(1)	Supply Chain Risk Management Plan \| Establish SCRM Team (SR-2(1))	Supply Chain Risk Management Plan \| Establish SCRM Team. Establish a supply chain risk management team consisting of [As...
SR-3	Supply Chain Controls and Processes (SR-3)	Establish processes to identify, protect, detect, respond, and recover across the supply chain lifecycle.
SR-5	Acquisition Strategies, Tools, and Methods (SR-5)	Employ acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply...
SR-6	Supplier Assessments and Reviews (SR-6)	Assess and review the supply chain risk posture of suppliers at defined frequency and after significant events.
SR-8	Notification Agreements (SR-8)	Establish agreements with suppliers for notification of supply chain compromises and relevant changes.

Your Compliance Coverage

If you comply with FedRAMP Moderate, you already cover:

NIST SP 800-53 Rev 5

100%

322 controls mapped

Compare →

ISO 27002:2022

98%

318 controls mapped

Compare →

SOC 2

93%

301 controls mapped

Compare →

+ 276 more: NIST SP 800-53 Rev 5 HIGH (92%), ISO 27001:2022 (91%)

See all 279 mapped frameworks ↓

Maps to 279 other frameworks

323 total controls

NIST SP 800-53 Rev 5

322 source controls mapped|206 target controls covered

100%

ISO 27002:2022

318 source controls mapped|90 target controls covered

98%

SOC 2

301 source controls mapped|52 target controls covered

93%

NIST SP 800-53 Rev 5 HIGH

296 source controls mapped|296 target controls covered

92%

ISO 27001:2022

293 source controls mapped|90 target controls covered

91%

NIST SP 800-53 Rev 5 MODERATE

287 source controls mapped|287 target controls covered

89%

PCI DSS 4.0

265 source controls mapped|245 target controls covered

82%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

251 source controls mapped|186 target controls covered

78%

NIST Cybersecurity Framework 2.0

234 source controls mapped|104 target controls covered

72%

CIS Controls v8

228 source controls mapped|150 target controls covered

71%

C5 (Germany)

216 source controls mapped|115 target controls covered

67%

NIST SP 800-171 Rev 3

216 source controls mapped|97 target controls covered

67%

Azure Security Benchmark

186 source controls mapped|85 target controls covered

58%

CMMC 2.0

176 source controls mapped|109 target controls covered

54%

AWS Well-Architected Security Pillar

155 source controls mapped|62 target controls covered

48%

NIST SP 800-53 Rev 5 LOW

149 source controls mapped|149 target controls covered

46%

NIST SP 800-161 Rev 1

147 source controls mapped|138 target controls covered

46%

HIPAA Security Rule

131 source controls mapped|64 target controls covered

41%

NIST SP 800-66 Rev 2

124 source controls mapped|55 target controls covered

38%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

102 source controls mapped|42 target controls covered

32%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

99 source controls mapped|39 target controls covered

31%

NIST SP 800-172

92 source controls mapped|32 target controls covered

28%

ISO 27701:2019

90 source controls mapped|66 target controls covered

28%

DORA

76 source controls mapped|26 target controls covered

24%

Australia Consumer Data Right - Banking (CDR)

69 source controls mapped|18 target controls covered

21%

ASD Strategies to Mitigate Cyber Security Incidents

66 source controls mapped|36 target controls covered

20%

ACSC Essential Eight

62 source controls mapped|24 target controls covered

19%

UK Cyber Essentials

60 source controls mapped|36 target controls covered

19%

NIS2 Directive

54 source controls mapped|20 target controls covered

17%

Australia My Health Records Act 2012

52 source controls mapped|18 target controls covered

16%

NIST SP 800-218

50 source controls mapped|40 target controls covered

15%

ISO 22301:2019

47 source controls mapped|44 target controls covered

15%

APRA CPS 230 Operational Risk Management

44 source controls mapped|40 target controls covered

14%

APRA CPS 234

41 source controls mapped|24 target controls covered

13%

APEC Cross-Border Privacy Rules (CBPR) System

33 source controls mapped|20 target controls covered

10%

GDPR

30 source controls mapped|12 target controls covered

APPI

20 source controls mapped|10 target controls covered

ISO/IEC 42001:2023

18 source controls mapped|13 target controls covered

NIST SP 800-53A Rev. 5

15 source controls mapped|14 target controls covered

APRA CPS 220 Risk Management

14 source controls mapped|11 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

11 source controls mapped|9 target controls covered

Australian Privacy Principles (APPs)

10 source controls mapped|6 target controls covered

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)

9 source controls mapped|4 target controls covered

NIST SP 800-190

5 source controls mapped|4 target controls covered

Singapore Government Instruction Manual on ICT&SS Management (IM8)

5 source controls mapped|3 target controls covered

API 1164

4 source controls mapped|3 target controls covered

BSI IT-Grundschutz

4 source controls mapped|3 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

4 source controls mapped|4 target controls covered

IEC 62443

4 source controls mapped|3 target controls covered

South Korea ISMS-P

4 source controls mapped|3 target controls covered

NIST SP 800-181

4 source controls mapped|6 target controls covered

NIST SP 800-146

4 source controls mapped|2 target controls covered

NIST SP 800-145

4 source controls mapped|3 target controls covered

NIST SP 800-144

4 source controls mapped|2 target controls covered

MTCS (Singapore)

4 source controls mapped|3 target controls covered

ISMAP (Japan)

4 source controls mapped|2 target controls covered

Florida Digital Bill of Rights (FDBR)

4 source controls mapped|4 target controls covered

TSA Pipeline Cybersecurity Directives

3 source controls mapped|2 target controls covered

Bahrain PDPL

3 source controls mapped|2 target controls covered

ASIS SPC.1-2009 - Organizational Resilience Standard

3 source controls mapped|2 target controls covered

ISO/IEC 29147:2018

3 source controls mapped|3 target controls covered

ISO/IEC 23894:2023

3 source controls mapped|6 target controls covered

NIST SP 1800-32

3 source controls mapped|3 target controls covered

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

3 source controls mapped|2 target controls covered

ISO/IEC 27019:2024

3 source controls mapped|3 target controls covered

ISO/IEC 27031:2011

3 source controls mapped|2 target controls covered

ISO/IEC 29134:2023

3 source controls mapped|3 target controls covered

Barbados Data Protection Act 2019

3 source controls mapped|2 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

3 source controls mapped|5 target controls covered

Annex 11 to EU GMP - Computerised Systems

3 source controls mapped|4 target controls covered

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

3 source controls mapped|3 target controls covered

New Zealand Information Security Manual (NZISM)

3 source controls mapped|2 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

3 source controls mapped|4 target controls covered

IAIS Insurance Core Principles (ICPs)

3 source controls mapped|2 target controls covered

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)

3 source controls mapped|3 target controls covered

ISO/IEC 27400:2022

3 source controls mapped|2 target controls covered

UK Telecommunications (Security) Act 2021

3 source controls mapped|2 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

3 source controls mapped|6 target controls covered

US SEC Digital Assets and Crypto Regulatory Framework

3 source controls mapped|3 target controls covered

ISO 28001:2007 Supply Chain Security Management

3 source controls mapped|2 target controls covered

OWASP DevSecOps Maturity Model (DSOMM)

3 source controls mapped|4 target controls covered

GLI-33 - Gaming Laboratories International Event Wagering Systems

3 source controls mapped|3 target controls covered

Virginia CDPA

2 source controls mapped|2 target controls covered

Uruguay DPL

2 source controls mapped|1 target controls covered

UNICEF Policy Guidance on AI for Children (2021)

2 source controls mapped|1 target controls covered

UNESCO Recommendation on the Ethics of AI

2 source controls mapped|3 target controls covered

UK GDPR (UK General Data Protection Regulation)

2 source controls mapped|2 target controls covered

UK AI Regulation Framework

2 source controls mapped|2 target controls covered

Texas Data Privacy and Security Act (TDPSA)

2 source controls mapped|1 target controls covered

Taiwan PDPA

2 source controls mapped|2 target controls covered

French Sapin II Law (Law No. 2016-1691)

2 source controls mapped|3 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

2 source controls mapped|2 target controls covered

FBI CJIS Security Policy

2 source controls mapped|1 target controls covered

ISO/IEC 27003:2017

2 source controls mapped|2 target controls covered

AICPA Privacy Management Framework (PMF)

2 source controls mapped|3 target controls covered

Kuwait National Cybersecurity Framework

2 source controls mapped|2 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

2 source controls mapped|2 target controls covered

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties

2 source controls mapped|1 target controls covered

AML/CTF Act 2006 (Australia)

2 source controls mapped|1 target controls covered

SQF Code Edition 9 - Safe Quality Food

2 source controls mapped|2 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

2 source controls mapped|2 target controls covered

ISO 26262:2018 - Functional Safety for Road Vehicles

2 source controls mapped|2 target controls covered

SSAE 18 - Attestation Standards (SOC Reporting)

2 source controls mapped|5 target controls covered

Singapore Cybersecurity Act 2018

2 source controls mapped|2 target controls covered

Saudi Arabia PDPL

2 source controls mapped|2 target controls covered

UK Age Appropriate Design Code (Children's Code)

2 source controls mapped|2 target controls covered

ISO 20400:2017 - Sustainable Procurement

2 source controls mapped|3 target controls covered

SASB Standards

2 source controls mapped|3 target controls covered

Oman National Cybersecurity Framework

2 source controls mapped|1 target controls covered

NERC CIP

2 source controls mapped|1 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

2 source controls mapped|1 target controls covered

FedRAMP High

2 source controls mapped|2 target controls covered

FFIEC Cybersecurity Assessment Tool (CAT)

2 source controls mapped|1 target controls covered

ISO/IEC 27006-1:2024

2 source controls mapped|1 target controls covered

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.4)

2 source controls mapped|2 target controls covered

HKMA Cyber Resilience Assessment Framework (C-RAF)

2 source controls mapped|2 target controls covered

FTC GLBA Safeguards Rule (16 CFR Part 314)

2 source controls mapped|2 target controls covered

FedRAMP Rev 5

2 source controls mapped|4 target controls covered

Regulation on the European Health Data Space (EHDS)

2 source controls mapped|2 target controls covered

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems

2 source controls mapped|2 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

2 source controls mapped|4 target controls covered

Nebraska Data Privacy Act

2 source controls mapped|4 target controls covered

South Korea PIPA

2 source controls mapped|2 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

1 source controls mapped|2 target controls covered

UK FCA/PRA Operational Resilience Framework

1 source controls mapped|1 target controls covered

SEC Climate Disclosure Rule

1 source controls mapped|1 target controls covered

ISO 27799:2025

1 source controls mapped|1 target controls covered

EASA Part-IS - Information Security in Aviation

1 source controls mapped|2 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

1 source controls mapped|1 target controls covered

ISO 22313:2020 - Guidance on Business Continuity Management Systems

1 source controls mapped|1 target controls covered

Responsible Minerals Initiative (RMI) - Responsible Minerals Assurance Process

1 source controls mapped|3 target controls covered

APRA SPS 220 Risk Management (Superannuation)

1 source controls mapped|1 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

1 source controls mapped|1 target controls covered

UK Modern Slavery Act 2015

1 source controls mapped|1 target controls covered

SOC for Cybersecurity - Cybersecurity Risk Management Examination

1 source controls mapped|1 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

1 source controls mapped|1 target controls covered

Modern Slavery Act 2018 (Australia)

1 source controls mapped|2 target controls covered

ISO 26000:2010

1 source controls mapped|3 target controls covered

South Africa Promotion of Access to Information Act (PAIA)

1 source controls mapped|1 target controls covered

ISO 22000:2018

1 source controls mapped|1 target controls covered

IEEE 1686

1 source controls mapped|1 target controls covered

Ghana Cybersecurity Act

1 source controls mapped|1 target controls covered

FISMA

1 source controls mapped|1 target controls covered

WCAG 2.2

1 source controls mapped|1 target controls covered

W3C Verifiable Credentials (VC) Data Model 2.0

1 source controls mapped|1 target controls covered

UK Gambling Commission LCCP and Remote Technical Standards

1 source controls mapped|2 target controls covered

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter

1 source controls mapped|1 target controls covered

UK Bribery Act 2010

1 source controls mapped|3 target controls covered

Trinidad and Tobago Data Protection Act 2011

1 source controls mapped|3 target controls covered

Tanzania Personal Data Protection Act 2022

1 source controls mapped|2 target controls covered

SLSA

1 source controls mapped|1 target controls covered

SIG (Shared Assessments)

1 source controls mapped|1 target controls covered

Protective Security Policy Framework (PSPF) Release 2026

1 source controls mapped|1 target controls covered

PSD2 SCA

1 source controls mapped|1 target controls covered

PTES

1 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

1 source controls mapped|3 target controls covered

Philippines Cybercrime Prevention Act (RA 10175)

1 source controls mapped|1 target controls covered

Pakistan Personal Data Protection Bill 2023

1 source controls mapped|2 target controls covered

OWASP Top 10:2025

1 source controls mapped|1 target controls covered

OWASP SAMM

1 source controls mapped|1 target controls covered

OWASP MASVS

1 source controls mapped|1 target controls covered

OSFI B-13

1 source controls mapped|1 target controls covered

OpenSSF Scorecard

1 source controls mapped|1 target controls covered

Open Banking Security

1 source controls mapped|1 target controls covered

OCC Heightened Standards (12 CFR Part 30, Appendix D)

1 source controls mapped|1 target controls covered

O-RAN WG11 Security Specification

1 source controls mapped|3 target controls covered

Notifiable Data Breaches Scheme (Australia)

1 source controls mapped|1 target controls covered

NIST SP 800-92

1 source controls mapped|1 target controls covered

NIST SP 800-88

1 source controls mapped|1 target controls covered

NIST SP 800-63-4

1 source controls mapped|1 target controls covered

NIST SP 800-61 Rev. 3

1 source controls mapped|1 target controls covered

NIST SP 800-137

1 source controls mapped|1 target controls covered

NIST SP 800-123

1 source controls mapped|1 target controls covered

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)

1 source controls mapped|1 target controls covered

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)

1 source controls mapped|1 target controls covered

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)

1 source controls mapped|2 target controls covered

Monetary Authority of Singapore Technology Risk Management Guidelines

1 source controls mapped|1 target controls covered

MITRE D3FEND

1 source controls mapped|1 target controls covered

MITRE ATT&CK

1 source controls mapped|1 target controls covered

ITU Radio Regulations and Space Security Standards

1 source controls mapped|1 target controls covered

ITAR - International Traffic in Arms Regulations

1 source controls mapped|1 target controls covered

Israel Protection of Privacy Law (5741-1981)

1 source controls mapped|2 target controls covered

ICH Q10 - Pharmaceutical Quality System

1 source controls mapped|2 target controls covered

ICH E6(R3) - Good Clinical Practice

1 source controls mapped|1 target controls covered

IATF 16949:2016 - Quality Management System for Automotive Production

1 source controls mapped|2 target controls covered

IATA Operational Safety Audit (IOSA) Standards Manual

1 source controls mapped|1 target controls covered

HKMA SPM

1 source controls mapped|1 target controls covered

GLBA

1 source controls mapped|1 target controls covered

GAMP 5 - Good Automated Manufacturing Practice

1 source controls mapped|2 target controls covered

FDA Quality Management System Regulation (QMSR)

1 source controls mapped|1 target controls covered

FATF Recommendation 16 - Payment Transparency (Travel Rule)

1 source controls mapped|1 target controls covered

Illinois Biometric Information Privacy Act (BIPA)

1 source controls mapped|1 target controls covered

IEC 62351 - Power Systems Communication Security

1 source controls mapped|1 target controls covered

ISO/IEC 27014:2020

1 source controls mapped|2 target controls covered

US Foreign Corrupt Practices Act (FCPA)

1 source controls mapped|1 target controls covered

ISO/IEC 27011:2024

1 source controls mapped|2 target controls covered

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework

1 source controls mapped|1 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

1 source controls mapped|2 target controls covered

Science Based Targets Initiative (SBTi) - Net-Zero Standard

1 source controls mapped|2 target controls covered

ISO/IEC 27007:2020

1 source controls mapped|1 target controls covered

ISO/IEC 29100:2024

1 source controls mapped|3 target controls covered

Azerbaijan Law on Personal Data (2010)

1 source controls mapped|1 target controls covered

ISO/IEC 27004:2016

1 source controls mapped|3 target controls covered

Albania Law No. 124/2024 on Personal Data Protection

1 source controls mapped|2 target controls covered

ISO/IEC 27050-1:2019

1 source controls mapped|1 target controls covered

ISO/IEC 30111:2019

1 source controls mapped|2 target controls covered

DFARS 252.204-7012 - Safeguarding Covered Defense Information

1 source controls mapped|1 target controls covered

ISO/IEC 23837:2023

1 source controls mapped|1 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

1 source controls mapped|3 target controls covered

ISO 8000 - Data Quality

1 source controls mapped|2 target controls covered

UK Open Banking Standard

1 source controls mapped|1 target controls covered

Sweden Data Protection Act (Dataskyddslag, 2018:218)

1 source controls mapped|1 target controls covered

PCI PIN Security

1 source controls mapped|1 target controls covered

ISO 41001:2018 - Facility Management Systems

1 source controls mapped|2 target controls covered

ISO/SAE 21434

1 source controls mapped|1 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

1 source controls mapped|3 target controls covered

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

1 source controls mapped|1 target controls covered

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration

1 source controls mapped|2 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

1 source controls mapped|3 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

1 source controls mapped|2 target controls covered

ISO 22320:2018

1 source controls mapped|3 target controls covered

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)

1 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

1 source controls mapped|3 target controls covered

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model

1 source controls mapped|2 target controls covered

ISO 56002

1 source controls mapped|2 target controls covered

FFIEC IT Examination Handbook

1 source controls mapped|1 target controls covered

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)

1 source controls mapped|1 target controls covered

Connecticut Data Privacy Act (CTDPA)

1 source controls mapped|1 target controls covered

WHO Global Strategy on Digital Health 2020-2025

1 source controls mapped|1 target controls covered

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

1 source controls mapped|1 target controls covered

ISO/IEC 27043:2015

1 source controls mapped|1 target controls covered

COBIT 2019

1 source controls mapped|1 target controls covered

PCI P2PE

1 source controls mapped|1 target controls covered

PCI SSF

1 source controls mapped|1 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

Vietnam PDPD

1 source controls mapped|1 target controls covered

Turkey KVKK

1 source controls mapped|1 target controls covered

TCFD Recommendations

1 source controls mapped|1 target controls covered

Qatar DPL

1 source controls mapped|1 target controls covered

Privacy Act 2020

1 source controls mapped|1 target controls covered

Privacy Act 1988 (Australia)

1 source controls mapped|1 target controls covered

POPIA

1 source controls mapped|1 target controls covered

Personal Data Act (personopplysningsloven)

1 source controls mapped|1 target controls covered

PDPA Thailand

1 source controls mapped|1 target controls covered

PDPA Singapore

1 source controls mapped|1 target controls covered

Oregon Consumer Privacy Act

1 source controls mapped|1 target controls covered

OECD AI Principles

1 source controls mapped|1 target controls covered

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

1 source controls mapped|1 target controls covered

NIST SP 800-122

1 source controls mapped|1 target controls covered

NIST Privacy Framework

1 source controls mapped|1 target controls covered

Nigeria Data Protection Regulation (NDPR)

1 source controls mapped|1 target controls covered

New Jersey Data Privacy Act

1 source controls mapped|1 target controls covered

New Hampshire Data Privacy Act

1 source controls mapped|1 target controls covered

Montana Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Minnesota Consumer Data Privacy Act

1 source controls mapped|1 target controls covered

Mexico LFPDPPP

1 source controls mapped|1 target controls covered

Mauritius DPA

1 source controls mapped|1 target controls covered

Maryland Online Data Privacy Act of 2024

1 source controls mapped|1 target controls covered

Malaysia PDPA 2010

1 source controls mapped|1 target controls covered

Liechtenstein DPA

1 source controls mapped|1 target controls covered

LGPD

1 source controls mapped|1 target controls covered

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)

1 source controls mapped|1 target controls covered

Law No. 172-13 on the Protection of Personal Data

1 source controls mapped|1 target controls covered

Kentucky Consumer Data Protection Act

1 source controls mapped|1 target controls covered

Japan AI Guidelines

1 source controls mapped|1 target controls covered

Jamaica Data Protection Act 2020

1 source controls mapped|1 target controls covered

ISSB Standards

1 source controls mapped|1 target controls covered

Iowa Consumer Data Protection Act

1 source controls mapped|1 target controls covered

Indonesia PDP Law

1 source controls mapped|1 target controls covered

Indiana Consumer Data Protection Act

1 source controls mapped|1 target controls covered

India DPDP Act

1 source controls mapped|1 target controls covered

IEEE 7000

1 source controls mapped|1 target controls covered

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)

1 source controls mapped|1 target controls covered

GRI Standards

1 source controls mapped|1 target controls covered

Global Cross-Border Privacy Rules (Global CBPR) Forum

1 source controls mapped|1 target controls covered

Family Educational Rights and Privacy Act (FERPA)

1 source controls mapped|1 target controls covered

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

1 source controls mapped|1 target controls covered

UK Data Protection Act 2018

1 source controls mapped|1 target controls covered

UK Online Safety Act 2023

1 source controls mapped|1 target controls covered

Compare FedRAMP Moderate with NIST SP 800-53 Rev 5

Coverage is not the same as your position

This page shows what FedRAMP Moderate overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is FedRAMP Moderate and who does it apply to?

FedRAMP Moderate is a compliance framework from United States with 18 domains and 323 controls. FedRAMP Moderate baseline. Federal cloud service authorization built on NIST SP 800-53 Rev 5 with FedRAMP-specific parameters. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does FedRAMP Moderate actually require?

FedRAMP Moderate has 323 controls organised across 18 domains. The largest domains are AC - Access Control (43 controls), SC - System and Communications Protection (29 controls), CM - Configuration Management (27 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of FedRAMP Moderate do I already cover?

FedRAMP Moderate maps to 279 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (100% coverage), ISO 27002:2022 (98% coverage), SOC 2 (93% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement FedRAMP Moderate?

Start your FedRAMP Moderate compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about FedRAMP Moderate requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 323 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 868 frameworks.

Get Started Free →

Free forever — no credit card required