FRMR.LOW.20x-low-pilot.json

{
  "info": {
    "name": "FedRAMP 20x Combined Requirements",
    "short_name": "FRMR-LOW",
    "current_release": "25.06A",
    "types": [
      "FRR",
      "FRD",
      "FRA"
    ],
    "releases": [
      {
        "id": "25.06A",
        "published_date": "2025-06-17",
        "description": "Combined FedRAMP 20x Low Requirements"
      }
    ]
  },
  "FRR": {
    "SCN": {
      "base": {
        "id": "FRR-SCN",
        "application": "These requirements apply ALWAYS to ALL _significant changes_ based on current Effective Date(s) and Overall Applicability",
        "referenced_fr": [
          "FRD-SCN-01"
        ],
        "requirements": [
          {
            "id": "FRR-SCN-01",
            "statement": "Providers MUST notify all necessary parties when Significant Change Notifications are required, including at least FedRAMP and all agency customers. Providers MAY share Significant Change Notifications publicly or with other parties.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST"
          },
          {
            "id": "FRR-SCN-02",
            "statement": "Providers MUST follow the procedures documented in their security plan to plan, evaluate, test, perform, assess, and document changes.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST"
          },
          {
            "id": "FRR-SCN-03",
            "statement": "Providers MUST evaluate and type label all _significant changes_, then follow FedRAMP requirements for the type.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-01"
            ]
          },
          {
            "id": "FRR-SCN-04",
            "statement": "Providers MUST maintain auditable records of these activities and make them available to all necessary parties.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST"
          },
          {
            "id": "FRR-SCN-05",
            "statement": "Providers MUST keep historical Significant Change Notifications available to all necessary parties at least until the service completes its next annual assessment.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST"
          },
          {
            "id": "FRR-SCN-06",
            "statement": "All parties SHOULD follow FedRAMP's best practices and technical assistance on _significant change_ assessment and notification where applicable.",
            "affects": [
              "Providers",
              "Agencies",
              "3PAOs"
            ],
            "primary_key_word": "SHOULD",
            "referenced_fr": [
              "FRD-SCN-01"
            ]
          },
          {
            "id": "FRR-SCN-07",
            "statement": "Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented and easily accessible.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MAY",
            "is_interim": true
          },
          {
            "id": "FRR-SCN-08",
            "statement": "Providers MUST make ALL Significant Change Notifications and related audit records available in similar human-readable and compatible machine-readable formats.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "is_interim": true
          },
          {
            "id": "FRR-SCN-09",
            "statement": "Providers MUST include at least the following information in Significant Change Notifications:",
            "following_information": [
              "Service Offering FedRAMP ID",
              "3PAO Name (if applicable)",
              "Related POA&M (if applicable)",
              "Significant Change type and explanation of categorization",
              "Short description of change",
              "Reason for change",
              "Summary of customer impact, including changes to services and customer configuration responsibilities",
              "Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or controls",
              "Copy of the business or security impact analysis",
              "Name and title of approver"
            ],
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "is_interim": true
          },
          {
            "id": "FRR-SCN-10",
            "statement": "Providers MAY include additional relevant information in Significant Change Notifications.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MAY",
            "is_interim": true
          }
        ]
      },
      "exceptions": {
        "application": "These exceptions MAY override some or all of the FedRAMP requirements for this standard.",
        "id": "FRR-SCN-EX",
        "requirements": [
          {
            "id": "FRR-SCN-EX-01",
            "statement": "Providers MAY be required to delay _significant changes_ beyond the standard Significant Change Notification period and/or submit _significant changes_ for approval in advance as a condition of a formal FedRAMP Corrective Action Plan or other agreement.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MAY",
            "referenced_fr": [
              "FRD-SCN-01"
            ]
          },
          {
            "id": "FRR-SCN-EX-02",
            "statement": "Providers MAY execute _significant changes_ (including _transformative_ changes) during an emergency or incident without meeting Significant Change Notification requirements in advance ONLY if absolutely necessary. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MAY",
            "referenced_fr": [
              "FRD-SCN-01"
            ]
          }
        ]
      },
      "routine_recurring": {
        "application": "These requirements apply ONLY to _significant changes_ of type _routine recurring_.",
        "id": "FRR-SCN-RR",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-SCN-02"
        ],
        "requirements": [
          {
            "id": "FRR-SCN-RR-01",
            "statement": "Providers SHOULD NOT make formal Significant Change Notifications for _routine recurring_ changes; this type of change is exempted from the notification requirements of this standard.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "SHOULD NOT",
            "referenced_fr": [
              "FRD-SCN-02"
            ]
          }
        ]
      },
      "adaptive": {
        "application": "These requirements apply ONLY to _significant changes_ of type _adaptive_.",
        "id": "FRR-SCN-AD",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-SCN-03"
        ],
        "requirements": [
          {
            "id": "FRR-SCN-AD-01",
            "statement": "Providers MUST notify all necessary parties within ten business days after finishing _adaptive_ changes, also including the following information:",
            "following_information": [
              "Summary of any new risks identified and/or POA&Ms resulting from the change (if applicable)"
            ],
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-03"
            ]
          }
        ]
      },
      "transformative": {
        "application": "These requirements apply ONLY to _significant changes_ of type _transformative_.",
        "id": "FRR-SCN-TF",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-SCN-04"
        ],
        "requirements": [
          {
            "id": "FRR-SCN-TF-01",
            "statement": "Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting _transformative_ changes if human validation is necessary. This review SHOULD be limited to security decisions that require human validation. Providers MUST document this decision and justification.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "SHOULD",
            "is_interim": true,
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-02",
            "statement": "Providers MUST notify all necessary parties of initial plans for _transformative_ changes at least 30 business days before starting _transformative_ changes.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-03",
            "statement": "Providers MUST notify all necessary parties of final plans for _transformative_ changes at least 10 business days before starting _transformative_ changes.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-04",
            "statement": "Providers MUST notify all necessary parties within 5 business days after finishing _transformative_ changes, also including the following information:",
            "following_information": [
              "Updates to all previously sent information"
            ],
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-05",
            "statement": "Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of _transformative_ changes, also including the following information:",
            "following_information": [
              "Updates to all previously sent information",
              "Summary of any new risks identified and/or POA&Ms resulting from the change (if applicable)",
              "Copy of the security assessment report (if applicable)"
            ],
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-06",
            "statement": "Providers MUST publish updated service documentation and other materials to reflect _transformative_ changes within 30 business days after finishing _transformative_ changes.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          },
          {
            "id": "FRR-SCN-TF-07",
            "statement": "Providers MUST allow agency customers to OPT OUT of _transformative_ changes whenever feasible.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-SCN-04"
            ]
          }
        ]
      },
      "impact": {
        "application": "These requirements apply ONLY to _significant changes_ of type _impact categorization_.",
        "id": "FRR-SCN-IM",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-SCN-05"
        ],
        "requirements": [
          {
            "id": "FRR-SCN-IM-01",
            "statement": "Providers MUST follow the legacy Significant Change Request process or full re-authorization for _impact categorization_ changes, with advance approval from an identified lead agency, until further notice.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "is_interim": true,
            "referenced_fr": [
              "FRD-SCN-05"
            ]
          }
        ]
      }
    },
    "MAS": {
      "base": {
        "application": "These requirements apply ALWAYS to ALL FedRAMP authorizations based on the Effective Date(s) and Overall Applicability.",
        "id": "FRR-MAS",
        "requirements": [
          {
            "id": "FRR-MAS-01",
            "statement": "Providers MUST identify a set of _information resources_ to assess for FedRAMP authorization that includes all _information resources_ that are likely to _handle_ _federal information_ or _likely_ to impact the confidentiality, integrity, or availability of _federal information_ _handled_ by the _cloud service offering_.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRD-MAS-01",
              "FRD-MAS-02",
              "FRD-MAS-03",
              "FRD-MAS-04"
            ]
          },
          {
            "id": "FRR-MAS-02",
            "statement": "Providers MUST include the configuration and usage of _third-party information resources_, ONLY IF _FRR-MAS-01_ APPLIES.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRR-MAS-01",
              "FRD-MAS-05"
            ]
          },
          {
            "id": "FRR-MAS-03",
            "statement": "Providers MUST clearly identify and document the justification, mitigation measures, compensating controls, and potential impact to _federal information_ from the configuration and usage of non-FedRAMP authorized _third-party information resources_, ONLY IF _FRR-MAS-01_ APPLIES.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRR-MAS-01",
              "FRD-MAS-01",
              "FRD-MAS-05"
            ]
          },
          {
            "id": "FRR-MAS-04",
            "statement": "Providers MUST include metadata (including metadata about _federal information_), ONLY IF _FRR-MAS-01_ APPLIES.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRR-MAS-01",
              "FRD-MAS-01"
            ]
          },
          {
            "id": "FRR-MAS-05",
            "statement": "Providers MUST clearly identify, document, and explain information flows and impact levels for ALL _information resources_, ONLY IF _FRR-MAS-01_ APPLIES.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRR-MAS-01",
              "FRD-MAS-02"
            ]
          }
        ]
      },
      "exceptions": {
        "application": "These exceptions MAY override some or all of the FedRAMP requirements for this standard.",
        "id": "FRR-MAS-EX",
        "requirements": [
          {
            "id": "FRR-MAS-EX-01",
            "statement": "Providers MAY include documentation of _information resources_ beyond the _cloud service offering, or even entirely outside the scope of FedRAMP, in a FedRAMP assessment and authorization package supplement; these resources will not be FedRAMP authorized and MUST be clearly marked and separated from the _cloud service offering_.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MAY",
            "referenced_fr": [
              "FRD-MAS-02"
            ]
          }
        ]
      },
      "application": {
        "application": "These rules provide general guidance on the application of this standard.",
        "id": "FRR-MAS-AY",
        "requirements": [
          {
            "id": "FRR-MAS-AY-01",
            "statement": "Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the _cloud service offering_ for FedRAMP. For more, see fedramp.gov/scope.",
            "affects": [
              "All"
            ],
            "primary_key_word": "MUST",
            "reference": "Overall Scope of FedRAMP",
            "reference_url": "http://fedramp.gov/scope"
          },
          {
            "id": "FRR-MAS-AY-02",
            "statement": "Software produced by cloud service providers that is delivered separately for installation on agency systems and not operated in a shared responsibility model (typically including agents, application clients, mobile applications, etc. that are not fully managed by the cloud service provider) is not a cloud computing product or service and is entirely outside the scope of FedRAMP under the FedRAMP Authorization Act. All such software is therefore not included in the _cloud service offering_ for FedRAMP. For more, see fedramp.gov/scope.",
            "affects": [
              "All"
            ],
            "primary_key_word": "MUST",
            "reference": "Overall Scope of FedRAMP",
            "reference_url": "http://fedramp.gov/scope"
          },
          {
            "id": "FRR-MAS-AY-03",
            "statement": "_Information resources_ (including _third-party information resources_) that do not meet the conditions in FRR-MAS-01 are not included in the _cloud service offering_ for FedRAMP(_FRR-MAS-02_).",
            "affects": [
              "All"
            ],
            "primary_key_word": "MUST",
            "referenced_fr": [
              "FRR-MAS-01",
              "FRR-MAS-02",
              "FRD-MAS-02",
              "FRD-MAS-05"
            ]
          },
          {
            "id": "FRR-MAS-AY-04",
            "statement": "_Information resources_ (including _third-party information resources_+_) MAY vary by impact level as appropriate to the level of information _handled_ or impacted by the information resource (_FRR-MAS-05_).",
            "affects": [
              "All"
            ],
            "primary_key_word": "MAY",
            "referenced_fr": [
              "FRR-MAS-05",
              "FRD-MAS-02",
              "FRD-MAS-03",
              "FRD-MAS-05"
            ]
          },
          {
            "id": "FRR-MAS-AY-05",
            "statement": "All parties SHOULD review best practices and technical assistance provided separately by FedRAMP for help with applying the Minimum Assessment Standard as needed.",
            "affects": [
              "All"
            ],
            "primary_key_word": "SHOULD"
          },
          {
            "id": "FRR-MAS-AY-06",
            "statement": "All aspects of the _cloud service offering_ are determined and maintained by the cloud service provider in accordance with related FedRAMP authorization requirements and documented by the cloud service provider in their assessment and authorization materials.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST"
          }
        ]
      }
    },
    "KSI": {
      "base": {
        "application": "These requirements apply ALWAYS to ALL FedRAMP 20x authorizations based on the Effective Date(s) and Overall Applicability.",
        "id": "FRR-KSI",
        "requirements": [
          {
            "id": "FRR-KSI-01",
            "statement": "Cloud service providers MUST apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope.",
            "affects": [
              "Providers"
            ],
            "primary_key_word": "MUST",
            "referenced_rules": [
              "FRR-MAS-01"
            ]
          },
          {
            "id": "FRR-KSI-02",
            "statement": "All parties SHOULD follow FedRAMP's best practices and technical assistance on assessing Key Security Indicators where applicable.",
            "affects": [
              "Providers",
              "Agencies",
              "3PAOs"
            ],
            "primary_key_word": "SHOULD"
          },
          {
            "id": "FRR-KSI-03",
            "statement": "All parties SHOULD continuously monitor and review materials in the FedRAMP 20x Phase One (20xP1) pilot requirements and the 20x Community Working Group. Additional details, interim best practices and technical assistance, answers to common questions, and more will be provided asynchronously during 20xP1.",
            "affects": [
              "Providers",
              "Agencies",
              "3PAOs"
            ],
            "primary_key_word": "SHOULD",
            "is_interim": true
          }
        ]
      }
    }
  },
  "FRD": {
    "SCN": [
      {
        "id": "FRD-SCN-01",
        "term": "Significant change",
        "definition": "Has the meaning given in NIST SP 800-37 Rev. 2 which is \"a change that is _likely_ to substantively affect the security or privacy posture of a system.\"",
        "reference": "NIST SP 800-37 Rev. 2",
        "reference_url": "https://csrc.nist.gov/pubs/sp/800/37/r2/final",
        "referenced_fr": [
          "FRD-MAS-04"
        ]
      },
      {
        "id": "FRD-SCN-02",
        "term": "Routine Recurring",
        "definition": "The type of _significant change_ that _regularly_ and routinely recurs as part of ongoing operations, vulnerability mitigation, or vulnerability remediation.",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-KSI-01"
        ]
      },
      {
        "id": "FRD-SCN-03",
        "term": "Adaptive",
        "definition": "The type of _significant change_ that does not routinely recur but does not introduce substantive potential security risks that need to be assessed in depth.",
        "note": "Adaptive changes typically require careful planning that focuses on engineering execution instead of customer adoption, can be verified with minor changes to existing automated validation procedures, and do not require large changes to operational procedures, deployment plans, or documentation.",
        "referenced_fr": [
          "FRD-SCN-01"
        ]
      },
      {
        "id": "FRD-SCN-04",
        "term": "Transformative",
        "definition": "The type of _significant change_ that introduces substantive potential security risks that are _likely_ to affect existing risk determinations and must be assessed in depth.",
        "note": "Transformative changes typically introduce major features or capabilities that may change how a customer uses the service (in whole or in part) and require extensive updates to security assessments, operational procedures, deployment plans, and documentation.",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-MAS-04"
        ]
      },
      {
        "id": "FRD-SCN-05",
        "term": "Impact Categorization",
        "definition": "The type of _significant change_ that is _likely_ to increase or decrease the impact level categorization for the entire cloud service offering (e.g. from low to moderate or from high to moderate).",
        "referenced_fr": [
          "FRD-SCN-01",
          "FRD-MAS-04"
        ]
      },
      {
        "id": "FRD-SCN-06",
        "term": "Interim Requirement",
        "definition": "A temporary requirement included as part of a FedRAMP Pilot or Beta Test that will _likely_ be replaced, updated, or removed prior to the formal wide release of the requirement.",
        "referenced_fr": [
          "FRD-MAS-04"
        ]
      }
    ],
    "MAS": [
      {
        "id": "FRD-MAS-01",
        "term": "Federal Information",
        "definition": "Has the meaning from OMB Circular A-130 and any successor documents. As of Apr 2025, this means \"information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the federal government, in any medium or form.\"",
        "note": "This typically does not include information that a cloud service provider produces outside of a government contract or agreement. Review FedRAMP's Technical Assistance and consult qualified legal experts for additional assistance identifying federal information.",
        "reference": "OMB Circular A-130",
        "reference_url": "https://whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf"
      },
      {
        "id": "FRD-MAS-02",
        "term": "Information Resource",
        "definition": "Has the meaning from 44 USC § 3502 (6): \"information and related resources, such as personnel, equipment, funds, and information technology.\"",
        "note": "This applies to any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from organizational policies and procedures to hardware, software, and code.",
        "reference": "44 USC § 3502 (6)",
        "reference_url": "https://www.govinfo.gov/app/details/USCODE-2023-title44/USCODE-2023-title44-chap35-subchapI-sec3502"
      },
      {
        "id": "FRD-MAS-03",
        "term": "Handle",
        "definition": "Has the plain language meaning inclusive of any possible action taken with information, such as access, collect, control, create, display, disclose, disseminate, dispose, maintain, manipulate, process, receive, review, store, transmit, use... etc."
      },
      {
        "id": "FRD-MAS-04",
        "term": "Likely",
        "definition": "A reasonable degree of probability based on context."
      },
      {
        "id": "FRD-MAS-05",
        "term": "Third-party Information Resource",
        "definition": "Any _information resource_ that is not entirely included in the assessment for the _cloud service offering_ seeking authorization.",
        "referenced_fr": [
          "FRD-SCN-02"
        ]
      },
      {
        "id": "FRD-MAS-06",
        "term": "Cloud Service Offering",
        "definition": "A specific, packaged cloud computing product or service provided by a cloud service provider that can be used by a customer. FedRAMP assessment and authorization of the cloud computing product or service is based on the Minimum Assessment Standard."
      }
    ],
    "KSI": [
      {
        "id": "FRD-KSI-01",
        "term": "Regularly",
        "definition": "Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different requirements."
      }
    ]
  },
  "FRA": {
    "SCN": {
      "id": "FRA-SCN",
      "disclaimer": "Every cloud service provider is different, every architecture is different, and every environment is different. Best practices and technical assistance MUST NOT be used as a checklist. All examples are for discussion purposes ONLY.",
      "purpose": "This Technical Assistance helps stakeholders evaluate and label _significant changes_ by type as required by _FRR-SCN-03_. This assistance is designed for the 20x Phase One Pilot and Rev5 Closed Beta Balance Improvement Test. The Significant Change Notification Requirements will be tested, evaluated, and improved in partnership with stakeholders based on real-world experience.",
      "requirements": [
        {
          "id": "FRA-SCN-03",
          "applies_to": "FRR-SCN-03",
          "statement": "Once a change has been identified as a _significant change_ in general, FedRAMP recommends next determining if a change is of the type _routine recurring_. If it is not, work down from the highest impact to lowest to identify the type of change.\n\n1. Is it a _significant change_?\n2. If it is, is it a _routine recurring_ change?\n3. If it is not, is it an _impact categorization_ change?\n4. If it is not, is it a _transformative_ change?\n5. If it is not, then it is an _adaptive_ change."
        },
        {
          "id": "FRA-SCN-RR",
          "applies_to": "FRR-SCN-RR",
          "statement": "Activities that match the _routine recurring_ _significant change_ type are performed _regularly_ and routinely by cloud service providers to address flaws or vulnerabilities, address incidents, and generally perform the typical maintenance and service delivery changes expected during day-to-day operations.\n\nThese changes leverage mature processes and capabilities to identify, mitigate, and remediate risks as part of the change. They are often entirely automated and may occur without human intervention, even though they have an impact on security of the service.\n\nIf the activity does not occur _regularly_ and routinely then it cannot be a _significant change_ of this type (e.g., replacing all physical firewalls to remediate a vulnerability is obviously not regular or routine).",
          "examples": [
            {
              "id": "Ongoing operations",
              "key_tests": [
                "Routine care and feeding by staff during normal duties",
                "No major impact to service availability",
                "Does not require executive approval"
              ],
              "examples": [
                "Provisioning or deprovisioning capacity to support service elasticity",
                "Changing or tuning performance configurations for instances or services",
                "Updating and maintaining operational handling of information flows and protection across physical and logical networks (e.g., updating firewall rules)",
                "Generating or refreshing API or access tokens"
              ]
            },
            {
              "id": "Vulnerability Management",
              "key_tests": [
                "Minor, incremental patching or updates",
                "Significant refactoring or migration process NOT required",
                "No breaking changes"
              ],
              "examples": [
                "Updating security service or endpoint signatures",
                "Routine patching of devices, operating systems, software or libraries",
                "Updating and deploying code that applies normal fixes and improvements as part of a regular development cycle",
                "Vulnerability remediation activity that simply replaces a known-bad component(s) with a better version of the exact same thing, running in the exact same way with no changes to processes"
              ]
            }
          ]
        },
        {
          "id": "FRA-SCN-TF",
          "applies_to": "FRR-SCN-TF",
          "statement": "Activities that match the _transformative_ _significant change_ type are rare for a cloud service offering, adjusted for the size, scale, and complexity of the service. Small cloud service offerings may go years without _transformative_ changes, while hyperscale providers may release multiple _transformative_ changes per year.",
          "examples": [
            {
              "id": "Transformative changes",
              "key_tests": [
                "Alters the service risk profile or require new or significantly different actions to address customer responsibilities",
                "Requires significant new design, development and testing with discrete associated project planning, budget, marketing, etc.",
                "Requires extensive updates to security assessments, documentation, and how a large number of security requirements are met and validated"
              ],
              "examples": [
                "The addition, removal, or replacement of a critical third party service that handles a significant portion of information (e.g., IaaS change)",
                "Increasing the security categorization of a service within the offering that actively handles federal information (does NOT include impact change of entire offering - see impact categorization change)",
                "Replacement of underlying management planes or paradigm shift in workload orchestration (e.g., bare-metal servers or virtual machines to containers, migration to kubernetes)",
                "Datacenter migration where large amounts of federal information is moved across boundaries different from normal day-to-day operations",
                "Adding a new AI-based capability that impacts federal information in a different way than existing services or capabilities (such as integrating a new third-party service or training on federal information)"
              ]
            }
          ]
        },
        {
          "id": "FRA-SCN-AD",
          "applies_to": "FRR-SCN-AD",
          "statement": "Activities that match the _adaptive_ _significant change_ type are a frequent and normal part of iteratively improving a service by deploying new functionality or modifying existing functionality in a way that is typically transparent to customers and does not introduce significant new security risks.\n\nIn general, most changes that do not happen _regularly_ will be _adaptive_ changes. This change type deliberately covers a wide range of activities in a way that requires assessment and consideration.",
          "examples": [
            {
              "id": "Service adjustments",
              "key_tests": [
                "Requires minimal changes to security plans or procedures",
                "Requires some careful planning and project management to implement, but does not rise to the level of planning required for transformative changes",
                "Requires verification of existing functionality and secure configuration after implementation"
              ],
              "examples": [
                "Updates to operating systems, containers, virtual machines, software or libraries with known breaking changes, complex steps, or service disruption",
                "Deploying larger than normal incremental feature improvements in code or libraries that are the work of multiple weeks of development efforts but are not considered a major new service",
                "Changing cryptographic modules where the new module meets the same standards and characteristics of the former",
                "Replacing a like-for-like component where some security plan or procedure adjustments are required (e.g., scanning tool or managed database swap)",
                "Adding models to existing approved AI services without exposing federal information to new services"
              ]
            }
          ]
        }
      ]
    }
  },
  "KSI": {
    "CED": {
      "id": "KSI-CED",
      "name": "Cybersecurity Education",
      "indicator": "A secure cloud service provider will continuously educate their employees on cybersecurity measures, testing them regularly to ensure their knowledge is satisfactory.",
      "requirements": [
        {
          "id": "KSI-CED-01",
          "statement": "Ensure all employees receive security awareness training",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "at-2",
              "title": "Literacy Training and Awareness"
            },
            {
              "control_id": "at-2.2",
              "title": "Insider Threat"
            },
            {
              "control_id": "at-2.3",
              "title": "Social Engineering and Mining"
            },
            {
              "control_id": "at-4",
              "title": "Training Records"
            }
          ]
        },
        {
          "id": "KSI-CED-02",
          "statement": "Require role-specific training for high risk roles, including at least roles with privileged access",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "at-2",
              "title": "Literacy Training and Awareness"
            },
            {
              "control_id": "at-3",
              "title": "Role-based Training"
            },
            {
              "control_id": "sr-11.1",
              "title": "Anti-counterfeit Training"
            }
          ]
        }
      ]
    },
    "CMT": {
      "id": "KSI-CMT",
      "name": "Change Management",
      "indicator": "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly.",
      "requirements": [
        {
          "id": "KSI-CMT-01",
          "statement": "Log and monitor system modifications",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "au-2",
              "title": "Event Logging"
            },
            {
              "control_id": "cm-3",
              "title": "Configuration Change Control"
            },
            {
              "control_id": "cm-4.2",
              "title": "Verification of Controls"
            },
            {
              "control_id": "cm-6",
              "title": "Configuration Settings"
            },
            {
              "control_id": "ma-2",
              "title": "Controlled Maintenance"
            }
          ]
        },
        {
          "id": "KSI-CMT-02",
          "statement": "Execute changes though redeployment of version controlled immutable resources rather than direct modification wherever possible",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-2",
              "title": "Baseline Configuration"
            },
            {
              "control_id": "cm-3",
              "title": "Configuration Change Control"
            },
            {
              "control_id": "cm-5",
              "title": "Access Restrictions for Change"
            },
            {
              "control_id": "cm-6",
              "title": "Configuration Settings"
            },
            {
              "control_id": "cm-7",
              "title": "Least Functionality"
            },
            {
              "control_id": "cm-8.1",
              "title": "Updates During Installation and Removal"
            },
            {
              "control_id": "si-3",
              "title": "Malicious Code Protection"
            }
          ]
        },
        {
          "id": "KSI-CMT-03",
          "statement": "Implement automated testing and validation of changes prior to deployment",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-3",
              "title": "Configuration Change Control"
            },
            {
              "control_id": "cm-3.2",
              "title": "Testing, Validation, and Documentation of Changes"
            },
            {
              "control_id": "si-2",
              "title": "Flaw Remediation"
            }
          ]
        },
        {
          "id": "KSI-CMT-04",
          "statement": "Have a documented change management procedure",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-3",
              "title": "Configuration Change Control"
            },
            {
              "control_id": "cm-3.4",
              "title": "Security and Privacy Representatives"
            },
            {
              "control_id": "cm-5",
              "title": "Access Restrictions for Change"
            },
            {
              "control_id": "cm-7.1",
              "title": "Periodic Review"
            },
            {
              "control_id": "cm-9",
              "title": "Configuration Management Plan"
            }
          ]
        },
        {
          "id": "KSI-CMT-05",
          "statement": "Evaluate the risk and potential impact of any change",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-7.4",
              "title": "Risk Monitoring"
            },
            {
              "control_id": "cm-3.4",
              "title": "Security and Privacy Representatives"
            },
            {
              "control_id": "cm-4",
              "title": "Impact Analyses"
            },
            {
              "control_id": "si-2",
              "title": "Flaw Remediation"
            }
          ]
        }
      ]
    },
    "CNA": {
      "id": "KSI-CNA",
      "name": "Cloud Native Architecture",
      "indicator": "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system.",
      "requirements": [
        {
          "id": "KSI-CNA-01",
          "statement": "Configure ALL information resources to limit inbound and outbound traffic",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-17.3",
              "title": "Managed Access Control Points"
            },
            {
              "control_id": "ca-9",
              "title": "Internal System Connections"
            }
          ]
        },
        {
          "id": "KSI-CNA-02",
          "statement": "Design systems to minimize the attack surface and minimize lateral movement if compromised",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-17.3",
              "title": "Managed Access Control Points"
            },
            {
              "control_id": "ca-9",
              "title": "Internal System Connections"
            }
          ]
        },
        {
          "id": "KSI-CNA-03",
          "statement": "Use logical networking and related capabilities to enforce traffic flow controls",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-17.3",
              "title": "Managed Access Control Points"
            },
            {
              "control_id": "ca-9",
              "title": "Internal System Connections"
            },
            {
              "control_id": "sc-7",
              "title": "Boundary Protection"
            }
          ]
        },
        {
          "id": "KSI-CNA-04",
          "statement": "Use immutable infrastructure with strictly defined functionality and privileges by default",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-2",
              "title": "Baseline Configuration"
            },
            {
              "control_id": "si-3",
              "title": "Malicious Code Protection"
            }
          ]
        },
        {
          "id": "KSI-CNA-05",
          "statement": "Have denial of service protection",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "sc-5",
              "title": "Denial-of-service Protection"
            }
          ]
        },
        {
          "id": "KSI-CNA-06",
          "statement": "Design systems for high availability and rapid recovery",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": []
        },
        {
          "id": "KSI-CNA-07",
          "statement": "Ensure cloud-native information resources are implemented based on host provider's best practices and documented guidance",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-17.3",
              "title": "Managed Access Control Points"
            },
            {
              "control_id": "cm-2",
              "title": "Baseline Configuration"
            },
            {
              "control_id": "pl-10",
              "title": "Baseline Selection"
            }
          ]
        }
      ]
    },
    "IAM": {
      "id": "KSI-IAM",
      "name": "Identity and Access Management",
      "indicator": "A secure cloud service offering will protect user data, control access, and apply zero trust principles.",
      "requirements": [
        {
          "id": "KSI-IAM-01",
          "statement": "Enforce multi-factor authentication (MFA) using methods that are difficult to intercept or impersonate (phishing-resistant MFA) for all user authentication",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2",
              "title": "Account Management"
            },
            {
              "control_id": "ia-2",
              "title": "Identification and Authentication (Organizational Users)"
            },
            {
              "control_id": "ia-2.1",
              "title": "Multi-factor Authentication to Privileged Accounts"
            },
            {
              "control_id": "ia-2.2",
              "title": "Multi-factor Authentication to Non-privileged Accounts"
            },
            {
              "control_id": "ia-2.8",
              "title": "Access to Accounts — Replay Resistant"
            },
            {
              "control_id": "ia-8",
              "title": "Identification and Authentication (Non-organizational Users)"
            }
          ]
        },
        {
          "id": "KSI-IAM-02",
          "statement": "Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2",
              "title": "Account Management"
            },
            {
              "control_id": "ac-3",
              "title": "Access Enforcement"
            },
            {
              "control_id": "ia-2.1",
              "title": "Multi-factor Authentication to Privileged Accounts"
            },
            {
              "control_id": "ia-2.2",
              "title": "Multi-factor Authentication to Non-privileged Accounts"
            },
            {
              "control_id": "ia-2.8",
              "title": "Access to Accounts Replay Resistant"
            },
            {
              "control_id": "ia-5.1",
              "title": "Password-based Authentication"
            },
            {
              "control_id": "ia-5.2",
              "title": "Public Key-based Authentication"
            },
            {
              "control_id": "ia-5.6",
              "title": "Protection of Authenticators"
            },
            {
              "control_id": "ia-6",
              "title": "Authentication Feedback"
            }
          ]
        },
        {
          "id": "KSI-IAM-03",
          "statement": "Enforce appropriately secure authentication methods for non-user accounts and services",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2",
              "title": "Account Management"
            },
            {
              "control_id": "ac-4",
              "title": "Information Flow Enforcement"
            },
            {
              "control_id": "ia-3",
              "title": "Device Identification and Authentication"
            },
            {
              "control_id": "ia-5.2",
              "title": "Public Key-based Authentication"
            }
          ]
        },
        {
          "id": "KSI-IAM-04",
          "statement": "Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2",
              "title": "Account Management"
            },
            {
              "control_id": "ac-2.2",
              "title": "Automated Temporary and Emergency Account Management"
            },
            {
              "control_id": "ac-2.3",
              "title": "Disable Accounts"
            },
            {
              "control_id": "ac-2.4",
              "title": "Automated Audit Actions"
            },
            {
              "control_id": "ac-2.6",
              "title": "Dynamic Privilege Management"
            },
            {
              "control_id": "ac-3",
              "title": "Access Enforcement"
            },
            {
              "control_id": "ac-4",
              "title": "Information Flow Enforcement"
            },
            {
              "control_id": "ac-5",
              "title": "Separation of Duties"
            },
            {
              "control_id": "ac-6",
              "title": "Least Privilege"
            },
            {
              "control_id": "ac-6.1",
              "title": "Authorize Access to Security Functions"
            },
            {
              "control_id": "ac-6.2",
              "title": "Non-privileged Access for Nonsecurity Functions"
            },
            {
              "control_id": "ac-6.5",
              "title": "Privileged Accounts"
            },
            {
              "control_id": "ac-6.7",
              "title": "Review of User Privileges"
            },
            {
              "control_id": "ac-6.9",
              "title": "Log Use of Privileged Functions"
            },
            {
              "control_id": "ac-6.10",
              "title": "Prohibit Non-privileged Users from Executing Privileged Functions"
            },
            {
              "control_id": "ac-7",
              "title": "Unsuccessful Logon Attempts"
            },
            {
              "control_id": "ac-17",
              "title": "Remote Access"
            },
            {
              "control_id": "au-9.4",
              "title": "Access by Subset of Privileged Users"
            },
            {
              "control_id": "cm-5",
              "title": "Access Restrictions for Change"
            },
            {
              "control_id": "cm-7",
              "title": "Least Functionality"
            },
            {
              "control_id": "cm-9",
              "title": "Configuration Management Plan"
            },
            {
              "control_id": "ia-4",
              "title": "Identifier Management"
            },
            {
              "control_id": "ia-4.4",
              "title": "Identify User Status"
            },
            {
              "control_id": "ia-7",
              "title": "Cryptographic Module Authentication"
            },
            {
              "control_id": "ps-2",
              "title": "Position Risk Designation"
            },
            {
              "control_id": "ps-3",
              "title": "Personnel Screening"
            },
            {
              "control_id": "ps-4",
              "title": "Personnel Termination"
            },
            {
              "control_id": "ps-5",
              "title": "Personnel Transfer"
            },
            {
              "control_id": "ps-6",
              "title": "Access Agreements"
            },
            {
              "control_id": "ps-9",
              "title": "Position Descriptions"
            },
            {
              "control_id": "sc-39",
              "title": "Process Isolation"
            }
          ]
        },
        {
          "id": "KSI-IAM-05",
          "statement": "Apply zero trust design principles",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2.5",
              "title": "Inactivity Logout"
            },
            {
              "control_id": "ac-2.6",
              "title": "Dynamic Privilege Management"
            },
            {
              "control_id": "ac-3",
              "title": "Access Enforcement"
            },
            {
              "control_id": "ac-4",
              "title": "Information Flow Enforcement"
            },
            {
              "control_id": "ac-6",
              "title": "Least Privilege"
            },
            {
              "control_id": "ac-12",
              "title": "Session Termination"
            },
            {
              "control_id": "ac-14",
              "title": "Permitted Actions Without Identification or Authentication"
            },
            {
              "control_id": "ac-17",
              "title": "Remote Access"
            },
            {
              "control_id": "ac-17.1",
              "title": "Monitoring and Control"
            },
            {
              "control_id": "ac-17.2",
              "title": "Protection of Confidentiality and Integrity Using Encryption"
            },
            {
              "control_id": "ac-17.3",
              "title": "Managed Access Control Points"
            },
            {
              "control_id": "ac-20",
              "title": "Use of External Systems"
            },
            {
              "control_id": "ac-20.1",
              "title": "Limits on Authorized Use"
            },
            {
              "control_id": "cm-9",
              "title": "Configuration Management Plan"
            },
            {
              "control_id": "ia-2",
              "title": "Identification and Authentication (Organizational Users)"
            },
            {
              "control_id": "ia-3",
              "title": "Device Identification and Authentication"
            },
            {
              "control_id": "ia-4",
              "title": "Identifier Management"
            },
            {
              "control_id": "ia-4.4",
              "title": "Identify User Status"
            },
            {
              "control_id": "ia-5.2",
              "title": "Public Key-based Authentication"
            },
            {
              "control_id": "ia-11",
              "title": "Re-authentication"
            },
            {
              "control_id": "ps-2",
              "title": "Position Risk Designation"
            },
            {
              "control_id": "ps-3",
              "title": "Personnel Screening"
            },
            {
              "control_id": "ps-4",
              "title": "Personnel Termination"
            },
            {
              "control_id": "ps-5",
              "title": "Personnel Transfer"
            },
            {
              "control_id": "ps-6",
              "title": "Access Agreements"
            },
            {
              "control_id": "sc-20",
              "title": "Secure Name/Address Resolution Service (Authoritative Source)"
            },
            {
              "control_id": "sc-21",
              "title": "Secure Name/Address Resolution Service (Recursive or Caching Resolver)"
            },
            {
              "control_id": "sc-22",
              "title": "Architecture and Provisioning for Name/Address Resolution Service"
            },
            {
              "control_id": "sc-39",
              "title": "Process Isolation"
            },
            {
              "control_id": "si-3",
              "title": "Malicious Code Protection"
            }
          ]
        },
        {
          "id": "KSI-IAM-06",
          "statement": "Automatically disable or otherwise secure accounts with privileged access in response to suspicious activity",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2",
              "title": "Account Management"
            },
            {
              "control_id": "ac-2.1",
              "title": "Automated System Account Management"
            },
            {
              "control_id": "ac-2.3",
              "title": "Disable Accounts"
            },
            {
              "control_id": "ac-2.13",
              "title": "Disable Accounts for High-risk Individuals"
            },
            {
              "control_id": "ac-7",
              "title": "Unsuccessful Logon Attempts"
            },
            {
              "control_id": "ps-4",
              "title": "Personnel Termination"
            },
            {
              "control_id": "ps-8",
              "title": "Personnel Sanctions"
            }
          ]
        }
      ]
    },
    "INR": {
      "id": "KSI-INR",
      "name": "Incident Reporting",
      "indicator": "A secure cloud service offering will document, report, and analyze security incidents to ensure regulatory compliance and continuous security improvement.",
      "requirements": [
        {
          "id": "KSI-INR-01",
          "statement": "Report incidents according to FedRAMP requirements and cloud service provider policies",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ir-4",
              "title": "Incident Handling"
            },
            {
              "control_id": "ir-4.1",
              "title": "Automated Incident Handling Processes"
            },
            {
              "control_id": "ir-6",
              "title": "Incident Reporting"
            },
            {
              "control_id": "ir-6.1",
              "title": "Automated Reporting"
            },
            {
              "control_id": "ir-7",
              "title": "Incident Response Assistance"
            },
            {
              "control_id": "ir-7.1",
              "title": "Automation Support for Availability of Information and Support"
            },
            {
              "control_id": "ir-8",
              "title": "Incident Response Plan"
            }
          ]
        },
        {
          "id": "KSI-INR-02",
          "statement": "Maintain a log of incidents and periodically review past incidents for patterns or vulnerabilities",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ir-3",
              "title": "Incident Response Testing"
            },
            {
              "control_id": "ir-4",
              "title": "Incident Handling"
            },
            {
              "control_id": "ir-4.1",
              "title": "Automated Incident Handling Processes"
            },
            {
              "control_id": "ir-5",
              "title": "Incident Monitoring"
            },
            {
              "control_id": "ir-8",
              "title": "Incident Response Plan"
            }
          ]
        },
        {
          "id": "KSI-INR-03",
          "statement": "Generate after action reports and regularly incorporate lessons learned into operations",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ir-3",
              "title": "Incident Response Testing"
            },
            {
              "control_id": "ir-4",
              "title": "Incident Handling"
            },
            {
              "control_id": "ir-4.1",
              "title": "Automated Incident Handling Processes"
            },
            {
              "control_id": "ir-8",
              "title": "Incident Response Plan"
            }
          ]
        }
      ]
    },
    "MLA": {
      "id": "KSI-MLA",
      "name": "Monitoring, Logging, and Auditing",
      "indicator": "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes.",
      "requirements": [
        {
          "id": "KSI-MLA-01",
          "statement": "Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistent logging of events, activities, and changes",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "au-2",
              "title": "Event Logging"
            },
            {
              "control_id": "au-3",
              "title": "Content of Audit Records"
            },
            {
              "control_id": "au-3.1",
              "title": "Additional Audit Information"
            },
            {
              "control_id": "au-4",
              "title": "Audit Log Storage Capacity"
            },
            {
              "control_id": "au-5",
              "title": "Response to Audit Logging Process Failures"
            },
            {
              "control_id": "au-6.1",
              "title": "Automated Process Integration"
            },
            {
              "control_id": "au-6.3",
              "title": "Correlate Audit Record Repositories"
            },
            {
              "control_id": "au-7",
              "title": "Audit Record Reduction and Report Generation"
            },
            {
              "control_id": "au-7.1",
              "title": "Automatic Processing"
            },
            {
              "control_id": "au-8",
              "title": "Time Stamps"
            },
            {
              "control_id": "au-9",
              "title": "Protection of Audit Information"
            },
            {
              "control_id": "au-11",
              "title": "Audit Record Retention"
            }
          ]
        },
        {
          "id": "KSI-MLA-02",
          "statement": "Regularly review and audit logs",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2.4",
              "title": "Automated Audit Actions"
            },
            {
              "control_id": "ac-6.9",
              "title": "Log Use of Privileged Functions"
            },
            {
              "control_id": "au-2",
              "title": "Event Logging"
            },
            {
              "control_id": "au-6",
              "title": "Audit Record Review, Analysis, and Reporting"
            },
            {
              "control_id": "si-4",
              "title": "System Monitoring"
            }
          ]
        },
        {
          "id": "KSI-MLA-03",
          "statement": "Rapidly detect and remediate or mitigate vulnerabilities",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "au-5",
              "title": "Response to Audit Logging Process Failures"
            },
            {
              "control_id": "ca-7",
              "title": "Continuous Monitoring"
            },
            {
              "control_id": "ra-5",
              "title": "Vulnerability Monitoring and Scanning"
            },
            {
              "control_id": "ra-5.2",
              "title": "Update Vulnerabilities to Be Scanned"
            },
            {
              "control_id": "sa-22",
              "title": "Unsupported System Components"
            },
            {
              "control_id": "si-2",
              "title": "Flaw Remediation"
            },
            {
              "control_id": "si-5",
              "title": "Security Alerts, Advisories, and Directives"
            }
          ]
        },
        {
          "id": "KSI-MLA-04",
          "statement": "Perform authenticated vulnerability scanning on information resources",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-7",
              "title": "Continuous Monitoring"
            },
            {
              "control_id": "ra-5",
              "title": "Vulnerability Monitoring and Scanning"
            },
            {
              "control_id": "si-3",
              "title": "Malicious Code Protection"
            }
          ]
        },
        {
          "id": "KSI-MLA-05",
          "statement": "Perform Infrastructure as Code and configuration evaluation and testing",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-7",
              "title": "Continuous Monitoring"
            },
            {
              "control_id": "cm-2",
              "title": "Baseline Configuration"
            },
            {
              "control_id": "cm-6",
              "title": "Configuration Settings"
            }
          ]
        },
        {
          "id": "KSI-MLA-06",
          "statement": "Centrally track and prioritize the mitigation and/or remediation of identified vulnerabilities",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-5",
              "title": "Plan of Action and Milestones"
            }
          ]
        }
      ]
    },
    "PIY": {
      "id": "KSI-PIY",
      "name": "Policy and Inventory",
      "indicator": "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured.",
      "requirements": [
        {
          "id": "KSI-PIY-01",
          "statement": "Have an up-to-date information resource inventory or code defining all deployed assets, software, and services",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-7.5",
              "title": "Authorized Software Allow-by-exception"
            },
            {
              "control_id": "cm-8",
              "title": "System Component Inventory"
            },
            {
              "control_id": "cm-8.1",
              "title": "Updates During Installation and Removal"
            },
            {
              "control_id": "cm-12",
              "title": "Information Location"
            },
            {
              "control_id": "cm-12.1",
              "title": "Automated Tools to Support Information Location"
            },
            {
              "control_id": "cp-2.8",
              "title": "Identify Critical Assets"
            }
          ]
        },
        {
          "id": "KSI-PIY-02",
          "statement": "Have policies outlining the security objectives of all information resources",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "at-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "au-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "ca-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "cm-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "cp-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "cp-2.1",
              "title": "Coordinate with Related Plans"
            },
            {
              "control_id": "cp-4.1",
              "title": "Coordinate with Related Plans"
            },
            {
              "control_id": "ia-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "ir-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "ma-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "mp-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "pe-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "pl-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "pl-2",
              "title": "System Security and Privacy Plans"
            },
            {
              "control_id": "pl-4",
              "title": "Rules of Behavior"
            },
            {
              "control_id": "pl-4.1",
              "title": "Social Media and External Site/Application Usage Restrictions"
            },
            {
              "control_id": "ps-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "ra-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "sa-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "sc-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "si-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "sr-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "sr-2",
              "title": "Supply Chain Risk Management Plan"
            },
            {
              "control_id": "sr-3",
              "title": "Supply Chain Controls and Processes"
            },
            {
              "control_id": "sr-11",
              "title": "Component Authenticity"
            }
          ]
        },
        {
          "id": "KSI-PIY-03",
          "statement": "Maintain a vulnerability disclosure program",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ra-5.11",
              "title": "Public Disclosure Program"
            }
          ]
        },
        {
          "id": "KSI-PIY-04",
          "statement": "Build security considerations into the Software Development Lifecycle and align with CISA Secure By Design principles",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-5",
              "title": "Separation of Duties"
            },
            {
              "control_id": "sa-3",
              "title": "System Development Life Cycle"
            }
          ]
        },
        {
          "id": "KSI-PIY-05",
          "statement": "Document methods used to evaluate information resource implementations",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": []
        },
        {
          "id": "KSI-PIY-06",
          "statement": "Have a dedicated staff and budget for security with executive support, commensurate with the size, complexity, scope, and risk of the service offering",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-5",
              "title": "Separation of Duties"
            },
            {
              "control_id": "cp-2.1",
              "title": "Coordinate with Related Plans"
            },
            {
              "control_id": "cp-4.1",
              "title": "Coordinate with Related Plans"
            },
            {
              "control_id": "ir-3.2",
              "title": "Coordination with Related Plans"
            },
            {
              "control_id": "sa-2",
              "title": "Allocation of Resources"
            },
            {
              "control_id": "sa-3",
              "title": "System Development Life Cycle"
            },
            {
              "control_id": "sr-2.1",
              "title": "Establish SCRM Team"
            }
          ]
        },
        {
          "id": "KSI-PIY-07",
          "statement": "Document risk management decisions for software supply chain security",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-7.4",
              "title": "Risk Monitoring"
            }
          ]
        }
      ]
    },
    "RPL": {
      "id": "KSI-RPL",
      "name": "Recovery Planning",
      "indicator": "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss during incidents and contingencies.",
      "requirements": [
        {
          "id": "KSI-RPL-01",
          "statement": "Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cp-2.3",
              "title": "Resume Mission and Business Functions"
            },
            {
              "control_id": "cp-10",
              "title": "System Recovery and Reconstitution"
            }
          ]
        },
        {
          "id": "KSI-RPL-02",
          "statement": "Develop and maintain a recovery plan that aligns with the defined recovery objectives",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cp-2",
              "title": "Contingency Plan"
            },
            {
              "control_id": "cp-2.3",
              "title": "Resume Mission and Business Functions"
            },
            {
              "control_id": "cp-6",
              "title": "Alternate Storage Site"
            },
            {
              "control_id": "cp-10",
              "title": "System Recovery and Reconstitution"
            }
          ]
        },
        {
          "id": "KSI-RPL-03",
          "statement": "Perform system backups aligned with recovery objectives",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-2.3",
              "title": "Retention of Previous Configurations"
            },
            {
              "control_id": "cp-6",
              "title": "Alternate Storage Site"
            },
            {
              "control_id": "cp-9",
              "title": "System Backup"
            },
            {
              "control_id": "cp-10",
              "title": "System Recovery and Reconstitution"
            },
            {
              "control_id": "cp-10.2",
              "title": "Transaction Recovery"
            },
            {
              "control_id": "si-12",
              "title": "Information Management and Retention"
            }
          ]
        },
        {
          "id": "KSI-RPL-04",
          "statement": "Regularly test the capability to recover from incidents and contingencies",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cp-4",
              "title": "Contingency Plan Testing"
            },
            {
              "control_id": "cp-6",
              "title": "Alternate Storage Site"
            },
            {
              "control_id": "cp-9.1",
              "title": "Testing for Reliability and Integrity"
            },
            {
              "control_id": "cp-10",
              "title": "System Recovery and Reconstitution"
            },
            {
              "control_id": "ir-3",
              "title": "Incident Response Testing"
            }
          ]
        }
      ]
    },
    "SVC": {
      "id": "KSI-SVC",
      "name": "Service Configuration",
      "indicator": "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources.",
      "requirements": [
        {
          "id": "KSI-SVC-01",
          "statement": "Harden and review network and system configurations",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ma-2",
              "title": "Controlled Maintenance"
            },
            {
              "control_id": "sc-7",
              "title": "Boundary Protection"
            },
            {
              "control_id": "sc-39",
              "title": "Process Isolation"
            },
            {
              "control_id": "si-4",
              "title": "System Monitoring"
            },
            {
              "control_id": "sr-10",
              "title": "Inspection of Systems or Components"
            }
          ]
        },
        {
          "id": "KSI-SVC-02",
          "statement": "Encrypt or otherwise secure network traffic",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-1",
              "title": "Policy and Procedures"
            },
            {
              "control_id": "ac-17.2",
              "title": "Protection of Confidentiality and Integrity Using Encryption"
            },
            {
              "control_id": "cp-9.8",
              "title": "Cryptographic Protection"
            },
            {
              "control_id": "sc-13",
              "title": "Cryptographic Protection"
            },
            {
              "control_id": "sc-20",
              "title": "Secure Name/Address Resolution Service (Authoritative Source)"
            },
            {
              "control_id": "sc-21",
              "title": "Secure Name/Address Resolution Service (Recursive or Caching Resolver)"
            },
            {
              "control_id": "sc-22",
              "title": "Architecture and Provisioning for Name/Address Resolution Service"
            }
          ]
        },
        {
          "id": "KSI-SVC-03",
          "statement": "Encrypt all federal and sensitive information at rest",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-20.2",
              "title": "Portable Storage Devices — Restricted Use"
            },
            {
              "control_id": "cm-12",
              "title": "Information Location"
            },
            {
              "control_id": "cp-9.8",
              "title": "Cryptographic Protection"
            },
            {
              "control_id": "sc-13",
              "title": "Cryptographic Protection"
            }
          ]
        },
        {
          "id": "KSI-SVC-04",
          "statement": "Manage configuration centrally",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-2.4",
              "title": "Automated Audit Actions"
            },
            {
              "control_id": "cm-2",
              "title": "Baseline Configuration"
            },
            {
              "control_id": "cm-2.2",
              "title": "Automation Support for Accuracy and Currency"
            },
            {
              "control_id": "cm-2.3",
              "title": "Retention of Previous Configurations"
            },
            {
              "control_id": "cm-6",
              "title": "Configuration Settings"
            },
            {
              "control_id": "pl-10",
              "title": "Baseline Selection"
            },
            {
              "control_id": "sa-5",
              "title": "System Documentation"
            },
            {
              "control_id": "si-5",
              "title": "Security Alerts, Advisories, and Directives"
            },
            {
              "control_id": "sr-10",
              "title": "Inspection of Systems or Components"
            }
          ]
        },
        {
          "id": "KSI-SVC-05",
          "statement": "Enforce system and information resource integrity through cryptographic means",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "cm-2.2",
              "title": "Automation Support for Accuracy and Currency"
            },
            {
              "control_id": "cm-8.3",
              "title": "Automated Unauthorized Component Detection"
            },
            {
              "control_id": "sc-13",
              "title": "Cryptographic Protection"
            },
            {
              "control_id": "sr-10",
              "title": "Inspection of Systems or Components"
            }
          ]
        },
        {
          "id": "KSI-SVC-06",
          "statement": "Use automated key management systems to manage, protect, and regularly rotate digital keys and certificates",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-17.2",
              "title": "Protection of Confidentiality and Integrity Using Encryption"
            },
            {
              "control_id": "ia-5.2",
              "title": "Public Key-based Authentication"
            },
            {
              "control_id": "ia-5.6",
              "title": "Protection of Authenticators"
            },
            {
              "control_id": "sc-12",
              "title": "Cryptographic Key Establishment and Management"
            }
          ]
        },
        {
          "id": "KSI-SVC-07",
          "statement": "Use a consistent, risk-informed approach for applying security patches",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-7.4",
              "title": "Risk Monitoring"
            },
            {
              "control_id": "ra-5",
              "title": "Vulnerability Monitoring and Scanning"
            },
            {
              "control_id": "ra-7",
              "title": "Risk Response"
            }
          ]
        }
      ]
    },
    "TPR": {
      "id": "KSI-TPR",
      "name": "Third-Party Information Resources",
      "indicator": "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources.",
      "requirements": [
        {
          "id": "KSI-TPR-01",
          "statement": "Identify all third-party information resources",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ca-3",
              "title": "Information Exchange"
            },
            {
              "control_id": "cm-10",
              "title": "Software Usage Restrictions"
            },
            {
              "control_id": "ps-7",
              "title": "External Personnel Security"
            }
          ]
        },
        {
          "id": "KSI-TPR-02",
          "statement": "Regularly confirm that services handling federal information or are likely to impact the confidentiality, integrity, or availability of federal information are FedRAMP authorized and securely configured",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-21",
              "title": "Information Sharing"
            },
            {
              "control_id": "ca-3",
              "title": "Information Exchange"
            },
            {
              "control_id": "cm-12",
              "title": "Information Location"
            },
            {
              "control_id": "ps-7",
              "title": "External Personnel Security"
            },
            {
              "control_id": "sa-2",
              "title": "Allocation of Resources"
            },
            {
              "control_id": "sa-4",
              "title": "Acquisition Process"
            },
            {
              "control_id": "sa-9",
              "title": "External System Services"
            }
          ]
        },
        {
          "id": "KSI-TPR-03",
          "statement": "Identify and prioritize mitigation of potential supply chain risks",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-20",
              "title": "Use of External Systems"
            },
            {
              "control_id": "ra-3.1",
              "title": "Supply Chain Risk Assessment"
            },
            {
              "control_id": "sa-9",
              "title": "External System Services"
            },
            {
              "control_id": "sa-22",
              "title": "Unsupported System Components"
            },
            {
              "control_id": "sr-5",
              "title": "Acquisition Strategies, Tools, and Methods"
            }
          ]
        },
        {
          "id": "KSI-TPR-04",
          "statement": "Monitor third party software information resources for upstream vulnerabilities, with contractual notification requirements or active monitoring services",
          "applied_impact_levels": [
            "Low"
          ],
          "controls": [
            {
              "control_id": "ac-20",
              "title": "Use of External Systems"
            },
            {
              "control_id": "ca-3",
              "title": "Information Exchange"
            },
            {
              "control_id": "ir-6.3",
              "title": "Supply Chain Coordination"
            },
            {
              "control_id": "ps-7",
              "title": "External Personnel Security"
            },
            {
              "control_id": "ra-5",
              "title": "Vulnerability Monitoring and Scanning"
            },
            {
              "control_id": "sa-9",
              "title": "External System Services"
            },
            {
              "control_id": "si-5",
              "title": "Security Alerts, Advisories, and Directives"
            },
            {
              "control_id": "sr-5",
              "title": "Acquisition Strategies, Tools, and Methods"
            },
            {
              "control_id": "sr-8",
              "title": "Notification Agreements"
            }
          ]
        }
      ]
    }
  }
}