Skip to content
FedRAMP Rules Hub
JSON — GET /api/baseline

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Class B scope155 controls · 18 families

JSON — GET /api/baseline

Every control in the class B Rev5 baseline, and what proves it. Baseline membership is FedRAMP Rev5; evidence status is our authored AWS and pipeline overlays (AWS overlay v3.0.0, pipeline overlay v0.8.0).

Evidencecontrols in the class B baseline

with a recipe
50 of 155
KSI-reached, no recipe
45 of 155the authoring backlog
orphan → narrative
60 of 155no telemetry will ever prove these — narrative means a document you write

Control index

evidence

155 controls

legend
recipe— an authored recipe collects evidence for this controlKSI only— a Key Security Indicator reaches it, but no recipe is authored yetorphan— no Key Security Indicator reaches it — a person writes it up instead = in the class B, C and D baselines, left to right
where do the control titles come from?

The FedRAMP rules reference NIST 800-53 controls by id only — no title text is in that dataset. The titles here are NIST’s own, read from a pinned commit of the OSCAL catalog that usnistgov/oscal-content publishes, and the full statement is on each control’s page. Hover a row to read its title; the KSI column still shows what reaches the control, which is the thing that decides what you have to do about it.

AC11 in scope · 5 covered

AT5 in scope · 0 covered

AU10 in scope · 8 covered

CA9 in scope · 1 covered

CM9 in scope · 5 covered

CP6 in scope · 2 covered

IA16 in scope · 5 covered

IR7 in scope · 5 covered

MA4 in scope · 0 covered

  • MA-01 — Policy and ProceduresIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-02 — Controlled MaintenanceIn baseline BKSI onlyKSI-CMT-LMC KSI-SVC-EIS
  • MA-04 — Nonlocal MaintenanceIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MA-05 — Maintenance PersonnelIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

MP4 in scope · 0 covered

  • MP-01 — Policy and ProceduresIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-02 — Media AccessIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-06 — Media SanitizationIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • MP-07 — Media UseIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PE10 in scope · 0 covered

  • PE-01 — Policy and ProceduresIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-02 — Physical Access AuthorizationsIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-03 — Physical Access ControlIn baseline Borphan—annual — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-06 — Monitoring Physical AccessIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-08 — Visitor Access RecordsIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-12 — Emergency LightingIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-13 — Fire ProtectionIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-14 — Environmental ControlsIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-15 — Water Damage ProtectionIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PE-16 — Delivery and RemovalIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PL7 in scope · 0 covered

  • PL-01 — Policy and ProceduresIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-02 — System Security and Privacy PlansIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-04 — Rules of BehaviorIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-04 (01) — Social Media and External Site/Application Usage RestrictionsIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
  • PL-08 — Security and Privacy ArchitecturesIn baseline BKSI onlyKSI-PIY-RSD KSI-SVC-EIS
  • PL-10 — Baseline SelectionIn baseline BKSI onlyKSI-CNA-IBP KSI-SVC-ACM
  • PL-11 — Baseline TailoringIn baseline Borphan— — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.

PS9 in scope · 2 covered

RA8 in scope · 1 covered

SA9 in scope · 2 covered

SC14 in scope · 8 covered

SI6 in scope · 4 covered

SR11 in scope · 2 covered