Crosswalk pair
FedRAMP Rev5 Class B and FedRAMP Consolidated Rules, control by control
12 canonical controls in Keel’s library satisfy clauses of both FedRAMP Rev5 Class B and FedRAMP Consolidated Rules. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
The overlap
What the two libraries have in common
Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.
12
Controls that satisfy both
Canonical controls that crosswalk to at least one clause of each.
50
In Keel’s library for FedRAMP Rev5 Class B
24% of them also map to FedRAMP Consolidated Rules.
23
In Keel’s library for FedRAMP Consolidated Rules
52% of them also map to FedRAMP Rev5 Class B.
48
Evidence artifacts expected
Across the shared controls, from Keel’s evidence guidance. Gathered once.
-
12 controls of 50 in Keel’s library for FedRAMP Rev5 Class B also map to FedRAMP Consolidated Rules.
-
FedRAMP Consolidated Rules 52%
12 controls of 23 in Keel’s library for FedRAMP Consolidated Rules also map to FedRAMP Rev5 Class B.
The mapping
Controls that satisfy both
Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.
| Canonical control | FedRAMP Rev5 Class B clauses | FedRAMP Consolidated Rules clauses |
|---|---|---|
| Data Protection & Privacy | ||
| Cryptographic key management Wherever the organization uses cryptography, the keys behind it are managed to written requirements rather than to whatever the tool defaulted to - because a strong algorithm on a badly held key protects nothing. The requirements state, for each class of key, how it is generated and to what strength, how it is distributed to the parties that need it and how they prove they are entitled to it, where and how it is stored, how it is used and by what, how often it is rotated, how it is revoked and destroyed when it is compromised or retired, and how it is recovered or escrowed where the information would otherwise become unreadable. A key’s life is bounded and its retirement is planned, so rotation is a scheduled act rather than a crisis. Private keys are held so that only the entity they identify can use them, and access to them is enforced technically rather than by convention. PUBLIC KEY CERTIFICATES are issued under a certificate policy the organization has approved, or obtained from a service provider it has approved, and only trust anchors it has approved are present in the trust stores and certificate stores it manages - a store nobody has curated is a list of parties allowed to impersonate anybody. Where the organization relies on public key authentication, an authenticated certificate is mapped to the account of the individual or group it belongs to rather than accepted as an identity in itself, certificates are validated by building and verifying a certification path to an accepted trust anchor including a check of revocation status, and revocation data is cached locally so that path discovery and validation still work when the source of that data cannot be reached. Authentication to the cryptographic modules themselves - the hardware security module, the key vault, the token, the software module - uses mechanisms that satisfy the laws, standards and guidelines that apply to it, rather than a shared operator password. Key material is inventoried, its owner recorded, and its use logged, so the question of what a compromised key opened is answered from a record. Where the keys protect payment or account data the storage rules are tighter and are stated rather than inferred: keys are held in the fewest locations and by the fewest custodians the operation can run with, a key that encrypts another key is protected at least as strongly as the key it wraps and is kept apart from it, key material at rest is held only in a form the organization has approved in advance - inside a secure cryptographic device, split into components or shares that no single custodian holds in full, or encrypted under a separate key-encrypting key - and every custodian acknowledges the responsibilities of the role in writing before taking it on. | IA-7, SC-12 | CMU-CSO-CMD |
| Data classification & handling Information is classified and handled per its sensitivity, with rules for labeling and protection - including the everyday handling rules that stop it being seen, overheard or picked up by people with no business reading it, so exposure that happens incidentally alongside legitimate work is limited rather than accepted. The handling rules are written to cover disclosure that nobody intended as much as disclosure that somebody chose, they say what an unauthorized disclosure is against the organization’s own privacy and confidentiality rules rather than leaving that to judgment in the moment, and they reach every medium the information travels in - spoken, on paper, on a screen and in a system - because the incidental exposure they exist to limit does not respect the boundary between an administrative, a physical and a technical safeguard. Labeling is the procedure that makes the classification visible, and it is defined rather than left to habit: there is a label for each level of the scheme, a rule for how the label is applied in each form the information takes - a document, an email, a file, a database field, a screen, a report, a piece of removable media, a printed page - and, where a system supports it, the label is carried in metadata so it can be acted on automatically rather than only read. The person who creates or receives the information applies the label at that point rather than later, the label travels with the information when it is copied, extracted, exported or transferred so a copy does not arrive unclassified, and information derived from or aggregated out of classified sources is labeled for what the combination is worth rather than for what the least sensitive input was. Where a label would itself disclose something, an agreed alternative is used and recorded, and the procedure covers what to do when unlabeled information is found. On storage media the marking carries more than the level: it states the distribution limitations that apply and any handling caveats that travel with the contents, so somebody who picks the item up knows what they may do with it without having to ask. Where the organization exempts a class of media from marking because it never leaves a controlled area, that exemption is defined and recorded as a decision rather than practiced as an omission. Underneath the scheme sits a documented DATA MANAGEMENT PROCESS that the classification and the handling rules are derived from: it states how sensitivity is decided, who owns each category of data, how each category is handled, the retention limits that apply to it and what disposal it requires, and it is reviewed and updated on a defined cadence and whenever a change to the organization would alter it. That process is also what the DATA FLOWS are documented against - where each category of information originates, which systems and processes it moves between, and where it crosses out to a service provider - recorded as documentation somebody maintains rather than reconstructed when a question is asked, and reviewed on the same cadence. | RA-2 | MAS-CSO-FLO, MAS-CSO-MDI |
| Encryption in transit & at rest Strong cryptography protects sensitive data in transit over public networks and at rest in storage. The mechanisms are chosen to do two things and are judged against both: prevent unauthorized disclosure of the information, and prevent or detect unauthorized change to it - in transit, so a message altered between sender and receiver is caught rather than delivered, and at rest, so a stored record cannot be modified undetectably by somebody with access to the storage but not to the key. Which information is protected at rest, and on which system components, is decided and recorded rather than left to whatever the platform encrypts by default. The scope named explicitly reaches the end-user device as well as the server: data held on laptops, desktops and other end-user devices that carry sensitive information is encrypted at the device or volume level, so a device that leaves the building is an object somebody lost rather than a disclosure. And data in transit is encrypted wherever it is sensitive, not only where it crosses a public network - a session between two internal systems is protected on the same terms when what it carries warrants it. Where a law, a regulation or a contract requires the cryptography to be VALIDATED rather than merely strong, the organization uses a cryptographic module that carries the validation that instrument names, and it confirms that validation against the specific module, version and operating mode actually deployed rather than inferring it from the product’s name - because a validated module run outside the configuration it was validated in is not a validated module, and the certificate that proves the point is held as evidence rather than assumed to exist. | SC-8, SC-8(1), SC-13, SC-28, SC-28(1) | CMU-CSO-CAT, CMU-CSO-UVM |
| Review of publicly posted information Publishing information where anybody can read it is treated as a disclosure decision, and somebody is accountable for it. The individuals authorized to make information publicly accessible are designated by name or role rather than being whoever holds the credentials to the website, the app listing, the code repository, the social account or the document portal. Those individuals are trained for the specific failure this control exists to prevent: that nonpublic information ends up on a public surface - personal data, security detail, internal identifiers, customer names, unreleased plans, credentials or keys embedded in a file, metadata and revision history inside a document, and anything the organization’s classification scheme says does not leave. Proposed content is reviewed before it is posted, against stated criteria rather than a general instruction to be careful, and the review is recorded so it can be shown to have happened. Publication is not the end of it: what is already published is re-reviewed on a defined cadence, because a page that was safe when written can be made unsafe by what was published beside it later, and anything nonpublic that is found is removed - with the removal treated as a potential incident and assessed as one rather than quietly corrected. The scope covers every public surface the organization actually operates, including the ones not owned by the marketing function. Public statements made during and after an incident fall inside this control rather than outside it: an update on incident recovery goes out through the designated individuals, on the channels the organization has approved for it, against messaging agreed in advance with the legal, security and communications roles - so what is said publicly about an incident is reviewed on the same terms as everything else the organization publishes, at the moment that is hardest to do. | AC-22 | SCG-CSO-PUB, VER-RPT-NID |
| Infrastructure & Operations | ||
| Asset inventory An inventory of hardware, software, and information assets with assigned owners, in which the movement of equipment and removable media into, out of, and within the organization’s premises is recorded against the person responsible for it. The record is maintained by the acts that change it rather than by a periodic sweep: installing a component, removing one, or updating a system updates the inventory as part of that work, and the estate is scanned for hardware, software and firmware that is present but not authorized, with the response to an unauthorized component - disable its network access, isolate it, remove it, notify a defined role - decided in advance. The inventory answers WHERE INFORMATION IS as well as what exists: for the categories of information the organization has defined as sensitive, it records where that information is processed and stored, which system components host it, and which users and roles can reach it, and it is updated when any of those change - with automated tools used to locate that information across components and to confirm the required protections are actually in place there, rather than relying on what a system was designed to hold. Each asset also carries its support status: the date vendor support ends is recorded, and a component that reaches end of support is replaced, or is covered by an alternative source of continued support that the organization has arranged and recorded, rather than left in service because it still runs. The inventory is kept current by discovery as well as by the acts that change it: an active discovery tool interrogates the network on a defined frequency, a passive tool identifies assets from the traffic they generate, the DHCP and address-management logs are read on a defined cadence so an address issued to something nobody registered surfaces, and automated software-inventory tooling documents what is installed across the estate rather than relying on a manual return. Support status decides authorization rather than merely being recorded: only software the vendor still supports is designated authorized in the inventory, and software that is unsupported and carries no documented exception setting out its mitigating controls and the residual risk somebody accepted is designated unauthorized, so the process that removes unauthorized software picks it up. What the register holds about those categories of information is itself a DATA INVENTORY: for each data type the organization has designated, the record carries the metadata that makes it usable - what the data is, who owns it, how it is classified, where it came from, what it is retained for and for how long - so the question of what data exists is answered from the register rather than from the systems one at a time. And the register tracks lifecycle STATE as well as existence: each system, device, piece of software, service and data set carries where it has reached in its life - requested, acquired, deployed, in service, superseded, withdrawn, disposed of - with the acts that move it between those states recorded against it, so an asset is managed from acquisition through operation to disposal rather than entered once and forgotten. | CM-8, SA-22 | MAS-CSO-IIR |
| Change management Changes to systems and software are requested, reviewed, tested, approved, and tracked. Each request is explicitly approved OR DISAPPROVED by a role authorized to decide it, rather than proceeding because nobody objected, and the decision, the reason behind it and the change itself are written to a durable record - so the log shows what was refused as well as what shipped, and a change that went in without a decision is visible as one. A proposed change is analyzed for what it would do to security and privacy BEFORE it is approved, so the decision is taken with that answer in hand rather than reported afterwards; where the change is significant, the analysis is recorded and the roles who own the affected controls see it. Change control is a body rather than a queue: security and privacy representatives are members of the group that approves changes, so the question is asked in the room instead of by exception. A change is tested, validated and documented before it is finalized and moved into the running system, in an environment that resembles the one it is going to. After it lands, the controls it touched are verified to be implemented correctly, still operating as intended, and still producing the result the organization’s security and privacy requirements call for - verified, not assumed from the fact that the deployment succeeded. Who may make a change at all is restricted: the physical and logical access needed to alter a system is defined, documented, approved and enforced, and it is a narrower set than the people who may use the system. EXCEPTIONS are managed on the same terms as changes: a departure from a standard, a baseline or a policy is requested, assessed for the risk it creates, approved by a role authorized to accept that risk, recorded with a scope and an expiry, and tracked to closure or to a deliberate renewal - so an exception is a change somebody decided rather than a state nobody revisits. | CM-4, CM-5 | VDR-CSO-DAC |
| Secure architecture & engineering principles The organization writes down the engineering principles its systems are designed to, and applies them to everything it builds or significantly changes rather than to whatever the architect of the day remembers. The principles state positions the design has to answer: defense in depth, so no single control failing exposes the system; least privilege for every identity, service and process; secure defaults, so an unconfigured system is safe rather than open; failing into a secure state rather than an available one; minimizing attack surface by removing rather than protecting what is not needed; validating at each layer rather than trusting a caller because it is internal; separating duties in the design so no single component or person can complete a sensitive action alone; and designing for the assumption that any component may be compromised. Each principle carries enough guidance to be applied by an engineer without asking what it means. Designs are reviewed against the principles at a defined point before build starts, a deviation is recorded and approved with its reason rather than argued informally, and the review reaches systems that are bought or outsourced as well as ones written in-house. The principles are revisited as threats, platforms and technologies change, and the changes are pushed to the teams designing against them. The output is an ARCHITECTURE, not only a set of positions: security and privacy architectures are developed and maintained for the organization’s systems, describing how the requirements are met, how the information is protected through the whole of its life, how privacy risk to individuals is minimized by design, and how the design assumptions and dependencies hold - and they are reconciled with the organization’s enterprise architecture rather than drawn beside it, reviewed and updated as the environment changes, and reflected in the acquisition and procurement decisions taken from them. Four specific separations follow from the principles and are stated so they cannot be argued away. User-facing functionality, including user interfaces and services, is kept physically or logically separate from system management functionality, so an administrative capability is not reachable from the surface every user already has. Unauthorized and unintended transfer of information through SHARED SYSTEM RESOURCES is prevented, so memory, storage, registers, caches and buffers released by one user or process do not deliver residual data to the next. Each executing process is maintained in a separate execution domain, so one process cannot read or modify another’s state. And memory is protected by mechanisms that prevent unauthorized code from executing in it. Two of the principles are stated concretely because they are the ones a design quietly skips. MEDIATION: every operation a user asks for is validated at the point it is acted on rather than trusted because an earlier screen allowed it, and input is subjected to explicit, documented checking for size, data type, and the ranges or formats the operation accepts - the position being that user input is never trusted, including input that arrived by way of the organization’s own front end. REUSE OVER REINVENTION: the security-sensitive components of an application - identity and authentication, authorization, cryptography, audit logging - are built on vetted platform mechanisms, established libraries or services rather than written afresh, and only standardized, currently accepted and widely reviewed cryptographic algorithms are used, because a bespoke implementation of a solved problem is where the implementation errors are. | PL-8, SC-39 | VDR-CSO-DFR |
| Secure configuration & baselines What a secure configuration IS is defined before anything is deployed, and drift away from it is detected rather than discovered. Baselines are written for each class of hardware, software, service and network component the organization runs, covering the settings that carry security consequence: vendor defaults changed, default and unused accounts removed or disabled, unnecessary services, ports, features and sample content removed, logging and time settings enabled, authentication and encryption settings set, and the administrative interfaces restricted. Baselines are derived from a stated hardening source and from the organization’s own requirements, are version-controlled, are approved before use, and are reviewed when the product changes, when a new threat makes a previous setting inadequate, or on a defined cadence. What is actually deployed is compared against the baseline automatically and on a schedule, and a difference raises an alert to somebody who either corrects it or records an approved exception with a reason, an owner and an expiry. Configuration is applied by an automated, repeatable mechanism wherever possible, so a rebuilt system comes back hardened rather than as somebody remembers it. A change to a baseline goes through the change process, and the record of what a system’s configuration was at a given time is retained - previous versions are kept deliberately and for a stated number of generations, so a system can be rolled back to a known-good configuration rather than rebuilt from memory. The settings themselves are set to the most restrictive mode consistent with what the system has to do, and any deviation from that is approved, documented with the operational requirement behind it, and monitored rather than left implicit. LEAST FUNCTIONALITY is the rule the baseline expresses: a system provides only the capabilities its purpose requires, and the functions, ports, protocols, software and services that purpose does not require are disabled, restricted or removed. That is not a one-time act at build - the estate is reviewed on a defined cadence to find functions, ports, protocols, software and services that have become unnecessary or are insecure by current understanding, and what the review finds is disabled or removed. Two artifacts sit alongside the baselines. A configuration management plan states the roles and responsibilities for the process, the process itself, the configuration items that are placed under configuration management and how they are identified, and it is protected against unauthorized disclosure and modification in its own right because it maps the estate. And the documentation for each product is obtained or written at acquisition rather than assumed to be findable later, in two parts. Administrator documentation covers secure configuration, installation and operation, the effective use and maintenance of the security and privacy functions, and the known vulnerabilities in how the administrative and privileged functions are configured and used. User documentation covers the security and privacy functions a user can reach and how to use them effectively, the ways of interacting with the system that keep it secure and protect individual privacy, and what the user is responsible for. Both are kept current, protected, and distributed to the administrators and users who need them. Where documentation is unavailable or does not exist, the attempts to obtain it are recorded and the organization takes a decided response - writing what it needs itself, or treating the gap as a risk. The process itself is a document and not only a set of files: how a baseline is written, approved, applied and reviewed is recorded and re-approved on a defined cadence and whenever a change to the organization would alter it - and network infrastructure carries its own such process rather than being covered by the one written for servers and end-user devices, because the devices, the settings and the people who change them are different. HOW assets are managed is part of the configuration: configuration is held as version-controlled infrastructure-as-code wherever the platform allows, and administrative interfaces are reached only over protocols that authenticate and encrypt the session - an insecure management protocol is not used unless it is operationally unavoidable, and then as a recorded exception. The hardening source is industry-recommended rather than invented here, and the templates reach the whole of an application’s infrastructure - the operating system under it, the database, the web server, the container image, and the platform and software services it is assembled from - so software written in-house cannot weaken the configuration it is deployed onto. The written process is issued as well as held: the hardening policy and the procedures under it go to the people who build, deploy and maintain the components they govern, so the standard is in use by the people it binds rather than merely current in a repository, and each part of it names the role answerable for carrying it out. | CM-1, CM-2, CM-6, CM-7, SA-5 | SCG-CSO-AUP, SCG-CSO-RSC, SCG-CSO-SDF, SCG-ENH-API, SCG-ENH-CMP, SCG-ENH-EXP, SCG-ENH-MRG |
| Vulnerability management Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications, fed by current information about threats and weaknesses collected from outside the organization as well as from its own scans - vendor and industry security advisories for the software actually in use, and the threat feeds, bulletins and sector reporting that describe how systems like these are being attacked now - which is gathered continuously rather than at the next scan, evaluated for whether it applies here, and used to decide what is looked for and what is fixed first. The set of vulnerabilities the scanner actually looks for is updated on a defined cadence and whenever new ones are identified and reported, so a scan reflects what is known today rather than what the tool shipped with. Scans that need to see inside a system are given the privileged access to do so, granted deliberately to the scanning activity for the components that require it rather than left to run blind and report clean. Whether a fix is actually present is confirmed by automated mechanisms that report, per component, which security-relevant software and firmware updates are installed - so remediation is evidenced by the estate rather than by a closed ticket. The organization also runs a PUBLIC intake: a reporting channel that anybody outside the organization can find and use to report a vulnerability they have discovered in its systems or products, with a stated scope, a stated way to report, an acknowledgment, and a route into the same triage and remediation process everything else uses. All of this rests on a documented system and information integrity policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. The scanning and the fixing are each defined rather than assumed. Internal assets are scanned automatically on a defined cadence, both with credentials and without, because the two find different things - one shows what is installed, the other shows what somebody with no account can see. Externally exposed assets are scanned on their own cadence, which is at least as frequent, because they are reachable by everyone. Patching is automated for operating systems and, on the same terms and cadence, for the applications running on them, so an application left to be updated by whoever notices is not the gap. Remediation runs to a documented, risk-based strategy - what is fixed first, within what period, and who may approve an exception - reviewed on a defined cadence rather than written once. The public intake is governed by a written vulnerability handling policy that names how to report, who is responsible for handling a report, and the steps from intake through assignment and remediation to remediation testing, with reports tracked in a system that records a severity rating and the timing of identification, analysis and remediation, so how long the organization takes is a measured number rather than an impression. | RA-5, RA-5(2), RA-5(11), SI-1, SI-2 | VDR-CSO-ADT, VDR-CSO-AKE, VDR-CSO-DET, VDR-CSO-FAV, VDR-CSO-MSP, VDR-CSO-RES, VDR-TFR-KEV, VDR-TFR-MVF, VDR-TFR-MVX, VDR-TFR-NMV, VDR-TFR-PCD, VDR-TFR-PDD, VDR-TFR-PSD, VDR-TFR-PVR, VDR-TFR-RMN, VER-EVA-AIA, VER-EVA-EFA, VER-EVA-EFP, VER-EVA-EIR, VER-EVA-ELX, VER-EVA-EPA, VER-EVA-GRV, VER-RPT-AVI, VER-RPT-HLO, VER-RPT-PER, VER-RPT-VDT, VER-TFR-EVU, VER-TFR-MHR, VER-TFR-MRH |
| Resilience & Continuity | ||
| Incident response A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents, and to mitigate - so far as is practicable - the harmful effect of a use or disclosure of personal data the organization knows breached its own policies or the law. Each incident is recorded together with its outcome - what happened, what was done about it and how it ended - as a record of that incident, which is a different artifact from the plan being documented. The mitigation duty runs to violations by the organization itself AND to violations by the processors, vendors and other parties handling that data on its behalf: the plan reaches an incident somebody else caused with the organization’s data, so learning of one triggers the same containment and remediation as an incident inside its own walls rather than a request that the other party deal with it. Where an incident carries a duty to tell someone outside the organization, the plan discharges it on the clock the applicable law sets - and, where the organization has itself committed to a timeframe for telling people, on that commitment too, whether or not a statute stands behind it - rather than whenever the investigation happens to conclude: whether an incident is notifiable is decided against written criteria rather than argued after the fact, the regulator or supervisory authority is notified inside the deadline that regime states and inside any shorter or additional timeframe the organization has committed to, the people whose data is affected are told where the risk to them warrants it and, independently of that threshold, wherever the organization’s own privacy commitments say they will be told - so individual notification is never conditioned solely on a statutory risk test - and any other party that law or those commitments require to be notified is told on the same terms, and where a deadline is missed the notification itself explains the delay instead of passing over it. What a notification carries is fixed in advance rather than composed under pressure: to a regulator it describes at least the nature of what happened, including where possible the categories and the approximate number of people affected and of records involved; names a contact point - the data protection officer where there is one, otherwise whoever can answer - from whom more can be obtained; describes the likely consequences; and describes the measures taken or proposed to address it, including where appropriate the measures that will mitigate its adverse effects. Where all of that cannot honestly be given at once, it is given in phases without further undue delay rather than held back until the picture is complete, and each phase says what is still outstanding. The communication to the people affected describes what happened in clear and plain language and carries the same contact point, likely consequences and measures. Every compromise of personal data is documented whether or not it turned out to be notifiable - the facts of it, its effects, and the remedial action taken - in enough detail that a regulator reviewing the file can verify for itself that the notification decision was the right one. Recovery is part of the plan rather than something that follows it: service and data are restored to a state the organization has established is clean, the restoration is verified before the system is handed back to use, the cause is determined rather than inferred from the symptom, and the weakness the incident exposed is fixed - with the plan itself updated for what the incident showed about it. Between the report and the response sits an assessment step that is a duty of its own: every reported event is assessed against written categorization and prioritization criteria by people competent to apply them, and the decision - whether this event is an incident, and at what severity - is recorded with the reasoning, so two assessors reach the same answer and an event judged not to be an incident is a decision somebody made rather than a report that went quiet. Learning is treated as a duty separate from fixing the incident in front of you: the types, volumes and costs of incidents are quantified and reviewed as a set for what the pattern says, and what is learned is pushed back into the controls, the risk assessment, the awareness material and the assessment criteria themselves rather than staying in the report of the incident that produced it. The plan is a documented incident response policy with supporting procedures, issued to the roles it binds, owned by a named role, and reviewed and updated on a defined cadence. The people the plan assigns roles to are trained for them: within a defined period of taking the role, again when the system or the plan changes in a way that affects it, and on a defined cadence thereafter, with the content revised for what exercises and real incidents have shown. The capability is TESTED rather than assumed - on a defined cadence, using tests the organization has chosen for the purpose, such as a tabletop, a walkthrough, a simulation or a live exercise - and that testing is coordinated with the organizational elements that own the related plans, incident response and contingency planning in particular, so the two do not each assume the other. Handling and reporting are supported by automated mechanisms rather than run by hand at the worst moment: detection, triage, tracking, evidence collection and the routing of a report are automated so far as the organization’s systems allow, and the reports that must go outside are produced and sent by mechanism rather than composed under pressure. The roles the plan assigns are named across the functions an incident actually needs and not security alone - legal, IT, information security, facilities, communications, human resources, the responders and the analysts - and the assignment is reviewed on a defined cadence. So are the CHANNELS: a primary and a secondary mechanism for communicating and reporting during an incident are chosen in advance, on the understanding that the ordinary one may be the thing that is unavailable or compromised, and both are reviewed on the same cadence. The plan reaches the parties outside the organization that an incident actually involves: the suppliers and other third parties whose services, staff or systems would be part of the response are named in it, take part in the planning and the exercises, and are called on during response and recovery on terms agreed in advance rather than negotiated during the event. ESCALATION is a defined step and not a judgment call - the plan states the conditions under which an incident is escalated or elevated, whether by severity, by elapsed time, by the functions it has reached or by the obligations it triggers, who it goes to at each step, and what changes when it gets there. The analysis establishes what actually took place during the incident as well as why it happened, and the incident’s magnitude - how many systems, records and people it reached, and over what period - is estimated as the investigation proceeds and then VALIDATED against the evidence rather than left at the first number anybody said out loud. Notification runs to internal stakeholders as well as external ones, so the functions inside the organization that have to act on an incident are told on the same defined terms as the parties outside it. And containment is followed by ERADICATION as a separate act: the malicious code, the unauthorized access and the persistence left behind are removed and their removal is confirmed, so a contained incident is not mistaken for a finished one. | IR-1, IR-2, IR-4, IR-5, IR-6, IR-8 | IEC-CSO-DPR, IEC-CSO-EFI, IEC-CSO-EFR, VER-TFR-IRI, VER-TFR-NRI |
| Security event reporting channel Everybody who works for the organization has a route to report anything they observe or suspect about information security, and they know what it is without having to look for it. The channel is named in onboarding and in awareness material, is available at the times events actually happen rather than in office hours only, and takes reports from contractors and temporary staff as well as employees. People are told what to report - not only confirmed breaches, but a lost or stolen device, a suspicious message, a control that is not working, a mistaken disclosure, an access somebody should not have, an unfamiliar person in a secure area, a weakness noticed in a system - and told to report promptly rather than after establishing whether it is real, because triage is the organization’s job and not the reporter’s. A report is acknowledged so the reporter knows it arrived, is routed straight into the event assessment and incident process rather than into a queue somebody reads weekly, and its outcome is fed back where that is appropriate, because silence teaches people not to report again. Reporting in good faith carries no penalty even where the reporter caused the event, and that is stated rather than implied; reports are recorded so volume and type can be reviewed for what they say about awareness. Behind the channel sits an assistance resource, not just an inbox: a named function - a help desk, an assistance group, an on-call responder, an external retainer - that is an integral part of the organization’s incident response capability and that ADVISES AND ASSISTS the person reporting, so somebody who has clicked a link or lost a laptop is helped through what to do next rather than told their ticket is open. Automated mechanisms make that assistance and the information behind it easier to reach - a self-service route to the reporting channel and the guidance, current contact details, and the material a responder needs surfaced where the incident is being handled rather than filed elsewhere. The channel is described in a written process rather than only advertised: it states how quickly a report is expected, who it goes to, by what mechanism, and the minimum information a report should carry, and that process is made available to everybody in the workforce rather than held by the team that operates it. It is reviewed on a defined cadence and whenever a change to the organization would alter it. The channel carries information OUTWARD as well as inward: what is known about an adverse event is provided to the staff authorized to act on it and to the tools that handle it - the ticketing, case and detection systems - at the point they need it, so a report does not stop at whoever received it. And every report is TRIAGED AND VALIDATED before it becomes anything else: whether the thing reported actually happened, whether it is what the reporter took it for, and what it should be treated as, decided against written criteria by a role competent to apply them and recorded with the reasoning. | IR-7 | IEC-CSO-AIR, IEC-CSO-FIR, IEC-CSO-IIR, IEC-CSO-OIR |
| Third-party Risk | ||
| ICT supply chain security Security expectations follow the technology the organization buys, not just the supplier it bought it from. Before acquisition, the security requirements for an ICT product or service are stated as conditions of purchase, and the supplier is required to propagate them to the sub-suppliers, components and services it in turn depends on rather than absorbing them at its own boundary; where the supplier will not or cannot, that is a recorded acceptance decision rather than a silent gap. The organization establishes what a delivered component is actually made of - the third-party and open-source software inside it, and where it came from - and keeps that record current enough to answer whether a newly published vulnerability affects it. Delivery is verified rather than assumed: the component received matches the one ordered, comes from the expected source, and its integrity can be checked. Through life, the supplier’s security advisories and the product’s support status are watched, so end-of-support arrives as a planned migration rather than as a discovery; and the sourcing risk itself - a supplier failing, being acquired, or ceasing to supply a component with no substitute - is assessed for the components the organization cannot operate without. That assessment is performed as a SUPPLY CHAIN RISK ASSESSMENT in its own right, covering the systems, components and services the organization depends on, and is updated on a defined cadence and whenever the supply chain materially changes - a new supplier, a change of ownership, a relocated manufacturing or support function, a substituted component. The program is written down: a documented supply chain risk management policy with supporting procedures under a named owner, reviewed on a defined cadence; and a supply chain risk management plan covering the whole life of the system from acquisition through operation to disposal, protected from unauthorized disclosure and modification because it maps the organization’s dependencies, and reviewed and updated on a defined cadence. A team is stood up to lead and support that work, drawn from the functions that actually decide - procurement, engineering, security, legal - rather than left as one person’s additional duty. Procurement is one of the controls: the acquisition strategies, contract tools and methods the organization uses are chosen to guard against, identify and mitigate supply chain risk, and agreements with suppliers and other entities in the chain set out what each party must notify the other of, disclose, or otherwise do when something changes or goes wrong. Delivered systems and components are inspected at defined times or on defined events to detect tampering, and an anti-counterfeit policy with supporting procedures exists to detect and prevent counterfeit components entering the estate, to report any that are found to the source, the authorities and the affected parties, and to train the personnel who receive, install and maintain equipment in what a counterfeit looks like across hardware, software and firmware. When an incident happens, information about it is shared with the providers of the affected products and services and with the other parties across the supply chain who need it, rather than treated as internal. For software the organization develops, that record is maintained as a BILL OF MATERIALS covering the third-party components in use and the ones a project intends to adopt, with the risk each component carries noted against it, and it is evaluated on a defined cadence - at least monthly - to pick up a change in a component or the loss of its support rather than waiting for an advisory to arrive. The program is not run beside the others: what the supply chain risk assessment finds enters the organization’s cybersecurity and enterprise risk registers, is assessed on the same criteria as every other risk, and feeds the same improvement process - so a supply chain finding competes for attention on equal terms instead of sitting in a document only procurement reads. How well the practices are working is monitored across the whole life of each technology product and service - at selection, at delivery, in operation and at retirement - rather than assessed once at purchase. And the suppliers the organization could not operate without are assessed BEFORE acquisition, against stated criteria and with the result recorded, so criticality is established while there is still the option not to buy. | RA-3(1), SR-1, SR-2, SR-2(1), SR-5, SR-8, SR-10, SR-11, SR-11(1) | MAS-CSO-TPR |
Beyond the pair
Where else this work counts
A framework is lit when a shared control above also maps to it. Unlit means none of them do, which is an absence rather than a judgment about that standard.
Also reached by these 12 controls
- AI Governance Essentials not reached
- Amazon Appstore Child-Directed Apps not reached
- Apple App Store Kids Category not reached
- CIS Critical Security Controls also reached
- COPPA also reached
- ESG Essentials not reached
- EU AI Act not reached
- FedRAMP 20x also reached
- FedRAMP Rev5 Class C also reached
- FedRAMP Rev5 Class D also reached
- GDPR also reached
- Google Play Families not reached
- HIPAA also reached
- ISO 9001 not reached
- ISO/IEC 27001 also reached
- ISO/IEC 42001 not reached
- NIST AI Risk Management Framework not reached
- NIST Cybersecurity Framework also reached
- NIST SP 800-171 also reached
- NIST SP 800-53 also reached
- PCI DSS also reached
- PIPEDA also reached
- SOC 2 also reached
- SOX (Sarbanes-Oxley) Section 404 also reached
- US Employment Law - Federal Baseline not reached
Nearby pairs
- FedRAMP Rev5 Class B and FedRAMP Rev5 Class C 50 shared controls
- FedRAMP Rev5 Class B and FedRAMP Rev5 Class D 50 shared controls
- FedRAMP Rev5 Class B and NIST SP 800-53 49 shared controls
- FedRAMP Rev5 Class B and ISO/IEC 27001 41 shared controls
- FedRAMP Rev5 Class B and NIST SP 800-171 36 shared controls
- FedRAMP Rev5 Class B and NIST Cybersecurity Framework 32 shared controls
The thesis
Why this is one project, not two
On a crosswalk-native model, FedRAMP Consolidated Rules mostly lights up controls you already built for FedRAMP Rev5 Class B. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.
Next step
Add FedRAMP Consolidated Rules to the work you already did
Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.