Gomes Security · Rev 5 to 20x

Your Rev 5 work counts toward 20x.

Computed, not generated · from FedRAMP's and NIST's published files · data as of October 4, 2026
← Home·Sources

FedRAMP 20x and FedRAMP Rev 5 rest on the same NIST controls. Pick your baseline. See which of your controls already feed a 20x indicator, and what is new.

Your baseline

Pick the FedRAMP Rev 5 baseline you work to. The numbers below change when you pick.

Showing the Moderate baseline.

FedRAMP's 20x pilots covered the Low and Moderate levels. FedRAMP also sorts offerings into four classes, A to D. Both are on fedramp.gov.

What carries

Controls in your baseline
323
The list FedRAMP publishes for this level.
Controls a 20x indicator points to
19962%
Count, and share of your baseline.
Not in your baseline: 10 more that indicators point to.
Indicators your baseline backs
36Fully backed
7Partly backed
1None in your baseline
Fully backed means every control it points to is in your baseline. Partly backed means some are. None means none are.
No control listed
2
KSI-CNA-OFA, KSI-PIY-RES
FedRAMP lists no control for these. We do not count them as covered.

The ten themes

FedRAMP groups its 46 indicators into ten themes. Each indicator points to NIST controls. Open a theme to see every control, with its official NIST title.

  • in your baseline
  • not in your baseline
  • no control listed

In each row, Full means fully backed. Part means partly backed. None means none of its controls are in your baseline. No control means FedRAMP lists none.

Cybersecurity Education

1Indicators0Full1Part0None0No control
  • KSI-CED-RAT
    Reviewing All Training
    Partly backed
    • AT-2
      Literacy Training and Awareness
      in your baseline
    • AT-2(2)
      Insider Threat
      in your baseline
    • AT-2(3)
      Social Engineering and Mining
      in your baseline
    • AT-3
      Role-based Training
      in your baseline
    • AT-3(5)
      Processing Personally Identifiable Information
      not in your baseline
    • AT-4
      Training Records
      in your baseline
    • CP-3
      Contingency Training
      in your baseline
    • IR-2
      Incident Response Training
      in your baseline
    • IR-2(3)
      Breach
      not in your baseline
    • PS-6
      Access Agreements
      in your baseline
    • SR-11(1)
      Anti-counterfeit Training
      in your baseline

Change Management

4Indicators4Full0Part0None0No control
  • KSI-CMT-LMC
    Logging Changes
    Fully backed
    • AU-2
      Event Logging
      in your baseline
    • CM-3
      Configuration Change Control
      in your baseline
    • CM-3(2)
      Testing, Validation, and Documentation of Changes
      in your baseline
    • CM-4(2)
      Verification of Controls
      in your baseline
    • CM-6
      Configuration Settings
      in your baseline
    • CM-8(3)
      Automated Unauthorized Component Detection
      in your baseline
    • MA-2
      Controlled Maintenance
      in your baseline
  • KSI-CMT-RMV
    Redeploying vs Modifying
    Fully backed
    • CM-2
      Baseline Configuration
      in your baseline
    • CM-3
      Configuration Change Control
      in your baseline
    • CM-5
      Access Restrictions for Change
      in your baseline
    • CM-6
      Configuration Settings
      in your baseline
    • CM-7
      Least Functionality
      in your baseline
    • CM-8(1)
      Updates During Installation and Removal
      in your baseline
    • SI-3
      Malicious Code Protection
      in your baseline
  • KSI-CMT-RVP
    Reviewing Change Procedures
    Fully backed
    • CM-3
      Configuration Change Control
      in your baseline
    • CM-3(2)
      Testing, Validation, and Documentation of Changes
      in your baseline
    • CM-3(4)
      Security and Privacy Representatives
      in your baseline
    • CM-5
      Access Restrictions for Change
      in your baseline
    • CM-7(1)
      Periodic Review
      in your baseline
    • CM-9
      Configuration Management Plan
      in your baseline
  • KSI-CMT-VTD
    Validating Throughout Deployment
    Fully backed
    • CM-3
      Configuration Change Control
      in your baseline
    • CM-3(2)
      Testing, Validation, and Documentation of Changes
      in your baseline
    • CM-4(2)
      Verification of Controls
      in your baseline
    • SI-2
      Flaw Remediation
      in your baseline

Cloud Native Architecture

8Indicators7Full0Part0None1No control
  • KSI-CNA-DFP
    Defining Functionality and Privileges
    Fully backed
    • CM-2
      Baseline Configuration
      in your baseline
    • SI-3
      Malicious Code Protection
      in your baseline
  • KSI-CNA-EIS
    Enforcing Intended State
    Fully backed
    • CA-2(1)
      Independent Assessors
      in your baseline
    • CA-7(1)
      Independent Assessment
      in your baseline
  • KSI-CNA-IBP
    Implementing Best Practices
    Fully backed
    • AC-17(3)
      Managed Access Control Points
      in your baseline
    • CM-2
      Baseline Configuration
      in your baseline
    • PL-10
      Baseline Selection
      in your baseline
  • KSI-CNA-MAT
    Minimizing Attack Surface
    Fully backed
    • AC-17(3)
      Managed Access Control Points
      in your baseline
    • AC-18(1)
      Authentication and Encryption
      in your baseline
    • AC-18(3)
      Disable Wireless Networking
      in your baseline
    • AC-20(1)
      Limits on Authorized Use
      in your baseline
    • CA-9
      Internal System Connections
      in your baseline
    • SC-7(3)
      Access Points
      in your baseline
    • SC-7(4)
      External Telecommunications Services
      in your baseline
    • SC-7(5)
      Deny by Default — Allow by Exception
      in your baseline
    • SC-7(8)
      Route Traffic to Authenticated Proxy Servers
      in your baseline
    • SC-8
      Transmission Confidentiality and Integrity
      in your baseline
    • SC-10
      Network Disconnect
      in your baseline
    • SI-10
      Information Input Validation
      in your baseline
    • SI-11
      Error Handling
      in your baseline
    • SI-16
      Memory Protection
      in your baseline
  • KSI-CNA-OFA
    Optimizing for Availability
    No control listed
    FedRAMP lists no control for this one. We do not count it as covered.
  • KSI-CNA-RNT
    Restricting Network Traffic
    Fully backed
    • AC-17(3)
      Managed Access Control Points
      in your baseline
    • CA-9
      Internal System Connections
      in your baseline
    • CM-7(1)
      Periodic Review
      in your baseline
    • SC-7(5)
      Deny by Default — Allow by Exception
      in your baseline
    • SI-8
      Spam Protection
      in your baseline
  • KSI-CNA-RVP
    Reviewing Protections
    Fully backed
    • SC-5
      Denial-of-service Protection
      in your baseline
    • SI-8
      Spam Protection
      in your baseline
    • SI-8(2)
      Automatic Updates
      in your baseline
  • KSI-CNA-ULN
    Using Logical Networking
    Fully backed
    • AC-12
      Session Termination
      in your baseline
    • AC-17(3)
      Managed Access Control Points
      in your baseline
    • CA-9
      Internal System Connections
      in your baseline
    • SC-4
      Information in Shared System Resources
      in your baseline
    • SC-7
      Boundary Protection
      in your baseline
    • SC-7(7)
      Split Tunneling for Remote Devices
      in your baseline
    • SC-8
      Transmission Confidentiality and Integrity
      in your baseline
    • SC-10
      Network Disconnect
      in your baseline

Identity and Access Management

6Indicators4Full2Part0None0No control
  • KSI-IAM-AAM
    Automating Account Management
    Fully backed
    • AC-2(2)
      Automated Temporary and Emergency Account Management
      in your baseline
    • AC-2(3)
      Disable Accounts
      in your baseline
    • AC-2(13)
      Disable Accounts for High-risk Individuals
      in your baseline
    • AC-6(7)
      Review of User Privileges
      in your baseline
    • IA-4(4)
      Identify User Status
      in your baseline
    • IA-12
      Identity Proofing
      in your baseline
    • IA-12(2)
      Identity Evidence
      in your baseline
    • IA-12(3)
      Identity Evidence Validation and Verification
      in your baseline
    • IA-12(5)
      Address Confirmation
      in your baseline
  • KSI-IAM-APM
    Adopting Passwordless Methods
    Fully backed
    • AC-2
      Account Management
      in your baseline
    • AC-3
      Access Enforcement
      in your baseline
    • IA-2
      Identification and Authentication (Organizational Users)
      in your baseline
    • IA-2(1)
      Multi-factor Authentication to Privileged Accounts
      in your baseline
    • IA-2(2)
      Multi-factor Authentication to Non-privileged Accounts
      in your baseline
    • IA-2(8)
      Access to Accounts — Replay Resistant
      in your baseline
    • IA-5
      Authenticator Management
      in your baseline
    • IA-5(1)
      Password-based Authentication
      in your baseline
    • IA-5(2)
      Public Key-based Authentication
      in your baseline
    • IA-5(6)
      Protection of Authenticators
      in your baseline
    • IA-6
      Authentication Feedback
      in your baseline
    • IA-8
      Identification and Authentication (Non-organizational Users)
      in your baseline
    • SC-23
      Session Authenticity
      in your baseline
  • KSI-IAM-ELP
    Ensuring Least Privilege
    Partly backed
    • AC-2(5)
      Inactivity Logout
      in your baseline
    • AC-2(6)
      Dynamic Privilege Management
      not in your baseline
    • AC-3
      Access Enforcement
      in your baseline
    • AC-4
      Information Flow Enforcement
      in your baseline
    • AC-6
      Least Privilege
      in your baseline
    • AC-12
      Session Termination
      in your baseline
    • AC-14
      Permitted Actions Without Identification or Authentication
      in your baseline
    • AC-17
      Remote Access
      in your baseline
    • AC-17(1)
      Monitoring and Control
      in your baseline
    • AC-17(2)
      Protection of Confidentiality and Integrity Using Encryption
      in your baseline
    • AC-17(3)
      Managed Access Control Points
      in your baseline
    • AC-20
      Use of External Systems
      in your baseline
    • AC-20(1)
      Limits on Authorized Use
      in your baseline
    • CM-2(7)
      Configure Systems and Components for High-risk Areas
      in your baseline
    • CM-9
      Configuration Management Plan
      in your baseline
    • IA-2
      Identification and Authentication (Organizational Users)
      in your baseline
    • IA-3
      Device Identification and Authentication
      in your baseline
    • IA-4
      Identifier Management
      in your baseline
    • IA-4(4)
      Identify User Status
      in your baseline
    • IA-5(2)
      Public Key-based Authentication
      in your baseline
    • IA-5(6)
      Protection of Authenticators
      in your baseline
    • IA-11
      Re-authentication
      in your baseline
    • PS-2
      Position Risk Designation
      in your baseline
    • PS-3
      Personnel Screening
      in your baseline
    • PS-4
      Personnel Termination
      in your baseline
    • PS-5
      Personnel Transfer
      in your baseline
    • PS-6
      Access Agreements
      in your baseline
    • SC-4
      Information in Shared System Resources
      in your baseline
    • SC-20
      Secure Name/Address Resolution Service (Authoritative Source)
      in your baseline
    • SC-21
      Secure Name/Address Resolution Service (Recursive or Caching Resolver)
      in your baseline
    • SC-22
      Architecture and Provisioning for Name/Address Resolution Service
      in your baseline
    • SC-23
      Session Authenticity
      in your baseline
    • SC-39
      Process Isolation
      in your baseline
    • SI-3
      Malicious Code Protection
      in your baseline
  • KSI-IAM-JIT
    Authorizing Just-in-Time
    Partly backed
    • AC-2
      Account Management
      in your baseline
    • AC-2(1)
      Automated System Account Management
      in your baseline
    • AC-2(2)
      Automated Temporary and Emergency Account Management
      in your baseline
    • AC-2(3)
      Disable Accounts
      in your baseline
    • AC-2(4)
      Automated Audit Actions
      in your baseline
    • AC-2(6)
      Dynamic Privilege Management
      not in your baseline
    • AC-3
      Access Enforcement
      in your baseline
    • AC-4
      Information Flow Enforcement
      in your baseline
    • AC-5
      Separation of Duties
      in your baseline
    • AC-6
      Least Privilege
      in your baseline
    • AC-6(1)
      Authorize Access to Security Functions
      in your baseline
    • AC-6(2)
      Non-privileged Access for Nonsecurity Functions
      in your baseline
    • AC-6(5)
      Privileged Accounts
      in your baseline
    • AC-6(7)
      Review of User Privileges
      in your baseline
    • AC-6(9)
      Log Use of Privileged Functions
      in your baseline
    • AC-6(10)
      Prohibit Non-privileged Users from Executing Privileged Functions
      in your baseline
    • AC-7
      Unsuccessful Logon Attempts
      in your baseline
    • AC-17
      Remote Access
      in your baseline
    • AC-20(1)
      Limits on Authorized Use
      in your baseline
    • AU-9(4)
      Access by Subset of Privileged Users
      in your baseline
    • CM-5
      Access Restrictions for Change
      in your baseline
    • CM-7
      Least Functionality
      in your baseline
    • CM-7(2)
      Prevent Program Execution
      in your baseline
    • CM-7(5)
      Authorized Software — Allow-by-exception
      in your baseline
    • CM-9
      Configuration Management Plan
      in your baseline
    • IA-4
      Identifier Management
      in your baseline
    • IA-4(4)
      Identify User Status
      in your baseline
    • IA-7
      Cryptographic Module Authentication
      in your baseline
    • PS-2
      Position Risk Designation
      in your baseline
    • PS-3
      Personnel Screening
      in your baseline
    • PS-4
      Personnel Termination
      in your baseline
    • PS-5
      Personnel Transfer
      in your baseline
    • PS-6
      Access Agreements
      in your baseline
    • PS-9
      Position Descriptions
      in your baseline
    • RA-5(5)
      Privileged Access
      in your baseline
    • SC-2
      Separation of System and User Functionality
      in your baseline
    • SC-23
      Session Authenticity
      in your baseline
    • SC-39
      Process Isolation
      in your baseline
  • KSI-IAM-SNU
    Securing Non-User Authentication
    Fully backed
    • AC-2
      Account Management
      in your baseline
    • AC-2(2)
      Automated Temporary and Emergency Account Management
      in your baseline
    • AC-4
      Information Flow Enforcement
      in your baseline
    • AC-6(5)
      Privileged Accounts
      in your baseline
    • IA-3
      Device Identification and Authentication
      in your baseline
    • IA-5(2)
      Public Key-based Authentication
      in your baseline
    • RA-5(5)
      Privileged Access
      in your baseline
  • KSI-IAM-SUS
    Responding to Suspicious Activity
    Fully backed
    • AC-2
      Account Management
      in your baseline
    • AC-2(1)
      Automated System Account Management
      in your baseline
    • AC-2(3)
      Disable Accounts
      in your baseline
    • AC-2(13)
      Disable Accounts for High-risk Individuals
      in your baseline
    • AC-7
      Unsuccessful Logon Attempts
      in your baseline
    • PS-4
      Personnel Termination
      in your baseline
    • PS-8
      Personnel Sanctions
      in your baseline

Incident Response

3Indicators2Full1Part0None0No control
  • KSI-INR-AAR
    Generating After Action Reports
    Fully backed
    • IR-3
      Incident Response Testing
      in your baseline
    • IR-4
      Incident Handling
      in your baseline
    • IR-4(1)
      Automated Incident Handling Processes
      in your baseline
    • IR-8
      Incident Response Plan
      in your baseline
  • KSI-INR-RIR
    Reviewing Incident Response Procedures
    Partly backed
    • IR-4
      Incident Handling
      in your baseline
    • IR-4(1)
      Automated Incident Handling Processes
      in your baseline
    • IR-6
      Incident Reporting
      in your baseline
    • IR-6(1)
      Automated Reporting
      in your baseline
    • IR-6(3)
      Supply Chain Coordination
      in your baseline
    • IR-7
      Incident Response Assistance
      in your baseline
    • IR-7(1)
      Automation Support for Availability of Information and Support
      in your baseline
    • IR-8
      Incident Response Plan
      in your baseline
    • IR-8(1)
      Breaches
      not in your baseline
    • SI-4(5)
      System-generated Alerts
      in your baseline
  • KSI-INR-RPI
    Reviewing Past Incidents
    Fully backed
    • IR-3
      Incident Response Testing
      in your baseline
    • IR-4
      Incident Handling
      in your baseline
    • IR-4(1)
      Automated Incident Handling Processes
      in your baseline
    • IR-5
      Incident Monitoring
      in your baseline
    • IR-8
      Incident Response Plan
      in your baseline

Monitoring, Logging, and Auditing

5Indicators5Full0Part0None0No control
  • KSI-MLA-ALA
    Authorizing Log Access
    Fully backed
    • SI-11
      Error Handling
      in your baseline
  • KSI-MLA-EVC
    Evaluating Configurations
    Fully backed
    • CA-7
      Continuous Monitoring
      in your baseline
    • CM-2
      Baseline Configuration
      in your baseline
    • CM-6
      Configuration Settings
      in your baseline
    • SI-7(7)
      Integration of Detection and Response
      in your baseline
  • KSI-MLA-LET
    Logging Event Types
    Fully backed
    • AC-2(4)
      Automated Audit Actions
      in your baseline
    • AC-6(9)
      Log Use of Privileged Functions
      in your baseline
    • AC-17(1)
      Monitoring and Control
      in your baseline
    • AC-20(1)
      Limits on Authorized Use
      in your baseline
    • AU-2
      Event Logging
      in your baseline
    • AU-7(1)
      Automatic Processing
      in your baseline
    • AU-12
      Audit Record Generation
      in your baseline
    • SI-4(4)
      Inbound and Outbound Communications Traffic
      in your baseline
    • SI-4(5)
      System-generated Alerts
      in your baseline
    • SI-7(7)
      Integration of Detection and Response
      in your baseline
  • KSI-MLA-OSM
    Operating SIEM Capability
    Fully backed
    • AC-17(1)
      Monitoring and Control
      in your baseline
    • AC-20(1)
      Limits on Authorized Use
      in your baseline
    • AU-2
      Event Logging
      in your baseline
    • AU-3
      Content of Audit Records
      in your baseline
    • AU-3(1)
      Additional Audit Information
      in your baseline
    • AU-4
      Audit Log Storage Capacity
      in your baseline
    • AU-5
      Response to Audit Logging Process Failures
      in your baseline
    • AU-6(1)
      Automated Process Integration
      in your baseline
    • AU-6(3)
      Correlate Audit Record Repositories
      in your baseline
    • AU-7
      Audit Record Reduction and Report Generation
      in your baseline
    • AU-7(1)
      Automatic Processing
      in your baseline
    • AU-8
      Time Stamps
      in your baseline
    • AU-9
      Protection of Audit Information
      in your baseline
    • AU-11
      Audit Record Retention
      in your baseline
    • IR-4(1)
      Automated Incident Handling Processes
      in your baseline
    • SI-4(2)
      Automated Tools and Mechanisms for Real-time Analysis
      in your baseline
    • SI-4(4)
      Inbound and Outbound Communications Traffic
      in your baseline
    • SI-7(7)
      Integration of Detection and Response
      in your baseline
  • KSI-MLA-RVL
    Reviewing Logs
    Fully backed
    • AC-2(4)
      Automated Audit Actions
      in your baseline
    • AC-6(9)
      Log Use of Privileged Functions
      in your baseline
    • AU-2
      Event Logging
      in your baseline
    • AU-6
      Audit Record Review, Analysis, and Reporting
      in your baseline
    • AU-6(1)
      Automated Process Integration
      in your baseline
    • SI-4
      System Monitoring
      in your baseline
    • SI-4(4)
      Inbound and Outbound Communications Traffic
      in your baseline

Policy and Inventory

5Indicators2Full2Part0None1No control
  • KSI-PIY-GIV
    Generating Inventories
    Fully backed
    • CM-2(2)
      Automation Support for Accuracy and Currency
      in your baseline
    • CM-7(5)
      Authorized Software — Allow-by-exception
      in your baseline
    • CM-8
      System Component Inventory
      in your baseline
    • CM-8(1)
      Updates During Installation and Removal
      in your baseline
    • CM-12
      Information Location
      in your baseline
    • CM-12(1)
      Automated Tools to Support Information Location
      in your baseline
    • CP-2(8)
      Identify Critical Assets
      in your baseline
  • KSI-PIY-RES
    Reviewing Executive Support
    No control listed
    FedRAMP lists no control for this one. We do not count it as covered.
  • KSI-PIY-RIS
    Reviewing Investments in Security
    Partly backed
    • AC-5
      Separation of Duties
      in your baseline
    • CA-2
      Control Assessments
      in your baseline
    • CP-2(1)
      Coordinate with Related Plans
      in your baseline
    • CP-4(1)
      Coordinate with Related Plans
      in your baseline
    • IR-3(2)
      Coordination with Related Plans
      in your baseline
    • PM-3
      Information Security and Privacy Resources
      not in your baseline
    • SA-2
      Allocation of Resources
      in your baseline
    • SA-3
      System Development Life Cycle
      in your baseline
    • SR-2(1)
      Establish SCRM Team
      in your baseline
  • KSI-PIY-RSD
    Reviewing Security in the SDLC
    Partly backed
    • AC-5
      Separation of Duties
      in your baseline
    • AU-3(3)
      Limit Personally Identifiable Information Elements
      not in your baseline
    • CM-3(4)
      Security and Privacy Representatives
      in your baseline
    • PL-8
      Security and Privacy Architectures
      in your baseline
    • PM-7
      Enterprise Architecture
      not in your baseline
    • SA-3
      System Development Life Cycle
      in your baseline
    • SA-8
      Security and Privacy Engineering Principles
      in your baseline
    • SC-4
      Information in Shared System Resources
      in your baseline
    • SC-18
      Mobile Code
      in your baseline
    • SI-10
      Information Input Validation
      in your baseline
    • SI-11
      Error Handling
      in your baseline
    • SI-16
      Memory Protection
      in your baseline
  • KSI-PIY-RVD
    Reviewing Vulnerability Disclosures
    Fully backed
    • RA-5(11)
      Public Disclosure Program
      in your baseline

Recovery Planning

4Indicators4Full0Part0None0No control
  • KSI-RPL-ABO
    Aligning Backups with Objectives
    Fully backed
    • CM-2(3)
      Retention of Previous Configurations
      in your baseline
    • CP-6
      Alternate Storage Site
      in your baseline
    • CP-9
      System Backup
      in your baseline
    • CP-10
      System Recovery and Reconstitution
      in your baseline
    • CP-10(2)
      Transaction Recovery
      in your baseline
    • SI-12
      Information Management and Retention
      in your baseline
  • KSI-RPL-ARP
    Aligning Recovery Plan
    Fully backed
    • CP-2
      Contingency Plan
      in your baseline
    • CP-2(1)
      Coordinate with Related Plans
      in your baseline
    • CP-2(3)
      Resume Mission and Business Functions
      in your baseline
    • CP-4(1)
      Coordinate with Related Plans
      in your baseline
    • CP-6
      Alternate Storage Site
      in your baseline
    • CP-6(1)
      Separation from Primary Site
      in your baseline
    • CP-6(3)
      Accessibility
      in your baseline
    • CP-7
      Alternate Processing Site
      in your baseline
    • CP-7(1)
      Separation from Primary Site
      in your baseline
    • CP-7(2)
      Accessibility
      in your baseline
    • CP-7(3)
      Priority of Service
      in your baseline
    • CP-8
      Telecommunications Services
      in your baseline
    • CP-8(1)
      Priority of Service Provisions
      in your baseline
    • CP-8(2)
      Single Points of Failure
      in your baseline
    • CP-10
      System Recovery and Reconstitution
      in your baseline
    • CP-10(2)
      Transaction Recovery
      in your baseline
  • KSI-RPL-RRO
    Reviewing Recovery Objectives
    Fully backed
    • CP-2(3)
      Resume Mission and Business Functions
      in your baseline
    • CP-10
      System Recovery and Reconstitution
      in your baseline
  • KSI-RPL-TRC
    Testing Recovery Capabilities
    Fully backed
    • CP-2(1)
      Coordinate with Related Plans
      in your baseline
    • CP-2(3)
      Resume Mission and Business Functions
      in your baseline
    • CP-4
      Contingency Plan Testing
      in your baseline
    • CP-4(1)
      Coordinate with Related Plans
      in your baseline
    • CP-6
      Alternate Storage Site
      in your baseline
    • CP-6(1)
      Separation from Primary Site
      in your baseline
    • CP-9(1)
      Testing for Reliability and Integrity
      in your baseline
    • CP-10
      System Recovery and Reconstitution
      in your baseline
    • IR-3
      Incident Response Testing
      in your baseline
    • IR-3(2)
      Coordination with Related Plans
      in your baseline

Supply Chain Risk

2Indicators2Full0Part0None0No control
  • KSI-SCR-MIT
    Mitigating Supply Chain Risk
    Fully backed
    • AC-20
      Use of External Systems
      in your baseline
    • CA-7(4)
      Risk Monitoring
      in your baseline
    • RA-3(1)
      Supply Chain Risk Assessment
      in your baseline
    • SA-9
      External System Services
      in your baseline
    • SA-10
      Developer Configuration Management
      in your baseline
    • SA-11
      Developer Testing and Evaluation
      in your baseline
    • SA-15(3)
      Criticality Analysis
      in your baseline
    • SA-22
      Unsupported System Components
      in your baseline
    • SC-18
      Mobile Code
      in your baseline
    • SI-7(1)
      Integrity Checks
      in your baseline
    • SR-5
      Acquisition Strategies, Tools, and Methods
      in your baseline
    • SR-6
      Supplier Assessments and Reviews
      in your baseline
  • KSI-SCR-MON
    Monitoring Supply Chain Risk
    Fully backed
    • AC-20
      Use of External Systems
      in your baseline
    • CA-3
      Information Exchange
      in your baseline
    • IR-6(3)
      Supply Chain Coordination
      in your baseline
    • PS-7
      External Personnel Security
      in your baseline
    • RA-5
      Vulnerability Monitoring and Scanning
      in your baseline
    • SA-9
      External System Services
      in your baseline
    • SI-5
      Security Alerts, Advisories, and Directives
      in your baseline
    • SR-5
      Acquisition Strategies, Tools, and Methods
      in your baseline
    • SR-6
      Supplier Assessments and Reviews
      in your baseline
    • SR-8
      Notification Agreements
      in your baseline

Service Configuration

8Indicators6Full1Part1None0No control
  • KSI-SVC-ACM
    Automating Configuration Management
    Partly backed
    • AC-2(4)
      Automated Audit Actions
      in your baseline
    • CM-2
      Baseline Configuration
      in your baseline
    • CM-2(2)
      Automation Support for Accuracy and Currency
      in your baseline
    • CM-2(3)
      Retention of Previous Configurations
      in your baseline
    • CM-6
      Configuration Settings
      in your baseline
    • CM-7(1)
      Periodic Review
      in your baseline
    • PL-9
      Central Management
      not in your baseline
    • PL-10
      Baseline Selection
      in your baseline
    • SA-5
      System Documentation
      in your baseline
    • SI-5
      Security Alerts, Advisories, and Directives
      in your baseline
    • SR-10
      Inspection of Systems or Components
      in your baseline
  • KSI-SVC-ASM
    Automating Secret Management
    Fully backed
    • AC-17(2)
      Protection of Confidentiality and Integrity Using Encryption
      in your baseline
    • IA-5(2)
      Public Key-based Authentication
      in your baseline
    • IA-5(6)
      Protection of Authenticators
      in your baseline
    • SC-12
      Cryptographic Key Establishment and Management
      in your baseline
    • SC-17
      Public Key Infrastructure Certificates
      in your baseline
  • KSI-SVC-EIS
    Evaluating and Improving Security
    Fully backed
    • CM-7(1)
      Periodic Review
      in your baseline
    • CM-12(1)
      Automated Tools to Support Information Location
      in your baseline
    • MA-2
      Controlled Maintenance
      in your baseline
    • PL-8
      Security and Privacy Architectures
      in your baseline
    • SC-7
      Boundary Protection
      in your baseline
    • SC-39
      Process Isolation
      in your baseline
    • SI-2(2)
      Automated Flaw Remediation Status
      in your baseline
    • SI-4
      System Monitoring
      in your baseline
    • SR-10
      Inspection of Systems or Components
      in your baseline
  • KSI-SVC-PRR
    Preventing Residual Risk
    Fully backed
    • SC-4
      Information in Shared System Resources
      in your baseline
  • KSI-SVC-RUD
    Removing Unwanted Data
    None in your baseline
    • SI-12(3)
      Information Disposal
      not in your baseline
    • SI-18(4)
      Individual Requests
      not in your baseline
  • KSI-SVC-SIN
    Securing Information
    Fully backed
    • AC-1
      Policy and Procedures
      in your baseline
    • AC-17(2)
      Protection of Confidentiality and Integrity Using Encryption
      in your baseline
    • CP-9(8)
      Cryptographic Protection
      in your baseline
    • SC-8
      Transmission Confidentiality and Integrity
      in your baseline
    • SC-8(1)
      Cryptographic Protection
      in your baseline
    • SC-13
      Cryptographic Protection
      in your baseline
    • SC-20
      Secure Name/Address Resolution Service (Authoritative Source)
      in your baseline
    • SC-21
      Secure Name/Address Resolution Service (Recursive or Caching Resolver)
      in your baseline
    • SC-22
      Architecture and Provisioning for Name/Address Resolution Service
      in your baseline
    • SC-23
      Session Authenticity
      in your baseline
    • SC-28
      Protection of Information at Rest
      in your baseline
    • SC-28(1)
      Cryptographic Protection
      in your baseline
  • KSI-SVC-VCM
    Validating Communications
    Fully backed
    • SC-23
      Session Authenticity
      in your baseline
    • SI-7(1)
      Integrity Checks
      in your baseline
  • KSI-SVC-VRI
    Validating Resource Integrity
    Fully backed
    • CM-2(2)
      Automation Support for Accuracy and Currency
      in your baseline
    • CM-8(3)
      Automated Unauthorized Component Detection
      in your baseline
    • SC-13
      Cryptographic Protection
      in your baseline
    • SC-23
      Session Authenticity
      in your baseline
    • SI-7
      Software, Firmware, and Information Integrity
      in your baseline
    • SI-7(1)
      Integrity Checks
      in your baseline
    • SR-10
      Inspection of Systems or Components
      in your baseline

One control, two rule books

One control, two rule books A Rev 5 statement and its evidence feed the control AC-2, Account Management. The control carries two tags, FedRAMP Moderate and FedRAMP 20x. A 20x theme, Identity and Access Management, and its indicator, KSI-IAM-SUS, pin the same control from the other side. Fed by Pinned by Rev 5 statement What you wrote for this control Evidence Records that back the statement AC-2 · Account Management FedRAMP Moderate FedRAMP 20x KSI theme Identity and AccessManagement Indicator KSI-IAM-SUS Responding to SuspiciousActivity One control, two rule books A Rev 5 statement and its evidence feed the control AC-2, Account Management. The control carries two tags, FedRAMP Moderate and FedRAMP 20x. A 20x theme, Identity and Access Management, and its indicator, KSI-IAM-SUS, pin the same control from the other side. Fed by Rev 5 statement What you wrote for this control Evidence Records that back the statement AC-2 · Account Management FedRAMP Moderate FedRAMP 20x Pinned by KSI theme Identity andAccess Management Indicator KSI-IAM-SUS Responding toSuspiciousActivity

A 20x indicator points to a list of NIST controls. Your Rev 5 package already wrote those controls up. So the move starts from work you already did.

GS|ATO™ keeps one control catalog. Your statements attach to controls. The indicators read them from the other side.

What 20x asks that Rev 5 did not

The controls stay the same. The way you show them changes. Here is what is new, with the FedRAMP rule for each.

  • You share your data as JSON files. They follow a format FedRAMP gives you, so a computer can read them.
    FedRAMP rule FRC-CSO-JSN
    FedRAMP JSON Schemas
  • You stay certified by reporting as you go. Reviews each quarter are part of that.
    FedRAMP rule CCM-OCR-AVL
    Report Availability
    FedRAMP rule CCM-QTR-MTG
    Quarterly Review Meeting
  • You send a notice about a big change. You tell the people who need to know.
    FedRAMP rule SCN-ADP-NTF
    Notification Requirements
  • You look for vulnerabilities all the time. You track each one and deal with it.
    FedRAMP rule VDR-CSO-DET
    Vulnerability Detection
    FedRAMP rule VDR-CSO-RES
    Vulnerability Response
  • You write a short summary for each indicator. Automated checks keep verifying them, as your class asks.
    FedRAMP rule SDR-CSX-KSI
    Key Security Indicators
    FedRAMP rule FRC-CSX-VVK
    Automated Verification and Validation of Key Security Indicators

How ATO moves you

  1. You hand us your Rev 5 package.
  2. It loads onto the same control catalog.
  3. The product's 20x readiness page shows what carries and what is new.
  4. We write the new parts and back each one with evidence.
  5. You get your package in a form a computer can read, plus the ongoing checks.

The product labels its 20x view as decision support. It is not an authorization.

Checks run on a schedule against your statements and evidence. Live pulls from your scanners and cloud accounts are turned on per client.

Dates to know

  • January 1, 2027
    After this day, FedRAMP begins to enforce the 2026 rules.
    Source: fedramp.gov
  • June 11, 2027
    FedRAMP stops accepting new Rev 5 certifications.
    Source: fedramp.gov
  • December 31, 2028
    Existing Rev 5 certifications stay active until at least this day. FedRAMP could be directed to change that.
    Source: fedramp.gov
Let's Talk →

Bring your Rev 5 package. We will show you what carries and what is new.

See the ATO page →

Pick your stack. See how much of a package your providers already cover.

Try it on your own scan →

Drop your own scan file. It is read in your browser. Nothing leaves your machine.

Where the numbers come from

The baselines are the FedRAMP Rev 5 baselines: 156 controls at Low, 323 at Moderate, 410 at High. They come from FedRAMP's baseline workbook.

The indicators, and the controls each one points to, come from FedRAMP's Consolidated Rules for 2026. They list 46 indicators in ten themes. That is 373 links to 209 different controls.

Control names are the official NIST SP 800-53 Rev 5 titles.

We match control ids exactly. IA-2(1) counts as in your baseline only if IA-2(1) itself is in it. We never guess from a control to its enhancements, or back.

FedRAMP lists no control for these indicators: KSI-CNA-OFA and KSI-PIY-RES. We say so, and we do not count them as covered.

The notes about the 20x pilots, the four classes and the High pilot come from FedRAMP's 20x page.

The files behind this page:

This is not an audit of your setup. It is not legal, audit or compliance advice.

The full method, and how each claim above was checked, is on sources.html.