Gomes Security · Sources & attribution — the ten decisions

Where the numbers come from.

Compiled 2026-09-03 · Cited, never reproduced

How to read this page

Every number in the ten decisions names its source. We do not copy charts, tables or text from any publisher. Each entry below names the report, the publisher, the year, and the kind of number we use. Then it stops.

The industry reports come from CrowdStrike, Mandiant, IBM/Ponemon, Verizon, the Identity Theft Resource Center, Sophos, Coalition, and Hiscox. Each is cited by report, not by number. One entry per report. That is how each report lets itself be read and quoted.

IBM/Ponemon's Cost of a Data Breach has two entries. We use two editions. The 2025 edition's Figures 7, 9, 13–14, and 39 sit beside each decision on the home page, as an industry reference. Story dollars mostly come from the 2026 edition. The index below says which edition each decision uses.

Figures tied to one event do not get their own entry. Naming the report that covered that event could point to the company behind the story. They share one line instead:

Figures tied to individual incidents are real and verified against primary records — securities filings, breach notices, court filings, and contemporaneous company statements — on file with Gomes Security. They are cited here at the publication level only, so the illustrative scenarios stay illustrative.

The FedRAMP 20x KSI and CIS Controls v8 tags on each story card point to good practice. They are not evidence, so they are not in the list below.

≈ marks a share read off the Fig. 9 chart. Shared vectors are counted once. Dollars are never guessed. Where no IBM/Ponemon vector applies, the card says so, and the rank does not depend on it.

CR26 is optional today for Rev5 providers. Its vulnerability rules bind 2026-12-07. The rest bind 2027-01-01. The platform tracks them now.

Deterministic by designThe math doesn't improvise.

The numbers on the instrument page are computed, not generated: forecasts, rankings, dollar figures, propagation counts. Same inputs, same answer, every time.

AI drafts paperwork on this platform. It never makes a decision, computes a number, or approves a change. The checks that guard your record run with no AI in them at all — and a named person signs every change.

Agents can hallucinate. Math can't. And when the data can't support an answer, the platform says so — it abstains instead of guessing.

Two kinds of numbers live on the instrument page: records and forecasts. Records are looked up — or marked “not assessed.” Never guessed. Forecasts are computed the same way every run, and always arrive as a range. We never dress one up as the other.

Carried over from the instrument page's own determinism strip when the landing went hero-only (2026-09-03); “here”/“this page” became “the instrument page” — no other word changed. The platform behind these pages is GS|ATO™.

How the dollar bands are modeledSourced inputs, run through the platform's own math

How the dollars on the ten decisions are made. Every dollar band is computed, not written. The platform's own risk and cost math runs a FAIR loss model with 10,000 draws. It is seeded from the inputs, so the same inputs give the same numbers. The inputs are sourced, not guessed. Every dollar is sized for a small SaaS team, the scale the platform uses across the ten decisions. The ten are ranked by what each incident cost, largest first. A company's own figure ranks ahead of an industry average. A card with a stated cost shows that cost and no modeled figure. A card with no stated cost shows the industry average. Where the platform holds sourced inputs for a decision, that card also shows ATO's own modeled range for one incident. The IBM/Ponemon per-vector figures on the cards are an industry reference only. They never set the depth or the rank. Loss per event is anchored on Coalition's 2026 Cyber Claims Report figure for companies under $25 million in revenue. It is split into FAIR's loss forms by the IBM/Ponemon Cost of a Data Breach 2025 cost categories. Those are response; fines and judgments; and reputation, which includes lost business and notification. Ransomware-class decisions use Coalition's ransomware claim average and Sophos's 2026 recovery cost. How often each loss event happens uses Hiscox's 2026 small-business attack rate times the decision's own vector share. That share comes from the Verizon DBIR 2026, Mandiant M-Trends 2026, CrowdStrike, IBM/Ponemon, or OMB FISMA, as the card cites. Labor is priced at the BLS May 2024 wage for information security analysts times the loaded rate the cards state. Tools are at the vendors' own list prices, each page fetched and hashed. The stronger control's effect on how often events happen is the engine's own rule. Where a published study measures a size effect (intact backups, Sophos 2024), it is applied and named. Every band is modeled and unsigned. It is the platform's math on public inputs for a staged team, not a certified assessment for a real client. The inputs, sources, and seeds are on file. As of 2026-09-04.

Applies to the ROI block and the dollar figure on all ten story cards on the home page.

Your contract, your numberTyped once, kept on your device, never sent

The home page can take your federal contract's yearly value. Type it in, and the “Late or lost ATO” line becomes your own number. A month of waiting costs one twelfth of that value. That is the rule this site uses for a month of delay. If the ATO is pulled, the whole value is on the line, plus a re-authorization. This is the platform's own rule, not a figure from an outside report.

The number stays in your browser's local storage, on your device. The page sends nothing. Clearing your browser's site data removes it.

How the control risk tier is coloredSourced coverage, run through a fixed cut rule

For each of the 17 controls behind the ten decisions, the platform checks every ATT&CK technique. The CTID ATT&CK-to-NIST SP 800-53 mapping says which ones each control mitigates. It matches each technique against the ten techniques seen in the largest share of analyzed malware samples. For a sub-technique, it uses the parent technique instead. That list is the Picus Red Report 2026's own “Prevalence” column. It then sums the prevalence percentages of the ones that match. A technique the mapping marks as detected but not mitigated is left out of this headline score. It counts at half weight in a separate sensitivity score instead. So a technique that is both mitigated and detected is never counted twice. The 31 scored controls are ranked by that score, highest first, and cut into rough thirds. A tied group on the boundary stays together in the higher tier. This gives two rated tiers: stops the most common ways in and stops common ways in. Any control scoring exactly zero falls outside those two tiers, no matter its rank. It is simply not rated against the ten most common techniques. Of the 17 controls behind the ten decisions, seven sit in the top tier. Four sit in the second tier, and six are not rated. Two of those six score zero against the top ten techniques. The other four, CA-5, CP-2, IA-12 and RA-10, were never among the 31 scored controls at all. Not rated means we found nothing, not that the control is weak or off the attacker's path. As of 2026-09-04.

This sets the risk-tier color on every control icon on the home page.

The bibliographyTwenty publications, cited once each

01 · Industry research · 2025 edition

IBM/Ponemon Cost of a Data Breach, 2025

IBM Security, research by Ponemon Institute

Cited for the cost and frequency breakdown, per vector: Figures 7, 9, 13–14, and 39. These sit beside each decision on the home page. They serve as an industry reference. It is also cited for one decision's malicious-insider cost figure, in that decision's own cost line.

This is the earlier of the two Cost of a Data Breach editions cited on this site. See “How to read this page” above to see which figures come from which edition.

Access — free to read; registration required.
02 · Industry research · 2026 edition

IBM/Ponemon Cost of a Data Breach, 2026

IBM Security, research by Ponemon Institute

Cited for the cost figures. These are global and U.S. averages, and days to identify and contain. Also cited for cost figures by vector. These are phishing and supply chain. They are also public-facing exploits and help-desk impersonation. And they are business-partner compromise. These figures are used across three of the ten decisions' cost lines.

Access — free to read; registration required.
03 · Industry research · 2026 edition

Verizon Data Breach Investigations Report (DBIR), 2026

Verizon Business

Cited for third-party involvement in breaches (48%). Also cited for exploited vulnerabilities. This is the leading initial access vector (31%). And cited for KEV remediation outcomes. About one in four are fully fixed. The median time is 43 days (report pp. 10, 17). Used in two decisions.

Access — access terms as published.
04 · Industry research · 2026 edition

Mandiant M-Trends, 2026

Mandiant (Google Cloud)

Cited for intrusion dwell time. It is also cited for detection method figures. These are the median time to detection. They also show how intrusions were found: by an outside notice, or by the company itself. And it is cited for cloud intrusion initial access. This shows how common each vector is (vishing, exploitation). Used across three decisions.

Access — access terms as published.
05 · Industry research · 2026 edition

CrowdStrike Global Threat Report, 2026

CrowdStrike

Cited for the share of intrusions with no malware. It is also cited for the share of cloud incidents from valid account abuse, and for attacker lateral movement timing. It is also cited for the count of organizations. Their own AI assistants were talked into actions they were not allowed to take. Used across four decisions.

Access — access terms as published.
06 · Industry research · H1 2026 edition

Identity Theft Resource Center, H1 2026 Data Breach Report

Identity Theft Resource Center (ITRC)

Cited for the share of notices that disclosed how the attack happened. Also cited for a single incident concentration figure. This is for one notice category. Used across two decisions.

Access — access terms as published.
07 · Industry research · 2026 edition

Sophos, The State of Ransomware, 2026

Sophos

Cited for ransomware recovery cost. Also cited for ransom payment rate, and median ransom demand. Also cited for the added recovery cost. That cost applies when backups are also compromised. Used across two decisions.

Access — access terms as published.
08 · U.S. government work

CISA Known Exploited Vulnerabilities (KEV) Catalog

Cybersecurity and Infrastructure Security Agency (CISA), U.S. Department of Homeland Security

Cited for the “actively exploited” list of flaws. Also cited for its fix due date rule. That rule is Binding Operational Directive 22-01. It is cited in one decision, in its mechanism text and its cost line.

Access — U.S. government work, public domain (17 U.S.C. §105).
09 · U.S. government work · FY2023, latest published

OMB FISMA Fiscal Year 2023 Annual Report to Congress

Office of Management and Budget (OMB)

Cited for the breakdown of incident categories. These are counted across the federal government. Improper usage was the leading category. Used in one decision. FY2023 was the latest edition published as of this citation. It is the oldest dated source in this list.

Access — U.S. government work, public domain (17 U.S.C. §105).
10 · U.S. government work · May 2024 (edition pinned at engagement scoping)

BLS Occupational Employment and Wage Statistics — Information Security Analysts

U.S. Bureau of Labor Statistics (BLS)

Cited for the median hourly wage for information security analysts. It is scaled by 1.33. That gives the $80/hour loaded rate the cards use. This is the rate underlying every one of the ten decisions' fix-cost estimate.

Access — U.S. government work, public domain (17 U.S.C. §105).
11 · Vendor threat-intelligence reporting

Google Threat Intelligence / Mandiant vendor-compromise reporting

Google Threat Intelligence / Mandiant (Google Cloud)

Cited for a report on a vendor credential compromise. Press coverage from the same time is cited beside it. Used in one decision. This entry names no article title and no URL for that one incident. That follows this page's own de-identification rule. See Licensing & Attribution below.

Access — access terms as published.
12 · U.S. government program documents

FedRAMP program documents — Consolidated Rules 2026 (CR26) and RFC-0031

FedRAMP Program Management Office, U.S. General Services Administration

Cited for the clocks that govern two of the ten decisions. One is the PAIN remediation clock. The other treats a detection gap as a vulnerability with its own clock. That second clock's program id is VDR-CSO-FAV.

Access — U.S. government work, public domain (17 U.S.C. §105).
13 · U.S. government work · Control authority

NIST SP 800-53 Revision 5 + SP 800-53A

National Institute of Standards and Technology (NIST)

No number comes from these documents directly. They set the control text and the test steps. They stand behind every one of the ten decisions' anchor controls and the FedRAMP High baseline itself. This entry is constant across all ten, so it is listed once here. It is not repeated on the index rows below.

Access — U.S. government work, public domain (17 U.S.C. §105).
14 · Consultancy & tool-vendor estimates

Moderate re-authorization cost and timeline estimates

Secureframe, Vanta, Paramify, Knox Systems, CISGuard

Cited for a range used for a late or lost Moderate re-authorization. That range is $250,000 to $2 million, and 12 to 24 months. This is referenced in two decisions. FedRAMP publishes no official figure for this. These are estimates from consultancies and tool vendors. They sit at the publication level, directional only.

Access — publicly published estimates, access terms as published.
15 · Industry research · 2026 edition

Coalition Cyber Claims Report, 2026

Coalition, Inc. (via Risk & Insurance coverage)

Cited for the anchor behind the modeled ROI band on every one of the ten decisions: the average claim severity. This is the loss per event. It is for policyholders under $25 million in revenue. It also gives the ransomware claim average. Three decisions use that one. They are the destructive class. See “How the dollar bands are modeled” above.

Access — accessed via secondary trade-press coverage (Risk & Insurance); Coalition's own report was not directly fetched this pass.
16 · Industry research · 2026 edition

Hiscox Cyber Readiness Report, 2026

Hiscox

Cited for the share of small businesses attacked in the past twelve months (56%). This sets the loss-event-frequency base rate for the modeled ROI band on every one of the ten decisions. See “How the dollar bands are modeled” above.

Access — free to read (PDF).
17 · Industry research · 2024 fielding

Sophos, The Impact of Compromised Backups on Ransomware Outcomes, 2024

Sophos, fielded by Vanson Bourne (2,974 organizations hit by ransomware) — a distinct study from the 2026 State of Ransomware report cited separately above

Cited for the recovery-cost size effect of compromised vs. intact backups: eight times higher, $3M vs. $375K. This applies to one decision's modeled ROI band. See “How the dollar bands are modeled” above.

Access — free to read (vendor blog).
18 · Vendor list prices · fetched 2026-09-04

Vendor list-price pages, fetched and hashed on 2026-09-04

Multiple named-brand identity, secrets-management, SIEM, breach-and-attack-simulation, continuous-monitoring, and penetration-testing tool vendors

Cited for the cost of the stronger control in each decision's modeled ROI band. The list covers hardware security keys. It also covers identity licensing. And it covers lifecycle management licensing. It covers secrets managers and SIEM tools. It covers attack simulation. It also covers continuous monitoring platforms. It covers object-lock backup storage. It also covers penetration tests. Each is priced from the vendor's own list price. Or it is priced by marketplace listing, or by product documentation. See “How the dollar bands are modeled” above. This is held as one collective entry, not one entry per vendor. That way, a story's cost line stays about the control. It does not stay about the product behind it.

Access — eleven pages fetched directly and hashed, 2026-09-04; publicly published, no registration required.
19 · Mapping data · commit 5998957f

ATT&CK 16.1 to NIST SP 800-53 Revision 5 mapping (enterprise), CTID Mappings Explorer

Center for Threat-Informed Defense (CTID)

Cited for the control-to-technique mitigates mapping. This mapping is behind the risk-tier color on each control icon on the home page. It holds 2,782 mitigates-type mapping rows across the 31 scored controls. These collapse to 1,055 rows after de-duplication. The full 443-control crosswalk table holds 5,264 mitigates-type rows. A GSA .govCAR strength-score dataset shares that same table, but is not used here. See “How the control risk tier is colored” above.

Access — license: see the project's repository.
20 · Industry research · Red Report 2026

Picus Red Report 2026

Picus Security (Picus Labs) — 1,084,718 malware samples analyzed in 2025; 13,321,128 total TTP observations mapped to ATT&CK

Cited for ATT&CK technique-prevalence percentages. These are attributed inputs to the risk-tier color on each control icon on the home page. They are matched against the mapping above, never reproduced as a table. See “How the control risk tier is colored” above.

Access — access terms as published; the ten prevalence figures used here were retrieved 2026-09-04 by an automated text fetch of the publisher's page (self-dated 2026-02-24), not a byte-level capture, so the sha256 on file covers the extracted figures only, not the page's raw bytes.

Per-story reference indexWhich sources back each decision

The BLS wage table backs every decision's fix-cost line. So it is in every row below. The other entries vary by decision. NIST SP 800-53 anchors every decision's control. So it is not repeated per row. See entry 13 above.

#DecisionDraws on
01Takes TwoCrowdStrike GTR 2026·BLS OES 2024
02Never RestoredIBM CoDB 2025·BLS OES 2024
03Leftover AccessCrowdStrike GTR 2026·BLS OES 2024
04Still InsideBLS OES 2024
05Stolen PapersBLS OES 2024
06Practiced ShutdownIBM CoDB 2025·BLS OES 2024
07Nobody LookedMandiant M-Trends 2026·FedRAMP CR26·BLS OES 2024
08Who Can Copy?CrowdStrike GTR 2026·IBM CoDB 2026·BLS OES 2024
09Same Door AgainIBM CoDB 2026·BLS OES 2024
10Fixed by Wednesday *Verizon DBIR 2026·IBM CoDB 2026·CISA KEV·FedRAMP CR26·BLS OES 2024

* Fixed by Wednesday's exposure line cites one figure. That figure is the 2025 edition's vulnerability exploitation vector, $4.24M. That number stays on the 2025 table by policy. Its cost line uses a different figure instead. That figure is the 2026 edition's public-facing application exploit vector, $4.68M (IBM CoDB 2026). The two editions are close. But they are not the same. And neither one replaces the other.

What the names meanThe NIST SP 800-53 Rev 5 name for each control on the home page

On the home page every control is shown by its NIST SP 800-53 Rev 5 name. This table maps each name to its control ID. The home page's reach counts are out of 1,014. That count is every active control and enhancement in the platform's NIST SP 800-53 Rev 5 control map. The ATO page's 410, 323 and 156 are the FedRAMP High, Moderate and Low baselines drawn from that map.

Name shown on the instrumentNIST SP 800-53 Rev 5 control (ID)
Account ManagementAC-2
Access EnforcementAC-3
Information Flow EnforcementAC-4
Separation of DutiesAC-5
Least PrivilegeAC-6
Use of External SystemsAC-20
Role-based TrainingAT-3
Audit Record Review, Analysis, and ReportingAU-6
Information ExchangeCA-3
Continuous MonitoringCA-7
Least FunctionalityCM-7
User-installed SoftwareCM-11
Information LocationCM-12
Signed ComponentsCM-14
Contingency Plan TestingCP-4
System BackupCP-9
System Recovery and ReconstitutionCP-10
Identification and Authentication (Organizational Users)IA-2
Authenticator ManagementIA-5
Identification and Authentication (Non-organizational Users)IA-8
Incident Response TestingIR-3
Incident HandlingIR-4
Incident ReportingIR-6
Personnel TerminationPS-4
Vulnerability Monitoring and ScanningRA-5
External System ServicesSA-9
Developer Testing and EvaluationSA-11
Information in Shared System ResourcesSC-4
Flaw RemediationSI-2
System MonitoringSI-4
Software, Firmware, and Information IntegritySI-7
Notification AgreementsSR-8
Name shown on the instrumentFamily
Access ControlAC
Awareness and TrainingAT
Audit and AccountabilityAU
Assessment, Authorization, and MonitoringCA
Configuration ManagementCM
Contingency PlanningCP
Identification and AuthenticationIA
Incident ResponseIR
Personnel SecurityPS
Risk AssessmentRA
System and Services AcquisitionSA
System and Communications ProtectionSC
System and Information IntegritySI
Supply Chain Risk ManagementSR

The stack pickerWhere the ATO page's stack numbers come from.

The baselines are FedRAMP Rev 5. They are published in OSCAL by the OSCAL Foundation, in its fedramp-resources files. Low has 156 controls. Moderate has 323. High has 410. Control and family names are the official NIST SP 800-53 Rev 5 titles.

The cloud layer splits responsibility. AWS GovCloud uses it. So do Azure Government and Google Cloud. It ties to the Cloud Security Alliance's CCM v4. The provider owns 31 controls outright. These cover physical, environmental, and maintenance. They also cover media, provider staff, and alternate sites. It shares 37 more controls with you.

AWS service citations come from AWS's own published OSCAL component definitions. They are joined to the Security Hub → NIST 800-53 mapping. That mapping is drawn from the guard rules AWS publishes (Apache-2.0). These citations are shared. They are never complete on the provider's side.

cloud.gov rows come from cloud.gov's own published control-family policies. They are public domain under CC0. Red Hat OpenShift rows come from the ComplianceAsCode OSCAL component definition. That definition stops at the Moderate baseline. That is why OpenShift stops counting at High.

Vendor rows are what each vendor's public FedRAMP package or trust page says. Each has one citation per control. Each also carries its FedRAMP Marketplace listing, and a link where the vendor's page still answers. At FedRAMP High, a vendor we hold at Moderate does not count yet. It counts only once we map its High package. A vendor we have not mapped yet counts as yours to write. We map it at onboarding, from the vendor's own package.

A control is provider-covered when one of your picks says it owns it in full. It is shared when they say it is split. It is yours when no pick speaks to it.

The speed numbers are measured, not estimated. On our own package at the High baseline, a batch of 203 statements was drafted in 14 minutes and reviewed in 15. Both figures are ceilings. They are stamped by the same scheduled check that looks for a finished batch.

stack.html holds a copy of the platform's inheritance data. That copy is as of the date shown in its masthead. The platform runs this again on every change.

The ATO pageWhere the ATO page's numbers come from.

The ATO page's package figures are a read-only export of the platform's own database, never typed in by hand. A build script reads the same tables the product reads. It records a sha256 hash of every file it reads, so a later change upstream can be detected. The export's snapshot date is in the ATO page's masthead.

Every speed figure on the ATO page is a timed batch, not an estimate:

RunWhatMinutesDate
NarrativeBatch cmphen86c006e04kthf9krr1d203 control statements drafted14.02026-05-22
AssessmentBatch cmphf5jmf01pu04l7uhj553va203 statements reviewed in an assessor's voice14.82026-05-22
NarrativeBatch cmr9i876c005msb3g24z2s79o50 control statements drafted8.32026-07-06
ProcedureDocument createdAt window108 procedure documents drafted70.32026-06-12

Every figure above is a ceiling. A scheduled check stamps the time when it finds the batch already done, not the batch's own clock.

Of the package's 410 control implementations, 202 are approved. 208 are still drafts. There are 18 policy documents, one for each control family that has controls in this package. Two families have none. There are also 110 procedure documents under them. Neither kind has left draft status yet.

The NIST SP 800-53 Revision 5 catalog comes in as OSCAL 1.2.2. Its catalog release is 5.2.0. Every package that leaves the platform is OSCAL 1.2.1: System Security Plan · Security Assessment Plan · Security Assessment Report · Plan of Action & Milestones · Continuous Monitoring Package · Complete Package. The FedRAMP baseline and ODP files are digests. They are drawn from the OSCAL Foundation's fedramp-resources files. Every export is checked before it leaves the platform. The full FedRAMP schema check runs when we build. It does not run on every export.

FedRAMP's own machine-readable indicators, used for the FedRAMP 20x figures, come from FRMR.documentation.json in FedRAMP's docs files. That repository has since been renamed docs-legacy. The file did not answer at that path on 16 September 2026. The platform holds the copy it fetched earlier instead. It holds 11 themes and 62 indicators. It also holds 474 links from indicators to controls. And it holds 351 mappings from those indicators onto NIST SP 800-53 Rev 5 controls.

On 2026-09-16, FedRAMP's current machine-readable rules file listed 46 indicators in 10 themes. That file is fedramp-consolidated-rules.json. It sits in the FedRAMP/rules repository on GitHub, version 2026.09.13.02. The platform's own copy has 62 indicators, loaded 2026-06-23. 16 of those 62 do not appear in FedRAMP's current file.

The ATO page's Why ATO table describes what our own review found across the 26 platforms we looked at on 16 September 2026. It is a scope, not a ranking. No platform is named on either page.

The Fix Engine can check 28 vulnerability classes end to end, on its own, before a fix reaches you. Nothing is changed without your approval. A finding closes only when a later, comparable scan confirms it.

The Rev 5 to 20x pageWhere the Rev 5 to 20x page's numbers come from.

You pick a baseline on the Rev 5 to 20x page: Low, Moderate or High. The page counts how many of that baseline's controls a FedRAMP 20x indicator points to. It also shows which indicators your controls back in full, in part, or not at all.

A control matches only on its exact id, so IA-2(1) never matches IA-2.

The page reads or counts every number from the files below. None is typed in by hand. The page shows the date its data was built.

1 of 4 · U.S. government work · Control catalog

NIST SP 800-53 Revision 5 catalog (OSCAL), release 5.2.0

National Institute of Standards and Technology (NIST)

Cited for the official NIST title beside each control id on the page. Each title is copied word for word. OSCAL is NIST's format for data a computer can read. The platform keeps its own copy of the catalog. NIST publishes it in its OSCAL content files. The NIST publication itself is entry 13 above.

Access — U.S. government work, public domain (17 U.S.C. §105).
2 of 4 · U.S. government program documents · Baselines

FedRAMP Rev 5 security controls baseline workbook

FedRAMP Program Management Office, U.S. General Services Administration

Cited for which controls are in each baseline. The workbook has one sheet each for Low, Moderate and High. They list 156, 323 and 410 controls. The platform keeps its own copy of the workbook. The same totals appear in the resolved profiles that the OSCAL Foundation publishes in its fedramp-resources files.

Access — U.S. government work, public domain (17 U.S.C. §105).
3 of 4 · U.S. government program documents · The indicators

FedRAMP Consolidated Rules for 2026, Key Security Indicators, version 2026.09.13.02

FedRAMP Program Management Office, U.S. General Services Administration

Cited for the 20x indicators, which FedRAMP calls Key Security Indicators, or KSIs. FedRAMP's file lists 46 indicators in 10 themes. Each indicator has a list of NIST controls. Each control on a list is one pin. The lists hold 373 pins in all.

The page reads a pin the way NIST IR 8477 reads a mapping. A relationship exists between the indicator and the control. The page does not say what kind.

The file is fedramp-consolidated-rules.json in FedRAMP's FedRAMP/rules repository. The platform uses it at the commit below. The ATO section above describes an earlier copy of FedRAMP's indicators. The Rev 5 to 20x page uses the file at this commit.

Commit 58487bda77d76d9ce334304ec2e779ece7cc7d54 · SHA-256 of the file 64915d88e72353c95f321ea4a9014516ac9441972cbd7f3d1abef7d1514c8fc8
Access — publicly published on GitHub, no registration required.
4 of 4 · U.S. government program pages · The dates

FedRAMP.gov pages on the 2026 rules and on FedRAMP 20x

FedRAMP Program Management Office, U.S. General Services Administration

Cited for the three dates the page shows. FedRAMP's What's Changing page for the 2026 rules gives all three. Its FedRAMP 20x page lists the 20x phases and the certification classes.

DateWhat FedRAMP's page says
January 1, 2027After this day, FedRAMP begins to enforce the 2026 rules.
June 11, 2027FedRAMP stops accepting new Rev 5 certifications.
December 31, 2028Existing Rev 5 certifications stay active until at least this day, unless FedRAMP is directed otherwise.
Access — publicly published, no registration required.

Two indicators, KSI-CNA-OFA and KSI-PIY-RES, have no control list in FedRAMP's file. The page shows them. It never counts them as covered. FedRAMP lists no control for either one, and that is not a claim that none applies.

The KSI ids, names and control lists are FedRAMP's published data. The page reproduces them with credit to FedRAMP. It does not reproduce FedRAMP's indicator statements.

Licensing & attributionThe legal basis for citing this way

Cited, never reproduced: IBM/Ponemon Cost of a Data Breach 2025 (Figs. 7, 9, 13–14, 39) & 2026 · Verizon DBIR · Mandiant M-Trends · CrowdStrike GTR · ITRC · CISA KEV · OMB FISMA report. Industry reports are free to read (registration) and appear here as attributed figures only — no charts or text reproduced. NIST, FedRAMP, CISA, and OMB materials are U.S. government works — public domain (17 U.S.C. §105).

This is the same licensing language that runs in the instrument page's own footer, carried over intact rather than paraphrased: the “cited, never reproduced” framing is the operative practice: figures are cited with attribution; expression, charts, and text are never reproduced — drawn from registration-gated industry reports, and the public-domain carve-out for U.S. government works is a separate legal basis that stands on its own — the two are not the same claim and shouldn't be blurred together.

Several sources in the bibliography above aren't named in that original line, because this page's bibliography is wider than what a one-line footer could carry — among them Sophos's State of Ransomware, the Bureau of Labor Statistics wage table behind every fix-cost estimate, the FedRAMP program documents behind the platform's clocks, and the sources behind the modeled ROI band described above: Coalition's Cyber Claims Report, Hiscox's Cyber Readiness Report, Sophos's 2024 backup-compromise study, and the vendor list-price pages. BLS and FedRAMP program documents are U.S. government works under the identical public-domain rule as NIST, CISA, and OMB above. Sophos's access terms are stated as published here, not independently re-verified this session in either direction.

Per-case figures — the real companies and incidents behind each anonymized scenario — are not disclosed on this page by design; see “How to read this page” for their collective attribution line. The internal mapping between a staged scenario and the real case behind it is held separately and does not render on any public page.

Recent incidents -- sources

Sources → · © 2026 Gomes Security LLC. All rights reserved. · Privacy · Terms · Accessibility
GOMESSECURITY™, GS|ATO™, GS|FixEngine™ and Compliance-as-Architecture™ are trademarks of Gomes Security LLC. FedRAMP is a mark of the U.S. General Services Administration; ATT&CK is a mark of The MITRE Corporation; all other names belong to their owners. Gomes Security LLC is not affiliated with or endorsed by any of them. For information only — dollar figures, likelihoods and forecasts are computed estimates from the cited public sources, not promises and not legal, audit or compliance advice.