NIST 800-53 Rev5 controls mapped to FedRAMP 20x KSIs
Browse NIST SP 800-53 Rev5 Moderate-baseline controls that map to FedRAMP 20x Key Security Indicators. Each control page shows the paraphrased intent (NIST cited), the KSIs that cover it, and the evidence scm.cc collects. Controls with no KSI mapping have no page.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
AC — Access Control
AC-17— Remote access is authorized, encrypted, and monitored (12 KSIs)
AC-2— Accounts are provisioned, reviewed, and de-provisioned through a managed lifecycle (9 KSIs)
AC-6— Least privilege is enforced for users, processes, and security functions (7 KSIs)
AU — Audit and Accountability
AU-12— Audit records are generated for all defined auditable events by system components (5 KSIs)
AU-2— Auditable events are defined and captured across the authorization boundary (4 KSIs)
AU-6— Audit records are reviewed and analyzed for inappropriate or unusual activity (5 KSIs)
CA — Assessment, Authorization, and Monitoring
CA-7— A continuous-monitoring program tracks control effectiveness and security posture (4 KSIs)
CM — Configuration Management
CM-2— Baseline configurations of the system are established and maintained (9 KSIs)
CM-6— Mandatory secure configuration settings are established and enforced (7 KSIs)
CP — Contingency Planning
CP-9— System backups are performed, protected, and tested for recoverability (3 KSIs)
IA — Identification and Authentication
IA-2— Organizational users are uniquely identified and authenticated, with MFA (3 KSIs)
IA-4— Identifiers are managed so each account maps to a unique, accountable subject (3 KSIs)
IA-5— Authenticators are managed with strength, rotation, and protection requirements (5 KSIs)
IR — Incident Response
IR-4— Incidents are handled through detection, analysis, containment, and recovery (9 KSIs)
IR-8— An incident-response plan is documented, distributed, and maintained (3 KSIs)
RA — Risk Assessment
RA-3— Risk assessments identify threats to and vulnerabilities of the system (4 KSIs)
RA-5— Systems are scanned for vulnerabilities and findings are remediated on a schedule (7 KSIs)
SC — System and Communications Protection
SC-13— Approved cryptography protects the confidentiality and integrity of data (2 KSIs)
SC-7— Boundary protection monitors and controls communications at the system perimeter (10 KSIs)
SI — System and Information Integrity
SI-2— System flaws are identified, reported, and remediated within defined timeframes (2 KSIs)
SI-4— The system is monitored to detect attacks and indicators of potential attacks (11 KSIs)