← Back to FedRAMP

FedRAMP Compliance Checklist: 325+ Controls

Complete checklist covering FedRAMP Moderate baseline based on NIST 800-53 Rev 5. Essential for cloud service providers seeking federal government authorization.

Get Expert HelpTake Free Assessment
325
Controls
NIST 800-53
Based
12 Month
Process

FedRAMP Moderate Baseline Controls

325+ controls across 18 NIST 800-53 control families

AC: Access Control

AC-1: Policy and Procedures
AC-2: Account Management
AC-3: Access Enforcement
AC-4: Information Flow Enforcement
AC-5: Separation of Duties
AC-6: Least Privilege
AC-7: Unsuccessful Logon Attempts
AC-8: System Use Notification
AC-10: Concurrent Session Control
AC-11: Device Lock
AC-12: Session Termination
AC-14: Permitted Actions without Identification
AC-17: Remote Access
AC-18: Wireless Access
AC-19: Access Control for Mobile Devices
AC-20: Use of External Systems
AC-21: Information Sharing
AC-22: Publicly Accessible Content

AT: Awareness & Training

AT-1: Policy and Procedures
AT-2: Literacy Training and Awareness
AT-3: Role-Based Training
AT-4: Training Records
AT-5: Contacts with Security Groups

AU: Audit & Accountability

AU-1: Policy and Procedures
AU-2: Event Logging
AU-3: Content of Audit Records
AU-4: Audit Log Storage Capacity
AU-5: Response to Audit Logging Process Failures
AU-6: Audit Record Review, Analysis, and Reporting
AU-7: Audit Record Reduction and Report Generation
AU-8: Time Stamps
AU-9: Protection of Audit Information
AU-11: Audit Record Retention
AU-12: Audit Record Generation

CA: Security Assessment

CA-1: Policy and Procedures
CA-2: Control Assessments
CA-3: Information Exchange
CA-5: Plan of Action and Milestones
CA-6: Authorization
CA-7: Continuous Monitoring
CA-8: Penetration Testing
CA-9: Internal System Connections

CM: Configuration Management

CM-1: Policy and Procedures
CM-2: Baseline Configuration
CM-3: Configuration Change Control
CM-4: Impact Analyses
CM-5: Access Restrictions for Change
CM-6: Configuration Settings
CM-7: Least Functionality
CM-8: System Component Inventory
CM-9: Configuration Management Plan
CM-10: Software Usage Restrictions
CM-11: User-Installed Software

CP: Contingency Planning

CP-1: Policy and Procedures
CP-2: Contingency Plan
CP-3: Contingency Training
CP-4: Contingency Plan Testing
CP-6: Alternate Storage Site
CP-7: Alternate Processing Site
CP-8: Telecommunications Services
CP-9: System Backup
CP-10: System Recovery and Reconstitution

IA: Identification & Authentication

IA-1: Policy and Procedures
IA-2: Identification and Authentication
IA-3: Device Identification and Authentication
IA-4: Identifier Management
IA-5: Authenticator Management
IA-6: Authentication Feedback
IA-7: Cryptographic Module Authentication
IA-8: Identification and Authentication (Non-Organizational Users)
IA-11: Re-authentication

IR: Incident Response

IR-1: Policy and Procedures
IR-2: Incident Response Training
IR-3: Incident Response Testing
IR-4: Incident Handling
IR-5: Incident Monitoring
IR-6: Incident Reporting
IR-7: Incident Response Assistance
IR-8: Incident Response Plan
IR-9: Information Spillage Response

MA: Maintenance

MA-1: Policy and Procedures
MA-2: Controlled Maintenance
MA-3: Maintenance Tools
MA-4: Nonlocal Maintenance
MA-5: Maintenance Personnel
MA-6: Timely Maintenance

MP: Media Protection

MP-1: Policy and Procedures
MP-2: Media Access
MP-3: Media Marking
MP-4: Media Storage
MP-5: Media Transport
MP-6: Media Sanitization
MP-7: Media Use

PE: Physical Protection

PE-1: Policy and Procedures
PE-2: Physical Access Authorizations
PE-3: Physical Access Control
PE-4: Access Control for Transmission
PE-5: Access Control for Output Devices
PE-6: Monitoring Physical Access
PE-8: Visitor Access Records
PE-12: Emergency Lighting
PE-13: Fire Protection
PE-14: Environmental Controls
PE-15: Water Damage Protection
PE-16: Delivery and Removal

PL: Planning

PL-1: Policy and Procedures
PL-2: System Security Plan
PL-4: Rules of Behavior
PL-8: Security and Privacy Architectures
PL-10: Baseline Selection
PL-11: Baseline Tailoring

PS: Personnel Security

PS-1: Policy and Procedures
PS-2: Position Risk Designation
PS-3: Personnel Screening
PS-4: Personnel Termination
PS-5: Personnel Transfer
PS-6: Access Agreements
PS-7: External Personnel Security
PS-8: Personnel Sanctions

RA: Risk Assessment

RA-1: Policy and Procedures
RA-2: Security Categorization
RA-3: Risk Assessment
RA-5: Vulnerability Monitoring and Scanning
RA-6: Technical Surveillance Countermeasures

SA: System & Services Acquisition

SA-1: Policy and Procedures
SA-2: Allocation of Resources
SA-3: System Development Life Cycle
SA-4: Acquisition Process
SA-5: System Documentation
SA-8: Security and Privacy Engineering
SA-9: External System Services
SA-10: Developer Configuration Management
SA-11: Developer Testing and Evaluation
SA-15: Development Process, Standards, and Tools
SA-16: Developer-Provided Training
SA-17: Developer Security and Privacy Architecture
SA-22: Unsupported System Components

SC: System & Communications Protection

SC-1: Policy and Procedures
SC-2: Separation of System and User Functionality
SC-4: Information in Shared System Resources
SC-5: Denial-of-Service Protection
SC-7: Boundary Protection
SC-8: Transmission Confidentiality and Integrity
SC-10: Network Disconnect
SC-12: Cryptographic Key Establishment
SC-13: Cryptographic Protection
SC-15: Collaborative Computing Devices
SC-17: Public Key Infrastructure Certificates
SC-18: Mobile Code
SC-19: Voice Over Internet Protocol
SC-20: Secure Name/Address Resolution Service
SC-21: Secure Name/Address Resolution Service (Recursive)
SC-22: Architecture and Provisioning
SC-23: Session Authenticity
SC-28: Protection of Information at Rest
SC-39: Process Isolation

SI: System & Information Integrity

SI-1: Policy and Procedures
SI-2: Flaw Remediation
SI-3: Malicious Code Protection
SI-4: System Monitoring
SI-5: Security Alerts, Advisories, and Directives
SI-6: Security and Privacy Function Verification
SI-7: Software, Firmware, and Information Integrity
SI-8: Spam Protection
SI-10: Information Input Validation
SI-11: Error Handling
SI-12: Information Management and Retention
SI-16: Memory Protection

PM: Program Management

PM-1: Information Security Program Plan
PM-2: Information Security Program Leadership Role
PM-3: Information Security and Privacy Resources
PM-4: Plan of Action and Milestones Process
PM-5: System Inventory
PM-6: Measures of Performance
PM-7: Enterprise Architecture
PM-8: Critical Infrastructure Plan
PM-9: Risk Management Strategy
PM-10: Authorization Process
PM-11: Mission and Business Process Definition
PM-15: Security and Privacy Groups
PM-16: Threat Awareness Program

FedRAMP Documentation Package

Required documents for authorization

Core Documents

System Security Plan (SSP)
Security Assessment Plan (SAP)
Security Assessment Report (SAR)
Plan of Action & Milestones (POA&M)
Continuous Monitoring Plan
Incident Response Plan
Configuration Management Plan
Contingency Plan

Supporting Documentation

Policies and procedures for all 18 control families
System inventory and network diagrams
Data flow diagrams
Cryptographic modules documentation
Privacy Impact Assessment
Privacy Threshold Analysis
Digital Identity Acceptance Statement
Penetration test results and vulnerability scans

How LowerPlane Automates FedRAMP

📋

SSP Generation

Automatically generate your System Security Plan with all 325+ controls and implementation details.

🔍

Continuous Monitoring

Automated evidence collection from AWS, Azure, GCP for ongoing authorization requirements.

📊

POA&M Tracking

Track and manage your Plan of Action & Milestones with automated status updates.

Download Your Free FedRAMP Checklist

Get the complete 325+ control checklist as a printable PDF. Track your progress toward FedRAMP authorization.

Download PDF ChecklistOr Get Expert Help
No email required for PDF download. Start tracking your compliance progress today.

Related FedRAMP Resources

FedRAMP Requirements

Complete guide to FedRAMP authorization requirements

View requirements →

NIST 800-53

Detailed guide to NIST 800-53 control families

Learn more →

Cloud Authorization

Complete guide for cloud service providers

View guide →